UK: AI in hiring under the UK GDPR and the Equality Act

What it is

The UK has not enacted an AI Act. AI used in hiring is governed by the law that already applies to recruitment, chiefly:

• The UK GDPR, as amended by the Data (Use and Access) Act 2025. It sets the rules for solely automated decisions about candidates and is enforced by the Information Commissioner’s Office (ICO).
• The Equality Act 2010, which makes the employer answer for discrimination in how it decides whom to hire, through claims in the employment tribunal.

The 2025 Act became law on 19 June 2025. Section 80 replaced Article 22 of the UK GDPR with new Articles 22A to 22D, and the Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 brought those changes into force on 5 February 2026 (reg. 2(j)). A decision taken before that date to which the old Article 22(3) applied stays under the old rules (reg. 5).

When a hiring decision is automated

The new rules turn on two definitions in Article 22A:

• A decision is based solely on automated processing if there is "no meaningful human involvement in the taking of the decision". In judging that, you must consider, among other things, the extent to which the decision is reached by means of profiling (Article 22A(2)).
• It is a significant decision if it produces a legal effect for the candidate or has a "similarly significant effect".

The ICO’s March 2026 report on automated recruitment says a similarly significant effect "is likely to include recruitment decisions." Its key finding was that "many employers engaging in automated recruitment are likely relying on solely automated decisions." Employers told the ICO they tended to automate the early stages of hiring, such as sifting CVs and scoring online assessments. Where employers do put a person in the loop, the ICO says that involvement must be applied consistently to every candidate in a hiring stage.

Where the tool only supports a person who takes the decision, the automated decision-making provisions do not apply, but the rest of data protection law still does.

What the employer must do

The Article 22C safeguards

The 2025 Act reframed the rules "from a prohibition with exceptions to a right of challenge with safeguards", in the ICO’s words. An employer can now make solely automated significant decisions on almost any Article 6 lawful basis, including legitimate interests if it meets the three-part test. For each such decision based on personal data, Article 22C requires measures that:

• give the candidate information about the decision;
• enable them to make representations about it;
• enable them to obtain human intervention on the employer’s part; and
• enable them to contest it.

The Secretary of State can add to or refine these safeguards, and say what does or does not count as meaningful human involvement, by regulations (Article 22D).

Special category data

A significant decision based entirely or partly on special category data, such as health or ethnic origin, may not be taken solely by automated means unless the candidate has given explicit consent, or the decision is necessary for a contract or required or authorised by law and the substantial public interest condition in Article 9(2)(g) applies (Article 22B). Article 22B(4) also rules out solely automated significant decisions where the processing relies on Article 6(1)(ea).

What the ICO expects

In its March 2026 report, based on engagement with more than 30 employers, the ICO said it expects organisations using automated decision-making in recruitment to:

• Monitor proactively for bias, testing regularly for biased outputs and mitigating them. Good practice includes asking developers about their own bias testing when procuring tools and considering monthly bias reviews.
• Be transparent with candidates that automated decision-making is being used, and explain how it works.
• Explain rights to recourse: tell candidates how to challenge a decision and request a human review.

The same report says automated decision-making in recruitment "is therefore likely to be an activity that requires a DPIA", and that it would consider one good practice in any event. Several of the DPIAs the ICO saw were missing, outdated or thin on how the third-party tool worked.

The ICO consulted on draft guidance on automated decision-making and profiling, updated for the 2025 Act, from 31 March to 29 May 2026. Check the ICO’s site for the final version before relying on the draft. Earlier, in 2024, the ICO audited providers and developers of AI recruitment tools and made almost 300 recommendations to them.

The Equality Act 2010

The Equality Act applies in England, Wales and Scotland; it does not extend to Northern Ireland as a whole (s. 217). For a hiring tool, the provisions that matter are:

• Direct liability for the process. An employer must not discriminate against a person "in the arrangements A makes for deciding to whom to offer employment" or "by not offering B employment" (s. 39(1)). The screening tool, its settings and its cut-offs are part of your arrangements, whoever built them.
• Indirect discrimination. Applying a provision, criterion or practice that puts people who share a protected characteristic at a particular disadvantage is discrimination unless you can show it is "a proportionate means of achieving a legitimate aim" (s. 19). A scoring model or a cut-off is the kind of criterion that test is applied to, and the justification has to be evidenced.
• Reasonable adjustments. The duty applies to an employer deciding to whom to offer employment, for a disabled person who is, or has said they may be, an applicant (s. 39(5); Schedule 8, para. 5). A timed or video-scored assessment that puts a disabled applicant at a substantial disadvantage can call for an alternative. The duty does not arise if you did not know, and could not reasonably have known, of the disability and the disadvantage (Schedule 8, para. 20).
• Agents. Anything done by an agent for a principal, with the principal’s authority, is treated as also done by the principal (s. 109(2)). A recruiting firm screening for you is the obvious case.
• Burden of proof. If there are facts from which a tribunal could decide, absent another explanation, that discrimination occurred, it must so hold unless you show otherwise (s. 136). Unexplained disparities in a tool’s outcomes are the kind of evidence a claimant will point to.

