This article discusses buying AI recruitment software from a talent acquisition perspective. It references the UK regulatory environment as context, but is not legal advice. For specific compliance decisions, consult a qualified UK data protection or employment law specialist.
A Head of People at a ninety person software business forwarded me a screenshot last spring. It was a vendor pricing page for an AI screening tool, with a one line note underneath from her managing director. Looks good. Can we start Monday?
She had four working days. No data protection officer. No procurement function. Three shortlisted vendors who all used the word fair somewhere on their homepage, and not one of whom had been asked to prove it.
That is where most UK SMEs sit. Not resisting AI. Not reckless about it either. Just making a significant purchase without the scaffolding a large employer would have, and no obvious place to begin.
There is a place to begin, and it costs nothing. The Information Commissioner’s Office has published a short set of questions for organisations procuring AI tools for recruitment. In my experience, almost nobody buying these tools has read them.
Most of these tools sit at the very top of your funnel, where the volume is. That is also where a single design flaw repeats itself several hundred times before anyone in the business notices.
The ICO published a report called Recruitment Rewired on 31 March 2026, based on voluntary engagement with more than 30 employers between March 2025 and January 2026. Employers reported real benefits from automation, and it tended to be applied at the early stages of hiring. Sifting. Ranking. Scoring. Sometimes rejecting outright.
Adoption in the UK is still uneven. The CIPD Resourcing and Talent Planning report 2024 found 31 per cent of organisations using AI in recruitment, up from 16 per cent in 2022, with around four fifths of SMEs not using it at all. The next edition is due in autumn 2026, so treat those as the most recent full picture rather than today’s number. What they tell you is simple. Most SMEs buying this software in 2026 are buying it for the first time. Nobody in the room has done this before.
One finding from the ICO’s public perceptions research is worth carrying into vendor conversations. People were broadly comfortable with automation filtering CVs, and noticeably more wary of profiling based automation such as online behavioural assessments. Candidates draw a line where a tool starts inferring things about them rather than reading what they wrote.
Six questions, published free, and they work just as well as a vendor scorecard as they do as a compliance prompt.
The ICO issued these alongside its November 2024 audit of AI recruitment tool providers, in which the regulator made almost 300 recommendations, all of which were accepted or partially accepted. Paraphrased into buyer language, and with what a weak answer tends to sound like:
These are framed around data protection, but they do commercial work too. A provider who cannot answer the third question inside a minute is one whose contract will cost you weeks later.
Because when a contract is vague about who is accountable, the gap tends to land with the employer.
The ICO’s audit of providers found several had identified themselves as processors when their role suggested otherwise, and that some had attempted to pass responsibility for compliance across to the recruiter. In other cases the contractual allocation of responsibilities was simply unclear.
For an SME this is the highest value thing to settle before signing, because it is the hardest to renegotiate afterwards. Ask in writing. Get the answer into the contract rather than an email thread. If the provider is acting as your processor, they should be working to explicit written instructions from you, which means somebody on your side has to decide what those instructions are.
The ICO also notes that buyers can set performance measures in the contract, including statistical accuracy and bias targets. Very few SMEs do this. It is one of the few real levers a smaller buyer has.
Ask your recruiter one question. When did you last overturn what the tool recommended, and what happened after you did?
If the honest answer is never, you do not have human oversight. You have a person clicking through a list.
The law moved here recently. Section 80 of the Data (Use and Access) Act 2025 came into force on 5 February 2026 and replaced the old Article 22 of the UK GDPR with a new framework at Articles 22A to 22D. Article 22A defines automated decision making as a decision based solely on automated processing, meaning no meaningful human involvement, which has a legal or similarly significant effect on a person.
The ICO’s key finding in Recruitment Rewired was that many employers using automated recruitment are likely relying on solely automated decisions without meaningful human involvement, which brings a wider set of safeguards into scope than its evidence suggested were in place. The regulator is careful to say those findings came from voluntary engagement rather than an audit, and frames the report as a call to action. Read it as a signal of direction, not an enforcement notice.
Two practical things to test in the demo. Can the reviewer see the candidates the tool has filtered out, or only the ones it surfaced. And is there a working route for a recruiter to flag that the tool got something wrong. The ICO’s provider audit found instances where a tool relied on recruiters spotting poor matches, without that expectation being made clear to them and without any mechanism to report it.
Ask for documentation rather than reassurance. Every provider in the market will say the word fair.
