ICO guidance on AI and automated decision-making (ADM) in recruitment

This article explains the ICO’s draft guidance on automated decision-making, what meaningful human involvement requires, and the safeguards that employers must provide when the rules apply.

This article is for general information and does not provide legal advice. It reflects the sources reviewed as at 9 October 2026 and uses the ICO’s draft guidance on automated decision-making. The guidance may change before it is final. Check the latest law and ICO guidance, and get advice from a qualified legal adviser about your specific circumstances.

1. Status of the guidance

• The ICO AI page gives links to two main guides. They are “Artificial intelligence (AI) and data protection” and “Explaining decisions made with AI”. ico
• The “AI and data protection” guide is under review because the Data (Use and Access) Act 2025 (DUAA) changed the law. Its text about Article 22 shows the old law. ico
• On 31 March 2026, the ICO published draft ADM guidance that shows the DUAA changes. The public consultation closed on 29 May 2026. icoico
• The ICO page still shows that the guidance is a draft. The ICO will withdraw the old guidance when the new guidance is final. ico
• The new ADM law is already in force. It started on 5 February 2026. burges-salmon

Note: The text below uses the draft ADM guidance. The ICO can change it before it is final.

2. When do the ADM rules apply?

The ADM rules apply only when all three of these conditions are true: ico

• A system makes a decision about a person. ico
• The decision is a “significant decision”. This means that it has legal effects or similarly significant effects. ico
• The decision is “solely automated”. This means that no human has a meaningful part in the decision. ico

A decision must include an evaluation or analysis of personal data. If a system only applies a rule that a human set before, the system does not make a decision. ico

3. What is a significant decision?

• A legal effect changes the legal status or legal rights of a person. An example is the refusal of a benefit, a licence or a visa. ico
• A similarly significant effect has an equal impact on the circumstances, behaviour, opportunities or choices of a person. ico
• The ICO gives e-recruitment with no meaningful human involvement as an example of a similarly significant effect. ico
• The ICO gives a list of areas to examine. The list includes money, employment, health, education, housing, essential services, reputation, behaviour and choices. ico

The context is important. The same decision can have a significant effect on one person and not on a different person. If you cannot accurately separate these two groups, apply the safeguards to all decisions (recommended). ico

4. What is meaningful human involvement?

Human involvement must be active. A token action is not sufficient. ico

For meaningful involvement, the human must do these tasks (recommended): ico

• Examine the decision at a time when the human can change the result. ico
• Have the ability, discretion and authority to change the decision. ico
• Have the training to understand the logic, outputs, limits and risks of the system. ico
• Examine the relevant data and factors that the decision used. ico

These rules also apply:

• The human must apply these criteria to each decision about a person. Random spot checks are not sufficient, because some decisions get no check. ico
• Keep a record of how the human took part in each decision (recommended). ico
• The human involvement must occur before the decision applies to the person (must). ico
• If a human only designs or builds the system, this is not meaningful involvement. ico
• If a human only puts data into the system, the system still makes the decision. ico
• You must examine how much the decision uses profiling. Complex profiling makes it difficult for a human to explain or challenge the result. ico

5. Can you use ADM?

Yes. After the DUAA, you can use any lawful basis for ADM, including legitimate interests. This is true only if the decision does not use special category data. brodies

Two restrictions apply: ico

1. Special category data. You can use ADM with special category data only if one of these conditions applies: ico
   • The person gives explicit consent. ico
   • The decision is necessary for a contract, and a substantial public interest (SPI) condition applies. ico
   • The law requires or authorises the decision, and an SPI condition applies. ico
2. Recognised legitimate interest. You cannot use “recognised legitimate interest” as the lawful basis for ADM. It is a different lawful basis from “legitimate interests”. ico

6. The four safeguards (Article 22C)

For ADM, you must give four safeguards. You must apply them to all decisions, not only to some decisions. ico

6.1 Information about decisions

• You must tell the person about each ADM decision about them. The information must be about the specific result. It is not sufficient to repeat your privacy notice. ico
• The information must be clear. It must show how you made the decision and the actual impact on the person. ico
• Include the factors that had an effect on the decision (recommended). Also tell the person if you used profiling or data from a third party. ico
• Tell the person how to challenge the decision. Do this when you give the decision (recommended). ico
• Use a system that keeps an audit trail of the key decision points (recommended). ico

6.2 Representations

You must let the person give their opinion about the decision. They can also give information that you did not have. You must tell them that they have this right. ico

6.3 Human intervention

• Human intervention occurs after the decision. The person asks for a human to examine their decision. ico
• Human involvement is different. It occurs during the decision. If it is meaningful, the ADM rules do not apply. ico
• The reviewer must have the same five qualities as for human involvement (recommended). ico
• Give the reviewer all the data that the system used. The reviewer must also examine any new evidence from the person (recommended). ico
• Monitor how frequently reviewers change decisions (recommended). A high rate can show a problem with the system. ico
• Spot checks do not satisfy this safeguard, because the person does not start them. ico

6.4 Contest

You must have a procedure that lets people challenge or appeal a decision. You must tell people about this right and about the procedure. ico

6.5 Time to reply

• You must reply to a request within one month. ico
• If the request is complex, you can add two more months. You must tell the person about the extension within one month and give the reason. ico

7. Recruitment

• On 31 March 2026, the ICO published the report “Recruitment Rewired”. The report used data from more than 30 employers. kingsleynapley
• Many employers said that their tools only gave support to human decisions. The ICO found that, in practice, there was frequently no meaningful human involvement. insideprivacy
• The ICO found these problems: no effective human oversight, safeguards that were not consistent, poor information to candidates, and DPIAs that were missing or weak. jdsupra
• If a human cannot really change the result, the ICO will consider the decision to be automated. kingsleynapley
• The ICO says that ADM in recruitment will probably need a DPIA. insideprivacy
• The ICO will update its recruitment and selection guidance in 2026. insideprivacy

8. Procedure for organisations

These steps are a summary of the guidance above. They are not ICO text.

1. Make a list of all automated decisions and profiling that you use.
2. For each decision, find if it is significant.
3. For each decision, find if a human has a meaningful part.
4. Compare each human review with the five criteria in Section 4.
5. Keep a record of each human review.
6. Find if the decision uses special category data. If yes, find a valid condition.
7. Do a DPIA.
8. Write a clear explanation for each decision.
9. Make a procedure for representations, human intervention and contest.
10. Train the human reviewers.
11. Monitor how frequently reviewers change decisions.

Sources:

• ICO – Artificial intelligence
• ICO – Guidance on AI and data protection
• ICO – Automated decision-making, including profiling (draft)
• ICO – What does the UK GDPR say about ADM?
• ICO – What are the ADM safeguards?
• ICO – ADM consultation
• Burges Salmon – ADM draft guidance
• Brodies – ADM draft guidance
• Inside Privacy – ADM and recruitment
• JD Supra – ICO recruitment report
• Kingsley Napley – Recruitment Rewired