| This article summarises UK regulatory developments including the ICO’s Recruitment Rewired report, the ICO’s draft guidance on automated decision-making, and the Data (Use and Access) Act 2025. It is regulatory signal and workforce direction, not legal advice. For decisions that touch employment law, data protection or AI compliance, consult a qualified UK specialist. |
A hiring manager at a 90-person UK firm told me her company does not use automated decision-making. They use AI “just to help with the sift.”
I asked her one question. In the last six months, how many times has anyone moved a candidate up from the bottom of the AI-ranked list into the interview stage?
She did not know of a single instance.
That is the exact pattern the Information Commissioner’s Office described when it published Recruitment Rewired on 31 March 2026. Employers believe they are using AI for decision support. In practice, the tool is making the decision and a human is approving it.
If your SME uses AI anywhere in hiring, this report tells you what the regulator now expects. Here is what it found and what you need to change.
Recruitment Rewired is the ICO’s March 2026 report setting out its findings and regulatory expectations for employers using AI-enabled or automated tools in recruitment.
The full title is Recruitment Rewired: an update on the ICO’s work on the fair and responsible use of automation in recruitment. It was published on 31 March 2026.
The report draws on voluntary engagement with more than 30 employers between March 2025 and January 2026, public perceptions research, and the ICO’s earlier audits of AI recruitment tool providers and developers, first published in November 2024.
It covers automated tools used across the recruitment lifecycle:
The ICO published the report alongside draft updated guidance on automated decision-making and profiling. That consultation closed on 29 May 2026, with final guidance expected in winter 2026.
The central finding is that many employers are carrying out solely automated decision-making without realising it, because human review of AI outputs is often a formality rather than a genuine decision point.
Three findings matter most for an SME.
Employers underestimate when automated decision-making is happening. Most employers told the ICO their tools provided decision support. The evidence showed that in practice, decisions were often made solely by the tool, with no meaningful human involvement. The distinction is not about what you intended. It is about what actually happened.
Safeguards are applied inconsistently. The ICO found employers were not reliably giving candidates a route to challenge an automated recruitment decision or to request human intervention.
Human oversight is often a rubber stamp. Where a human did review the output, the review frequently added nothing. The reviewer either lacked the authority to override the tool, lacked the understanding to question it, or simply did not.
The ICO framed its guidance in support of innovation rather than against it. It acknowledges that automated recruitment tools benefit both employers and candidates. The concern is bias and the absence of oversight, not automation itself.
A human review only counts as meaningful if the reviewer has real authority to change the outcome, understands the basis of the automated output, and conducts the review before the decision is applied to the candidate.
The ICO’s draft guidance is explicit that human involvement must be active rather than a token gesture. In practical terms, the reviewer must:
| Requirement | What this means in your process |
| Have real authority | The reviewer can override the tool without needing approval from someone else |
| Understand the output | The reviewer knows what the tool scored and on what basis |
| Review before application | The review happens before the candidate is rejected, not after |
| Consider all relevant factors | The reviewer weighs the full application, not only the AI score |
| Be appropriately trained | The reviewer has been taught how to interrogate and override an AI output |
| Leave a record | The review process is documented |
One clarification in the draft guidance is easily missed and matters a great deal. A human who designs or builds the automated system does not constitute meaningful human involvement. The design happens before any real-world decision is made, so it cannot substitute for review at the point of decision.
This is where the training question becomes a compliance question. A reviewer who has never been shown how to challenge an AI output cannot provide meaningful human involvement, however senior they are. I covered what that training looks like in AI training for HR teams.
The DUAA reframed automated decision-making from a general prohibition into a right of challenge with safeguards, which gives UK employers more room to automate, provided the protections are genuinely in place.
Under the previous framework, Article 22 of the UK GDPR treated solely automated decisions with legal or similarly significant effects as largely prohibited, subject to narrow exceptions. The Data (Use and Access) Act 2025 replaced Article 22 with Articles 22A to 22D. The automated decision-making provisions came into force on 1 December 2025, ahead of the Act’s main data protection provisions on 5 February 2026.
Two practical consequences for SMEs:
The DUAA removed the previous restriction limiting automated recruitment decisions to consent or contractual necessity, provided no special category data is involved. That is a genuine loosening.
In exchange, the safeguards tighten. Where you do carry out solely automated decision-making, candidates must be able to receive information about the decision, make representations about it, obtain human intervention, and contest it.
This is not a relaxation. It is a trade. More flexibility to automate, in return for real safeguards you can evidence.
