A founder showed me her new hiring setup a few weeks ago. Fifteen people on the payroll, plans to reach sixty, one HR lead working three days a week. She had bought a tool that, in her words, handled the whole top of the funnel. It found candidates, wrote to them, replied when they replied, booked the calls, and dropped a ranked shortlist into her inbox on Friday mornings.
She was thrilled with it, and I could see why. Then I asked who had turned down the eighty or so people who never reached that shortlist. She thought about it and said she assumed the system had flagged them and someone would have taken a look.
Nobody had taken a look. There was nobody in the process to look.
Software that runs a sequence on its own behalf is arriving in hiring faster than most UK SMEs have had a chance to think about it, and the Information Commissioner’s Office has already set out where it is looking. The useful thing to do is to work out what your own tools are quietly deciding, before anybody else asks you.
| Scope note. This article is written from hiring practice, not from law. I am a talent acquisition practitioner, not a lawyer. What follows describes the direction UK regulators are signalling and the questions I would put to a client in the room. Where your own use of technology raises a legal question, a qualified data protection specialist can advise you on your specific circumstances. |
An agent is handed a goal rather than a task, and then works out the steps for itself.
Your applicant tracking system parses a CV when a person asks it to. Your scheduling tool sends an invitation when someone triggers it. Every step waits for a human hand. That is automation, and most SMEs have been running some version of it for years.
An agent works differently. You give it an outcome, something along the lines of build me a shortlist for this role, and it decides the sequence. It searches, writes to people, reads the replies and writes again. It screens what comes back, ranks it, and books time in a diary. Nobody triggers each step, because the point is that nobody has to.
The ICO describes agentic AI as generative AI combined with additional tools and new ways of interacting with the world, which lets systems take on more open-ended tasks. That reaches well beyond hiring, but it explains why hiring is an obvious early use. Recruitment is a long chain of small, repeatable steps with a clear finish line, which is close to a perfect shape for this technology. The ICO set out its early thinking in its Tech Futures report on agentic AI, published in January 2026.
For a business of 51 to 200 people this lands differently than it does for a company with a recruitment function. You do not have three recruiters and a coordinator whose judgement sits between the software and the candidate. You might have one person handling hiring alongside payroll and onboarding. When an agent runs the top of the funnel, it is not one tool among many. It is the function. If you are still choosing between products, our guide to AI recruitment software for UK businesses covers that separately.
Because more autonomy means more decisions get taken without anyone choosing to take them that way.
In January 2026 the ICO published its Tech Futures report on agentic AI, becoming the first data protection regulator anywhere to set out a position. The report is exploratory rather than binding, which is what makes it worth reading. It shows what the regulator is thinking before that thinking hardens into guidance.
One item on its list of novel risks matters more than the rest for anyone hiring. The ICO points to rapid automation of increasingly complex tasks resulting in a larger amount of automated decision-making. The more a system does under its own steam, the more decisions end up being made without a person involved, whether or not that was anybody’s intention when the tool was bought.
The report also names three patterns that make an agent risky. Systems with no clear purpose. Systems connected to databases they do not need for the task in hand and the ones with no way to secure access, monitor what is happening, or stop it. Every one of those is a question a founder can put to a vendor on a first call.
None of this is settled, and the ICO says so itself. Agentic AI sits on its published plan for new and updated guidance, alongside an update to its guidance on automated decision-making and profiling. That page shows the stage each piece has reached and when a final version is expected, and the dates on it have moved before. It is the one place worth checking directly rather than trusting a timetable you read somewhere else.
The question is not whether a person sits somewhere in the process. It is whether that person could realistically have changed the outcome.
On 5 February 2026, section 80 of the Data (Use and Access) Act 2025 came into force and replaced Article 22 of the UK GDPR with new Articles 22A to 22D. The statute treats a decision as based solely on automated processing where there is no meaningful human involvement in taking it. Article 22C sets out safeguards around significant decisions, including giving people information about the decision, letting them make representations, ask for human intervention, and contest the outcome.
Practitioners broadly read the change as moving from a general prohibition towards a permissive approach built on safeguards, with tighter rules retained where special category data is in play. More room to automate, on condition that you can show your working. I am not going to tell you how that applies to your business. What I can tell you is what the regulator found when it went and looked.
