If your business uses software to screen CVs, rank candidates, or shortlist applicants, there is a good chance you are using automated decision-making under data protection law - and an equally good chance you do not know it. 

That, in short, is what the Information Commissioner's Office (ICO) found when it engaged with more than 30 employers as part of its research into AI use in recruitment. Many organisations are deploying AI hiring tools without recognising that those tools trigger specific obligations under UK data protection law. The ICO has now updated its draft guidance on automated decision-making (ADM) and profiling to reflect changes to the UK GDPR following the Data (Use and Access) Act 2025 (DUAA). Final guidance is expected later this year, ahead of a statutory Code of Practice on AI and ADM that the ICO is under a statutory duty to develop.

So what does this mean in practice?

Automated decision-making (ADM) occurs where a decision about an individual is made solely by automated means, without meaningful human involvement. AI CV screening and candidate-ranking tools are a textbook example. If your recruitment process involves a tool that filters out candidates before a human ever sees their application, you are very likely in scope.

The obligations that follow are not trivial. You need a lawful basis for the processing. You should carry out a Data Protection Impact Assessment (DPIA) before deploying the tool. Candidates have the right to request human review of any automated decision that significantly affects them - and that human reviewer must have real authority and sufficient information to overturn the machine's output. A rubber-stamp process will not do.

The ICO has been particularly clear on that last point. Human oversight must be genuine. A reviewer who simply confirms the AI's shortlist without being given the underlying data or the ability to challenge the outcome does not satisfy the requirement.

What should employers do now?

Start by auditing your recruitment technology. If any part of your hiring process involves automated scoring, filtering or ranking of candidates, treat it as ADM until you can establish otherwise. Confirm your lawful basis, carry out a DPIA if you have not already done so, and check that your privacy notice tells candidates how decisions about them are made.

Do not wait for the final guidance or for an enforcement notice. The ICO has signalled its intentions clearly, and the cost of getting this wrong - both financially and reputationally - is significant.

If you have any questions about automated decision-making, data protection compliance or the changes introduced by the DUAA, please contact any member of the Edwin Coe Intellectual Property team.