Audit where automation sits in your hiring process, decide whether each decision is solely automated, then build the safeguards and the training around the ones that are.
Five steps, in order.
1. Map your automation. List every point in your hiring process where a tool scores, ranks, filters or assesses a candidate. Include the applicant tracking system features you may not think of as AI, such as keyword filters and knockout questions. Many SMEs find automation in places they had forgotten about.
2. Test whether human involvement is real. For each automated step, ask the question I asked that hiring manager. When did a human last override the tool? If the answer is never, or nobody knows, you are likely carrying out solely automated decision-making regardless of what your process document says.
3. Assess whether you need a Data Protection Impact Assessment. The ICO expects employers using automated recruitment tools to carefully assess whether a DPIA is required. For most SMEs running AI-driven candidate scoring, the answer will be yes.
4. Build the challenge route. Candidates need a clear, usable way to contest an automated decision and request human review. Not buried in a privacy notice. In the rejection communication itself.
5. Train the reviewers and document it. The ICO’s draft guidance emphasises that reviewers must be appropriately trained and that records of the review process should be maintained. Training without documentation gives you no evidence. Documentation without training gives you no defence. You need both, and your AI policy should set out how. I covered the policy side in AI policy for employees.
If you are earlier in the journey and have not yet rolled out AI across hiring, implementing an AI hiring system sets out the sequence. If CV screening specifically is where you are starting, AI CV screening in the UK covers the mechanics.
Final ADM guidance is expected in winter 2026, with a statutory Code of Practice on AI and automated decision-making to follow.
Three dates to put in your planning calendar.
Winter 2026. The ICO’s final guidance on automated decision-making and profiling, following the consultation that closed on 29 May 2026. This will replace the draft and shape how the ICO enforces the reformed regime.
In force since 12 May 2026. The Data Protection Act 2018 (Code of Practice on Artificial Intelligence and Automated Decision-Making) Regulations 2026, known as SI 2026/425, formally require the ICO to prepare a statutory code of practice on AI and automated decision-making.
Spring 2027. The draft statutory code is currently targeted for consultation, according to evidence given by the Department for Science, Innovation and Technology to a Lords committee.
A statutory code carries more weight than guidance. It is admissible in legal proceedings and regulators must take it into account. The window between now and then is the time to get your hiring process in order without the pressure of a code already in force.
The hiring manager I opened with is now running the audit. She found automation at four points in her process, not one. Two of them were making decisions nobody was reviewing. That is not unusual for an SME, and it is not a failure. It is what happens when tools get adopted faster than processes get updated.
The ICO has signalled where it is going. The employers who move first will spend 2027 hiring. The ones who wait will spend it explaining.
Recruitment Rewired is a report published by the Information Commissioner’s Office on 31 March 2026, titled Recruitment Rewired: an update on the ICO’s work on the fair and responsible use of automation in recruitment. It sets out the ICO’s findings and regulatory expectations for employers using AI-enabled or automated tools in recruitment, based on engagement with more than 30 employers between March 2025 and January 2026.
Possibly yes. The ICO’s position is that human involvement is only meaningful if the reviewer has real authority to override the output, understands the basis of the decision, reviews it before it is applied, and considers factors beyond the automated score. A reviewer who consistently approves the tool’s output without changing it is unlikely to constitute meaningful human involvement.
Where a decision is solely automated and has legal or similarly significant effects, the candidate must be able to receive information about the decision, make representations about it, obtain human intervention, and contest the decision. These safeguards sit in Articles 22A to 22D of the UK GDPR, introduced by the Data (Use and Access) Act 2025.
The ICO’s consultation on draft ADM and profiling guidance closed on 29 May 2026, and final guidance is expected in winter 2026. A separate statutory Code of Practice on AI and automated decision-making is required under SI 2026/425, in force since 12 May 2026, with a draft code targeted for consultation in spring 2027.
The ICO expects employers using automated recruitment tools to carefully assess whether a Data Protection Impact Assessment is required. For most SMEs using AI to score, rank or filter candidates, the risk profile means a DPIA is likely to be needed. Consult a qualified data protection specialist on your specific use.
| Sabiha is a Talent Acquisition Director and Speaker with 16+ years of international hiring experience across the UK, Dubai, South Africa and Malaysia. She has advised 300+ UK SMEs on AI-enabled hiring and retention, and was shortlisted for Best Career Coach UK by the Career Development Institute. Her forthcoming book, How to Use AI to Win Talent and Retain People (Trotman), publishes Autumn 2026. |
Global Talent. Ethical AI. Strategic Hiring. Sustainable Retention.
