United Kingdom: Recruitment Rewired Guidance on AI-Assisted Recruitment (ICO)

United KingdomGuidanceIn force

The Information Commissioner's Office (ICO) "Recruitment rewired" report outlines regulatory expectations for employers and technology providers using automated decision-making (ADM) in recruitment. Updated to reflect the Data (Use and Access) Act 2025 (DUAA), the guidance clarifies that organizations can make solely automated decisions using legitimate interests, provided they do not process special category data without an additional legal condition. It requires employers (deployers) to either implement meaningful human involvement at every stage of the decision-making process or apply strict ADM safeguards, including providing candidates with information about the logic involved and the right to contest decisions. The guidance focuses entirely on employment-related provisions. It mandates Data Protection Impact Assessments (DPIAs) for high-risk processing, clear transparency notices, and fair processing that mitigates bias. While it does not ban ADM or require independent third-party bias audits, it strongly expects ongoing bias monitoring, robust vendor due diligence, and explicit contractual instructions between deployers and providers.

Impact

What this means for HR and vendors

HR and recruitment teams

HR teams must ensure they identify a lawful basis, such as legitimate interests, before deploying AI tools. With the DUAA changes, HR can rely on solely automated decision-making but must apply specific safeguards, including allowing candidates to contest decisions and understand the logic involved. If not using these safeguards, HR must ensure meaningful human involvement - meaning a human actively reviews and can overturn decisions, rather than rubber-stamping. This increases the importance of completing DPIAs, monitoring for bias, and providing detailed transparency notices to candidates.

HR technology vendors

HR technology providers must clearly define whether they act as a data controller or processor and follow the deployer's explicit processing instructions. Providers are expected to support deployers by offering transparent technical information about the AI's logic to help employers fulfill candidate transparency requirements. Providers should proactively monitor the demographic characteristics of training data to mitigate bias and provide evidence of ongoing information security controls.

Key obligations

What organizations need to do

Practical obligation briefings focused on what the requirement is, who it applies to, when it applies and what teams should consider doing.

DeployerImpact & Risk Assessment

Bias Monitoring and Fairness Evaluation

OBLIGATION

APPLIES TO

STATUS

Stay ahead of AI hiring compliance before it lands.

Free alerts on the regulation, litigation and incidents shaping AI in hiring.

Not legal advice

This page is regulatory intelligence only. Organizations should seek guidance from legal counsel before making compliance decisions.

Employment-focused extraction

This may be part of wider regulation. The Warden Watch extracts and displays the parts relevant to employment, HR and recruitment decision-making.

HR and recruitment teams

HR technology vendors

Data Protection Impact Assessment (DPIA)

Automated Decision Safeguards

Meaningful Human Involvement

Transparency & Notice

Identify and Document Lawful Basis

Bias Monitoring and Fairness Evaluation

Stay ahead of AI hiring compliance before it lands.

Manage Consent Preferences