Skip to main content

Recruitment rewired: an update on the ICO’s work on the fair and responsible use of automation in recruitment

Contents

Executive summary

As part of our AI and biometrics strategy, published in June 2025, we’ve made the use of automated decision-making (ADM)1 in recruitment a key regulatory focus. In our plan of action, we’ve committed to: 

  • scrutinising major employers’ and recruitment platforms’ use of ADM in recruitment to identify risks related to:
    • transparency;
    • discrimination; and
    • fixing misuse;
  • publishing findings and regulatory expectations; and
  • holding employers to account if they fail to respect people’s information rights.

This report sets out our findings to date and our regulatory expectations based on those findings. The report is based on evidence gathered from over 30 employers that voluntarily talked to us between March 2025 and January 2026. We’ve seen many examples of how employers use automation to make or support recruitment decisions. We thank those employers for their help. 

Automated recruitment tools have a role to play in helping candidates and employers alike. For instance, they can enable employers to process high volumes of applications consistently and quickly. We support innovation in the use of these new tools. As we set out in our January 2026 letter to government 2, we are guided by three key principles: 

  • Maximise clarity - helping organisations understand what the law enables so they can innovate confidently and avoid unnecessary risk aversion
  • Reduce friction - removing unnecessary regulatory burdens and costs.
  • Build public trust in the responsible use of data - increasing safe adoption of new and emerging technologies.

Our public perceptions research  also shows that the public can see the value in these tools when they are used appropriately. For example, the people we surveyed accepted that ADM can help create fairer and more consistent choices with less bias, and they were generally comfortable with its use for activities such as filtering CVs.

However, we also recognise the risks these tools can pose to people. Reducing these risks allows candidates and employers to have a better mutual understanding of the benefits and risks of ADM in recruitment, and therefore greater trust in how these technologies are used.

Our public perceptions research 3 also showed that whilst people accept that ADM can help remove bias and unfairness, they were also concerned that it could have the opposite effect by introducing new biases and unfairness to the process. People were particularly wary of more profiling-based automation, such as online behavioural assessments.

Our key finding is that many employers engaging in automated recruitment are likely relying on solely automated decisions as part of this process. This means they’re using solely automated systems without meaningful human involvement, and the decisions these systems take have legal or similarly significant effects on people. This places these decisions within the scope of the provisions on solely automated decision-making in the UK General Data Protection Regulation (UK GDPR). For this reason, a greater range of safeguards will need to apply than our evidence suggests are currently in place. 

Our findings also suggest that:

  • employers must improve their transparency measures to ensure they adequately inform candidates about the use of ADM, including any solely automated decisions, in the recruitment process;
  • where employers are including meaningful human involvement in their recruitment processes, they must ensure that it is applied consistently to all candidates within a hiring stage to ensure fair treatment and compliance; and
  • employer’s should expand and adopt good practice in monitoring for fairness and bias.

The findings in this report are based on established guidance and arise from voluntary engagement, not an audit or investigation. This report is a call to action for employers to ensure that they apply data protection law correctly as they adopt new practices and technologies. We hope that these findings and practical examples will serve as a useful resource for employers on that journey. 

 


 

 

1 When we use the term 'ADM' in this report, we mean decisions based solely on automated processing of personal information that produce legal or similarly significant effects on individuals. For more information about what ADM is, please see the “What is ADM, and why does it apply in a recruitment context?” section of this report, as well as our guidance on ADM.

 

 2 Letter to government

 3 Understanding public perceptions towards automated decision-making in recruitment