AI in recruitment

Sourcing tools search job boards, professional networks and an employer's own past applicants, then suggest people who resemble a target profile. Advertising tools decide who sees a vacancy in the first place.

Screening tools parse CVs and application answers, summarise them and often score or rank candidates against the role. This is where most volume, and most risk, sits.

Assessment covers online tests, game-based exercises and recorded video interviews that are analysed by software. Scheduling assistants handle the least contentious job: finding interview slots and sending reminders.

The ICO's 2024 audit of AI recruitment tools describes the same pattern: tools used to source potential candidates, summarise CVs and score applicants. The government's Responsible AI in Recruitment guide organises its advice around the same sourcing, screening, interview and selection stages.

Section 80 of the Data (Use and Access) Act 2025 substitutes new Articles 22A to 22D into the UK GDPR. A decision is 'based solely on automated processing' where there is no meaningful human involvement, and it is 'significant' if it has a legal or similarly significant effect on the person.

Under the commencement regulations, section 80 came into force on 5 February 2026. Decisions taken before that date under the old Article 22 are saved under the previous rules.

Where a solely automated significant decision is made, the safeguards must include giving the person information about it, letting them make representations, letting them obtain human intervention and letting them contest the decision. Using special category data, such as health or ethnicity, for these decisions remains restricted.

For hiring, an automatic rejection at the screening stage is very likely to be a significant decision. A reviewer who simply clicks through a ranked list is unlikely to count as meaningful human involvement, because the Act asks you to consider the extent to which the outcome was reached by profiling.

The Responsible AI in Recruitment guide from the Department for Science, Innovation and Technology is written for a non-technical audience and for organisations with or without an AI strategy.

It names the risks plainly: perpetuating existing biases, digital exclusion, and discriminatory job advertising and targeting. Its answer is assurance, meaning evidence gathered at each stage rather than a vendor's assurance on a sales call.

In practice that means asking what the tool is for, what data it was built and tested on, how it performs across groups, and how a candidate who cannot use it will be treated. It also means a pilot with real roles before wider roll-out.

Our page on AI recruitment tools turns this into an evaluation checklist; this guide stays with the stages and the law.

Map your hiring process and mark every point where software ranks, filters or decides. Scheduling and drafting job adverts are sensible early uses; automated rejection is not where to start.

Run the DPIA early and agree, in contract, who is controller and who is processor; the ICO's guidance on controllers and processors sets out the test.

Then train the recruiters and hiring managers who will use the tools: what the score means, when to override it and how to record why. Our AI training for recruiters does this on your own vacancies and systems, and AI training for HR covers the wider people team.

predeploy does not supply or certify recruitment tools and cannot promise that a tool is lawful. We help teams use AI well and keep the evidence that shows they did.