UK GDPR Articles 22A–22D came into force on 5 February 2026. In March, the ICO reported that employers who believed they were using AI as decision support were, in practice, often making solely automated decisions — and wrote to 16 of them.
Six questions about how you hire and what you use. They tell us whether these obligations reach you, and what putting it right would involve.
Express your interest →No card details. No obligation. Stephanie reads every one herself — and will say so if we are not the right fit. See our Privacy Notice.
Articles 22A–22D — inserted by the Data (Use and Access) Act 2025 — set out when automated decision-making in hiring is lawful, and what meaningful human review actually has to look like. The distinction that matters is not whether a person is involved. It is whether that person sees enough, and has enough authority, for the decision to be theirs.
In its Recruitment Rewired report of 31 March 2026, the ICO reported that employers it engaged with often believed they were using AI only as decision support, while in practice decisions were being made with no meaningful human involvement. It wrote to 16 organisations it considered likely to be making automated decisions without adequate safeguards, obtained commitments that they would act, and said it will not hesitate to take further action if necessary. Separately, its 2024 audits of AI recruitment tool providers produced close to 300 recommendations, including on tools that allowed filtering by protected characteristics and inferred ethnicity from candidate names.
To be clear about where this stands: no UK recruitment agency has been publicly fined for automated decision-making in hiring. What exists is a regulator that has set out its expectations, told named organisations it thinks they fall short, and said what happens next. The gap between being told and being enforced against is the window in which records get put in order.
Two further points that catch agencies out. Since 19 June 2026, the DUAA 2025 has required every UK controller to operate a structured complaints process — a route a rejected candidate can use to challenge a decision they do not understand. And under the Equality Act 2010, liability for a discriminatory outcome rests with the employer who used the tool, not only the supplier who built it. “Our vendor handles compliance” is not a defence available to you.
The ICO engaged with employers on automated decision-making in recruitment and issued specific compliance recommendations.
Read article → June 2026Escalating regulatory scrutiny of AI hiring tools — from CV screening to video interview analysis.
Read article → June 2026The DUAA 2025 formal complaints process came into force on 19 June 2026. Here's what it requires.
Read article → June 2026How the Data (Use and Access) Act 2025 reshapes the automated decision-making framework for hiring.
Read article → May 2026The ICO warns employers that CV-screening and candidate-ranking tools may already breach data protection law.
Read article → April 2026Where the line falls between AI as decision support and AI as the decision-maker — and why getting it wrong is costly.
Read article →Scroll for more →