UK ICO Publishes Automated Decision-Making in Recruitment Report and Calls on Employers to Review AI Hiring Practices, UK, March 2026

On March 31, 2026, the UK Information Commissioner's Office (ICO) published a report on the use of automated decision-making (ADM) in recruitment, accompanied by draft guidance addressed to employers. The action is at the report and draft guidance stage; the guidance is open for stakeholder input and no enforcement notices have been issued. The ICO simultaneously wrote to 16 named organisations likely to be using ADM in hiring decisions, and those organisations have committed to acting on the ICO's recommendations.

The governing authority is the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. The specific provisions engaged are UK GDPR Article 22, which restricts solely automated decisions that produce legal or similarly significant effects on individuals, and the transparency obligations in UK GDPR Articles 13 and 14 requiring disclosure when automated decisions are made. The Data (Use and Access) Act 2025 amended the legal framework applicable to ADM by introducing new provisions on lawful bases for such processing; the ICO's guidance reflects that updated statutory position.

Employers in the UK who use algorithms or AI tools to screen, score, or rank job applications — including applicant tracking systems, psychometric assessment platforms, and AI-powered CV review tools — must now comply with the ICO's stated expectations. Those obligations include: testing automated tools regularly for bias against protected characteristics; clearly disclosing to candidates when ADM is used and how it affects their application; and providing candidates with the right to request human review of automated outcomes. Organisations that received the ICO's direct letter face a commitment to implement specific improvements within a defined period.

The draft guidance is open for input, and the ICO indicated that updated final guidance will follow. The report notes that 70% of UK employers anticipate increasing their use of AI in recruitment over the next five years, placing a large and growing class of businesses within scope. The guidance does not introduce new law but consolidates the ICO's interpretation of existing UK GDPR obligations as applied to the recruitment context. Non-compliance with Article 22 exposes controllers to enforcement action including reprimands and monetary penalties under the Data Protection Act 2018 Schedule 2.

Prokopiev Law Group advises on AI regulatory compliance, UK GDPR obligations, and automated decision-making governance; our partnership network includes UK data protection specialists and technology law practitioners able to support employers in auditing recruitment tools and drafting required disclosures. Contact us to discuss your specific situation. Our work covers AI in employment, UK GDPR Article 22 compliance, data protection impact assessments for AI systems, automated hiring governance, and bias testing protocols.

Source: ICO, "Here's what jobseekers need to know about automated recruitment decisions," News Release, March 31, 2026, https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/03/here-s-what-jobseekers-need-to-know-about-automated-recruitment-decisions/. Confirmed April 14, 2026.

The information provided is not legal, tax, investment, or accounting advice and should not be used as such. It is for discussion purposes only. Seek guidance from your own legal counsel and advisors on any matters. The views presented are those of the author and not any other individual or organization. Some parts of the text may be automatically generated. The author of this material makes no guarantees or warranties about the accuracy or completeness of the information.