This article summarises publicly available guidance from regulators and official sources. It is general educational information only and does not constitute legal or professional advice. Requirements vary by jurisdiction. Consult your regional authority or a qualified professional for advice specific to your situation.
Most UK job candidates have no idea when an AI tool is involved in deciding whether they get an interview. That's not a guess. It's what the Information Commissioner's Office (ICO) found in its own research, and it's why recruitment has become one of the ICO's named enforcement priorities for AI.
In short: if your recruitment process uses AI to screen, score, or shortlist candidates, the ICO expects you to tell candidates that before or at the start of the application process, not just after a decision has been made. This is distinct from a candidate's separate right to request a human review of an automated decision, which applies once a decision has actually gone against them.
What the ICO's own research found
Through its Recruitment Rewired programme, the ICO researched how candidates actually experience automated decision-making in hiring. Participants consistently reported not knowing what type of automated decision-making was being used, where in the recruitment process it applied, or what information the software used to reach a decision. Almost every participant said they wanted to be told AI was involved before, or at the start of, the application process, not after.
An HR lead at a 35-person UK recruitment consultancy, using an AI-powered applicant tracking system to shortlist CVs, had assumed her only real obligation was to offer a human review if a rejected candidate formally asked for one, consistent with UK GDPR's automated-decision rights. After reading the ICO's own findings, she recognised the gap: telling candidates about the AI stage upfront is a separate, additional expectation, not something that's satisfied just by having a human-review process available on request.
The ICO's earlier audit already found the same gap
This isn't a new concern. In its 2024 audit of AI recruitment tools, the ICO wrote to 16 organisations likely to be using automated decision-making in hiring and found many were relying on solely automated decisions with legal or significant effects on candidates, without meaningful human involvement, adequate transparency, or consistent monitoring for bias. All 16 organisations committed to acting on the ICO's recommendations. The March 2026 research confirms the underlying transparency gap identified in that audit is still a live, ongoing problem across the sector, not a one-off finding.
Two separate obligations, not one
It's worth being precise about what's required, because there are two different obligations that often get conflated. First, the disclosure obligation: telling candidates AI is being used to screen or assess them, ideally in the job posting or application instructions, before they apply. Second, the human-review right under UK GDPR (see our guide to that right for the detail): a candidate's right to ask for a genuine human review once a solely-automated decision with a significant effect has actually been made about them.
An employer can technically satisfy the human-review right while still leaving candidates in the dark at the application stage, which is exactly the gap the ICO's research is pushing employers to close. Meeting one obligation does not automatically mean the other is covered.
What's coming next
The ICO has said its recruitment-specific findings and recommendations will feed into broader draft guidance on automated decision-making and profiling, due to go out for public consultation. That guidance hadn't been published as final at the time this article was last verified, so treat current recruitment practice as an area where formal expectations are actively firming up, not a settled, finished picture.
Practical steps for now
Until the fuller guidance lands, a reasonable working approach is: state plainly in the job advert or application form that AI is used to screen or shortlist applications; describe, in plain terms, what stage of the process it affects (initial CV screening, interview scoring, and so on); and keep the existing human-review process for candidates who ask for one after a decision, since that obligation hasn't changed. None of this requires disclosing the tool's internal logic or vendor name, just that AI is genuinely involved and roughly where.
It's also worth checking what your applicant tracking system vendor already discloses on your behalf. Some ATS platforms include a standard AI-use notice in their candidate-facing communications by default, which can cover part of this obligation without any extra work, but it's the employer, not the vendor, who carries the actual responsibility for making sure candidates are genuinely informed. Don't assume the software handles disclosure correctly just because it has the feature available.
Methodology (Real-World, Verified)
We test AI tools against real SMB workflows: the tasks a 20-person business actually uses AI for, not enterprise demos. Pricing is verified at the vendor's published rates, with local-currency conversions noted where relevant. Compliance notes reference the legislation and regulatory guidance relevant to each article's region. Every tool is judged on one question: could a business with no dedicated IT department actually pick this up and use it on Monday morning.
Related reading: our AI governance by region.
Do I have to tell candidates I'm using AI to screen their application?
The ICO's own research and guidance strongly encourage disclosing AI use before or at the start of the application process. This isn't the same as the separate, established human-review right under UK GDPR, which applies once a decision has been made.
What happens if I don't disclose AI use in recruitment?
The ICO's 2024 audit found 16 organisations using AI recruitment tools without adequate transparency, and secured commitments from all of them to improve practice. Recruitment is now a named ICO enforcement priority, with further draft guidance expected, and a business with an ongoing transparency gap in its own hiring process is a plausible future audit target rather than a hypothetical one.
Is telling candidates about AI use the same as offering a human review?
No. Disclosure is about telling candidates AI is involved before or during the process. The human-review right is a separate, established right under UK GDPR that applies after a solely-automated decision with a significant effect has been made.
Does this apply to any AI use in hiring, or only fully automated rejections?
The ICO's research covers the broader candidate experience of automated decision-making in recruitment, including CV screening and interview scoring, not only cases where a candidate is rejected with zero human involvement at any stage.
The information in this article is general in nature. It reflects a summary of publicly available guidance and does not constitute legal, privacy, or professional advice. Your obligations will depend on your specific situation, jurisdiction, and business circumstances. Do not rely on this article as a substitute for qualified legal or professional advice.
Already have a candidate asking for a human review of an automated decision? Here's what that process actually requires.
Read the Human Review Guide