In March 2026 the ICO published Recruitment Rewired, drawing on voluntary engagement with more than thirty employers between March 2025 and January 2026. Most of them considered it unlikely that they were using automated decision-making in recruitment at all. The ICO concluded that several of them were. It then wrote to sixteen organisations it identified as likely to be making automated decisions about candidates, and all sixteen committed to acting on its recommendations.
That finding is the most useful thing in the whole report. The employers who fell short were not careless. They were confident. Being sure you are not doing this is not evidence that you are not doing it.
The ICO is signalling that human involvement needs to be active and genuine, carried out by somebody with the authority, the discretion and the competence to change the outcome before it takes effect. A manager approving a ranking they have no real scope to overturn is not the safeguard it appears to be.
Agents make this harder in one specific way. When the chain sources, screens, ranks and books, the first moment a human being meets a candidate is the interview. Everybody who did not get that far was filtered by the sequence, and nobody saw them.
Anything that removes a candidate, and anything you would struggle to explain to them afterwards.
Here is the split I use with clients, and it has held up well.
Let the agent do the work that carries no judgement. Searching for candidates. Drafting outreach for a person to approve. Sending follow-ups. Chasing replies that have gone quiet. Booking time. Keeping records straight. This is the part that eats an SME hiring lead’s week, and handing it over is a genuine gain.
Keep a person on anything that closes a door. Rejections. Any ranking that determines who gets seen. Any score that touches assessment. The decision to progress. Not a person who signs off a list, but a person who has the time and the standing to disagree with it, and who sometimes does.
Three things make that split hold in practice.
Then give candidates a route to ask why they were turned down. Not because a form is expected of you, but because if nobody in your business can answer that question, you have found the weak point in your process. Our guide to implementing AI in hiring for UK SMEs sets out the wider rollout sequence.
Map what your tools already decide, while you still have time to change it quietly.
There is a window here and it is worth using. Guidance that has not been finalised cannot be enforced against, which makes anything you do at this stage preparation rather than repair. Work done ahead of time is cheap. The same work done in answer to a complaint is not.
Four things are worth doing, and none of them needs a consultant.
None of this slows your hiring down. It is the same discipline that makes hiring work anyway, pointed at a new kind of tool. The businesses that get caught out by this will not be the ones that moved quickly. They will be the ones that never checked what they had already handed over.
UK data protection law was changed on 5 February 2026, when section 80 of the Data (Use and Access) Act 2025 replaced Article 22 of the UK GDPR with Articles 22A to 22D. Practitioners read the change as moving towards a permissive approach built on safeguards rather than a general prohibition, with tighter rules kept where special category data is involved. Final ICO guidance on automated decision-making and on agentic AI was still in progress when this article was written, so its guidance plan is the place to check the current position. A qualified data protection specialist can advise on your specific circumstances.
Automation performs a task when a person triggers it. An agent is given an outcome and decides the sequence of steps needed to reach it, including steps nobody specified in advance. The practical difference for hiring is that the number of points where a human touches the process falls, often without anyone noticing that it has.
The ICO is signalling that it means active, genuine involvement by somebody with the authority, discretion and competence to change an outcome before it takes effect. Approving a ranking you have no realistic scope to overturn, or reviewing volumes nobody could sensibly review, is where the regulator has indicated the line sits.
The ICO keeps a public plan for new and updated guidance which shows the stage each piece has reached and when a final version is expected. Agentic AI guidance and the update to its automated decision-making and profiling guidance both sit on it. Dates on that page have shifted before, so check it directly rather than relying on a figure quoted elsewhere.
The obligations in UK data protection law do not scale down by headcount, but the effort involved does. For a business of 51 to 200 people, the work described in this article is a written paragraph explaining what each tool is for, a list of which tools can reject someone, a named person for each, and a readable record. That is an afternoon, not a project.
Sabiha is a Talent Acquisition Director, speaker and author with more than 16 years of hiring experience across the UK, Dubai, South Africa and Malaysia. She helps UK organisations move past reactive hiring and build workforce strategies that hold up for the long run, using AI alongside human judgement. Shortlisted as Best Career Coach UK by the CDI, she has helped businesses improve the way they hire and retain talent.
Global Talent. Ethical AI. Strategic Hiring. Sustainable Retention.