The provider audit found some tools were not processing personal information fairly. Examples included search functionality that let recruiters filter out candidates with certain protected characteristics, and tools that inferred gender and ethnicity from a candidate’s name.
On accuracy, one audited provider had not formally assessed the accuracy of its tool at all, taking the view that performing better than random was a sufficient basis to process personal information. The ICO’s position was that better than random would usually not be enough where AI is actively making recruitment decisions without human intervention.
In its March 2026 material the ICO set out good practice for employers, which includes asking developers about their own bias testing at the procurement stage and considering monthly bias reviews once a tool is live. Four follow up questions make that concrete. What did you test. On what population. When did you last test it. What did you change as a result.
A provider with a genuine answer will send you a document. A provider without one will send you a case study.
Bring your own data. A curated demo tells you about the vendor’s best case, not about your hiring.
Take a batch of applications from a role you filled last year, where you already know how it turned out. Run them through. Then look at the bottom of the list rather than the top. The candidate you eventually hired sitting at rank forty is the most useful thing a demo can show you, and it will never appear in the vendor’s own dataset.
Three more questions for the same session. What happens to candidate data when the contract ends. Is our applicants’ information used to train your model, or to market other roles to them. And can I see the exact privacy wording a candidate will read.
That second one is not theoretical. The ICO audit found some tools collecting far more personal information than necessary, in some cases scraping job networking sites and social media to build large databases of potential candidates, and retaining that information without the candidates’ knowledge. Your applicants are the asset in that arrangement, and your brand carries the cost if it surfaces.
Narrow and slow. One hiring stage, one family of roles, a named human owner, and a review date already in the diary.
Start where volume is highest and individual stakes are lowest, which for most SMEs means initial sift rather than final stage selection. Write down what you decided and why, and keep that record to a page. Tell candidates in plain English that automation is used and at which point. Give them a route to ask for a human to look again.
The ICO has said it plans to update its recruitment and selection guidance during 2026, and a statutory code of practice on AI and automated decision making is in preparation following regulations made earlier this year. Final ADM guidance is still pending as this is published, so anyone citing settled rules is ahead of the evidence. The direction of travel is towards documentation, transparency and demonstrable human involvement rather than prohibition.
That direction is good news for a smaller employer, because everything it rewards is cheap to do at your size and expensive to retrofit at scale. If you are still building the wider process this software will plug into, start with how to implement AI in hiring as a UK SME. If screening is the specific stage you are buying for, the practical detail sits in AI CV screening in the UK.
The Head of People with four days did not buy anything that Monday. She sent all three vendors the same six questions. Two answered inside a week. One never replied, which told her everything the demo had not.
Using AI in recruitment is not prohibited in the UK. The rules that attract most attention concern decisions made solely by automated means with no meaningful human involvement, which sit under Articles 22A to 22D of the UK GDPR following changes that took effect on 5 February 2026. Where those rules apply, additional safeguards come into scope. Whether a particular tool and a particular process fall within them is a question for a qualified specialist who can look at your actual setup.
The ICO has been consistent that transparency is central to its expectations. Its March 2026 material says organisations need to be clear with candidates when automated decision making is used, explain how it works, and tell people how to challenge a decision and request a human review. Beyond the regulatory position, the commercial case is straightforward. Candidates who discover automation after the fact tend to talk about it publicly.
The ICO lists completing a DPIA as the first of its procurement questions and notes it is best carried out before a tool is used, ideally at the procurement stage. Its recruitment report also indicates that a DPIA is likely to be required where automated decision making is used in hiring. Whether one is required in your specific circumstances is a judgement to take with a data protection specialist rather than from a blog.
AI assisted means a person considers the output and can reach a different conclusion. Fully automated means the system decides and nobody meaningfully intervenes. The distinction is not what your vendor calls it. It is whether the human in your process has the information, the authority and the time to disagree, and whether that review is applied consistently to every candidate at that stage rather than to a sample.
Sabiha is a Talent Acquisition Director, speaker and author with more than 16 years of international hiring experience across the UK, Dubai, South Africa and Malaysia. She has advised over 300 businesses on hiring and retention, and was shortlisted for Best Career Coach UK by the Career Development Institute. She writes and speaks on AI enabled hiring systems, skills-based recruitment and retention strategy for UK organisations.
Global Talent. Ethical AI. Strategic Hiring. Sustainable Retention.
