The Information Commissioner’s Office (ICO) has warned employers that their use of automated decision‑making (ADM) in recruitment must be matched with “transparent, fair and accountable” practices and launched a consultation on its draft ADM guidance
In its report Recruitment rewired: an update on the ICO’s work on the fair and responsible use of automation in recruitment, published on 31st March, the regulator said that reforms under the Data (Use and Access) Act 2025 will make it easier for organisations to deploy automated systems without human involvement.
While this is a development that it said that it broadly supportive of, the ICO’s William Malcolm, Executive Director for Regulatory Risk and Innovation, cautioned that unlawful or poorly designed automation – such as CV‑sifting algorithms to automated scoring of online assessments - could result in unfair or biased outcomes for candidates.
Responsible adoption, he said, depends on employers maintaining strong safeguards and being upfront with candidates about how their data is being used.
Over the past year, the regulator has engaged with more than 30 employers to understand how ADM is being implemented. This found efficiency gains, particularly at early screening stages, but also identified a number of common weaknesses: limited transparency, inconsistent human oversight, and insufficient checks for bias. Following this review, 16 organisations received letters outlining required improvements.
Public focus groups arranged by the ICO revealed widespread concern about automated decisions made without meaningful human involvement. Participants highlighted fears that opaque algorithms could amplify existing biases or exclude candidates without explanation.
The OCO found that many of those employers engaging in automated recruitment are likely relying on solely automated decisions as part of this process, without human involvement. This, it said, places these decisions within the scope of the provisions on solely automated decision-making in the UK General Data Protection Regulation. For this reason, a greater range of safeguards will need to apply than our evidence suggests are currently in place.
The regulator said employers wishing to deploy ADM in recruitment must meet three core expectations:
- Proactively monitor for bias – Regular testing for discriminatory outcomes, scrutiny of vendors’ bias‑mitigation processes, and ongoing review of automated outputs (with monthly reviews identified as good practice).
- Be transparent with jobseekers – Clearly explain where and how automation is used, including the logic of the system in accessible terms.
- Explain rights to recourse – Make sure candidates know how to challenge decisions and request a human review where they believe an error has occurred.
Alongside the report, the ICO launched a consultation on its draft ADM guidance, which runs until 29 May. The guidance is intended to give organisations greater clarity on when ADM can be used lawfully and the safeguards required under the revised legislation. The consultation document can be found at https://ico.org.uk/about-the-ico/ico-and-stakeholder-consultations/2026/03/ico-consultation-on-the-draft-guidance-about-automated-decision-making-including-profiling/
The ICO’s latest work builds on its wider AI and biometrics strategy. In 2024, the regulator audited several recruitment‑technology providers and developers, issuing nearly 300 recommendations to improve legal compliance.
