ICO warns businesses over use of automated hiring tools

The Information Commissioner’s Office (ICO) has urged organisations to review their use of automated decision-making (ADM) tools in recruitment, warning that safeguards are essential as AI and automation become more common in hiring.

The call follows changes introduced under the Data (Use and Access) Act 2025, which updated UK data protection legislation to make it easier for businesses to use automated decisions without human involvement, provided appropriate protections are in place.

ADM tools are increasingly used to streamline recruitment, from screening CVs to scoring online assessments. The ICO said that while the technology can help employers manage high volumes of applications more efficiently and consistently, it also carries risks, including potential bias and a lack of transparency if deployed incorrectly.

In a report published this week, the ICO set out its expectations for organisations using automation in hiring, emphasising the need for fairness, transparency and clear processes for candidates to challenge decisions.

Over the past year, the ICO said it has engaged with more than 30 employers to better understand how automated tools are used in recruitment. The findings showed automation is most commonly applied in early-stage candidate filtering, where organisations reported efficiency gains. However, the ICO identified a need for improved transparency, stronger bias monitoring and clearer rules around human oversight.

The ICO said organisations using automated decision-making should proactively monitor systems for bias, clearly inform candidates when automation is used, and provide straightforward routes for individuals to challenge decisions and request human review.

The regulator also wrote to 16 organisations believed to be using automated decision-making in recruitment, which have since committed to improving their practices in line with the ICO’s recommendations.

Public focus groups conducted as part of the ICO’s research highlighted concerns among jobseekers, particularly around automated decisions made without human involvement and the risk of amplifying existing biases.

William Malcolm, executive director for regulatory risk and innovation at the ICO, said that jobseekers want to work for an employer they can trust, and that this trust is built and maintained by using people’s personal information fairly and respecting their rights.

“Use of AI and automation is rapidly transforming recruitment across the UK – from helping sift CVs to scoring online assessments,” he added. “We want to support organisations to comply with recent changes to the law when using these tools.

“But safeguards to protect jobseekers are essential – they are fundamental to maintaining public trust.”