The protected characteristics are age, disability, gender reassignment, marriage and civil partnership, pregnancy and maternity, race, religion or belief, sex and sexual orientation (s. 4).

Penalties

UK GDPR. Breaching Article 22B or 22C falls in the higher tier of administrative fines: up to £17.5 million or, for an undertaking, 4% of total worldwide annual turnover in the preceding financial year, whichever is higher (Article 83(5)(ba)).

Equality Act. An employment tribunal can make a declaration, order compensation or make a recommendation (s. 124(2)). Compensation corresponds to what the county court could award (s. 124(6)), where damages can include compensation for injured feelings (s. 119(4)) and no cap is set. Where indirect discrimination is established but the criterion was not applied with the intention of discriminating, the tribunal must first consider a declaration or recommendation before ordering compensation (s. 124(4)–(5)).

Timeline

• 19 June 2025: the Data (Use and Access) Act 2025 becomes law.
• 5 February 2026: Articles 22A to 22D replace Article 22 of the UK GDPR.
• 31 March 2026: the ICO publishes its report on automated decision-making in recruitment and opens consultation on draft guidance, which closed on 29 May 2026.

What this means in practice

For each hiring stage, the first question is whether a person meaningfully takes the decision or the tool does. If the tool does, the Article 22C safeguards have to exist in the candidate journey, not just in a policy: information about the decision, a route to make representations, a person who can intervene, and a way to contest. If a person does, that involvement has to be real and applied to every candidate in the stage. Either way, the ICO expects a DPIA and documented bias monitoring, and the Equality Act puts the burden on you to justify any criterion that disadvantages a protected group.

A UK employer whose tool’s output is used in the EU, or that hires through an EU entity, can also fall under the EU AI Act, whose Article 26 deployer duties overlap heavily with what the ICO expects. A bank using the tool may also have to bring it into its model risk framework; the bank model risk page covers the Canadian and US guidance.

The deployer-side file Casework builds records where the tool’s output stops and a person’s decision starts, what is monitored for bias and how often, and what candidates are told. Those are the facts a DPIA, an Article 22C review and an Equality Act justification all start from. It is not legal advice, and it does not replace advice from UK employment and data protection counsel.

Frequently asked questions

Does the UK have an AI Act that covers hiring?

No. The UK has not enacted AI-specific legislation. AI used in hiring is governed by existing law, chiefly the UK GDPR as amended by the Data (Use and Access) Act 2025, enforced by the Information Commissioner's Office, and the Equality Act 2010.

What changed for automated hiring decisions under the Data (Use and Access) Act 2025?

Section 80 of the Act replaced Article 22 of the UK GDPR with Articles 22A to 22D, with effect from 5 February 2026. The old Article 22 prohibited solely automated significant decisions unless an exception applied. The new articles permit them on almost any lawful basis, except where special category data is involved, provided the safeguards in Article 22C are in place.

When is a hiring decision solely automated under the UK GDPR?

Under Article 22A, a decision is based solely on automated processing if there is no meaningful human involvement in taking it, and it is a significant decision if it has a legal or similarly significant effect. The ICO says a similarly significant effect is likely to include recruitment decisions, and its March 2026 report found that many employers using automated recruitment are likely relying on solely automated decisions.

What safeguards does Article 22C of the UK GDPR require?

Where a significant decision is based solely on automated processing and on personal data, the controller must have measures that give the candidate information about the decision, enable them to make representations about it, enable them to obtain human intervention on the controller's part, and enable them to contest it.

What does the ICO expect of employers using automated decisions in recruitment?

In March 2026 the ICO said it expects employers to monitor proactively for bias, including asking developers about their own bias testing and considering monthly bias reviews; to be clear with candidates when automated decision-making is used and explain how it works; and to tell candidates how to challenge a decision and request a human review. It also said automated decision-making in recruitment is likely to require a data protection impact assessment.

How does the Equality Act 2010 apply to AI hiring tools?

An employer must not discriminate in the arrangements it makes for deciding to whom to offer employment, or by not offering someone employment (section 39). A screening rule that puts people sharing a protected characteristic at a particular disadvantage is indirect discrimination unless the employer can show it is a proportionate means of achieving a legitimate aim (section 19), and the duty to make reasonable adjustments for disabled applicants applies to the selection process.

What are the penalties for breaching the UK's automated decision-making rules?

Breaching Article 22B or 22C of the UK GDPR is in the higher tier of administrative fines: up to £17.5 million or, for an undertaking, 4% of total worldwide annual turnover, whichever is higher (Article 83(5)). Under the Equality Act, an employment tribunal can award compensation that corresponds to what the county court could award, which has no statutory cap and can include injured feelings.

---

Looking at this regulation from the vendor side instead? HireAIScore covers vendor compliance posture against this regulation.