AI in recruitment: can employers use it?

Hiring AI can reject a care assistant for a CV gap, mark down a cleaner’s accent or shut a disabled applicant out of a test. The legal question is whether it breached your rights. The ethical question is whether it judged your ability to do the job fairly. A score does not answer either.

Ethical hiring: what should you expect from AI?

In our view, fair recruitment means assessing whether you can do the job, not hiding old prejudices behind a score. An employer calling its system “objective”, “ethical” or “compliant” does not establish that it treated you fairly. Ask these questions:

• What was actually assessed? Ask which skills and experience counted, and whether a CV gap, postcode or accent counted against you.
• Could you take part fairly? If a disability makes a timed or video test inaccessible, ask for a reasonable adjustment, such as extra time or another assessment method.
• Can you check the information? Ask for your scores and assessments, the data used and an explanation of the decision. Challenge errors.
• Can someone change the outcome? Ask whether a person genuinely considered your application and had authority to disagree with the software.

Unethical does not automatically mean unlawful. A bad score or an unfair process alone does not prove discrimination. A discrimination claim needs facts connecting the treatment to the legal protection. A data-protection complaint can stand separately: you do not have to prove bias to challenge inaccurate data or missing automated-decision safeguards.

How to challenge an AI hiring rejection

1. Save the evidence. Keep the advert, job criteria, test instructions, privacy notice, rejection and any scores. Record dates and any adjustment you requested. Save copies outside a work account you could lose.
2. Write to the recruiter and data-protection contact. Ask whether the decision was solely automated, what data and criteria it used, and what a human considered. If it was solely automated and significant, request the Article 22C safeguards. Use the wording below.
3. Identify the error or discrimination. Explain which experience the tool missed, which data is wrong or which test barrier needs an adjustment. Ask for reconsideration while the vacancy is still open.
4. Use advice and enforcement routes in parallel. Raise the data complaint with the organisation, then use the ICO complaint service if it is unresolved. Seek help from your union, Acas, Citizens Advice or a law centre on employment rights. An ICO complaint is free, but it is not a tribunal claim or an order to give you the job.
5. Protect the tribunal deadline. Normally notify Acas within six months less a day for a GB discrimination claim about a rejection from 1 October 2026. For a single rejection before that date, the old three-month limit applies. Do not wait for a review, grievance, subject access response or ICO decision. None of those pauses the tribunal clock.

AI and employment law: which hiring rules protect you?

AI can sift CVs, mark tests and rank candidates. Data-protection law controls how the employer uses your personal information and makes automated decisions. Discrimination law protects you against unlawful treatment in recruitment, whether a person or software decides. Buying a tool from another company does not remove the employer’s duties. Northern Ireland has separate discrimination laws, explained below.

Since 5 February 2026, UK GDPR Articles 22A to 22D govern solely automated significant decisions. These replaced the old Article 22. A decision is solely automated if there is no meaningful human involvement. A rejection, or a decision that keeps you off the interview shortlist, can significantly affect you.

Ask whether a person considered your application and could disagree with the score. A manager who approves every recommendation without considering it does not provide meaningful review. Nor does a human interview at the end help someone the software eliminated at the start.

AI hiring compliance: what must the employer get right?

The employer needs a lawful basis for using your data, must use it fairly and accurately, and must follow the rules for the kind of decision it makes. A privacy notice alone is not enough. Check which row fits your rejection.

Special category data includes health, racial or ethnic origin, religious beliefs, trade union membership and sexual orientation. Biometric data is special category data when used to identify someone uniquely. The restriction applies even if only part of the decision uses this data.

One exception requires explicit consent to all the personal-data processing on which the decision rests. The other requires a decision necessary for entering into or performing a contract, or required or authorised by law, and processing necessary for substantial public interest under Article 9(2)(g). That is not a general permission to use sensitive information because an employer finds it useful.

A separate restriction bans solely automated significant decisions where the processing relies wholly or partly on the new “recognised legitimate interests” basis in Article 6(1)(ea). This is distinct from ordinary legitimate interests. Safeguards do not cancel that restriction.

AI hiring transparency: must they explain your rejection?

They must be transparent about how they use your personal data. For solely automated significant decisions, you are entitled to information about the decision and meaningful information about the logic involved, its significance and likely consequences. That does not mean a right to the source code.

Do not assume every use of AI carries exactly the same explanation or human-review rights. A chatbot arranging interview times is different from a screener rejecting your CV. Ask what happened at the stage where you were eliminated.

A rejection arriving seconds after submission is a reason to ask questions, not proof that software decided. Write to the recruiter and its data-protection contact. Ask what information the tool used, which criteria mattered, what score or assessment it produced about you, and whether a person reviewed it.

Can you demand human review of an AI hiring decision?

Yes, if a solely automated decision significantly affects you. Article 22C requires safeguards that let you receive information about the decision, make representations, obtain human intervention and contest it. These safeguards also apply where an exception permits the use of special category data.

Send the request promptly. Explain what the system missed, such as experience it failed to recognise or a disability-related CV gap. Ask for someone with authority to reconsider the decision, not another automated score. A review does not guarantee an interview or a job.

For genuinely human-led decisions, Article 22C is not a general right to a second interview. You can still challenge inaccurate data, discrimination or a failure to make reasonable adjustments. If the employer claims a person decided, ask what that person actually considered.

The ICO’s draft recruitment guidance says employers must assess automated recruitment risks through a data protection impact assessment and warns against rubber-stamping. It is under review and still describes the old Article 22 restriction in places. The amended statute gives the current rule.

AI hiring bias: when is it unlawful discrimination?

In England, Scotland and Wales, the Equality Act 2010 protects applicants against discrimination in recruitment arrangements and job offers. There is no minimum service requirement. The employer cannot answer a discrimination complaint with “the algorithm did it”.

Direct discrimination means less favourable treatment because of a protected characteristic. Indirect discrimination can arise when an apparently neutral screening rule disadvantages a protected group and you personally, unless the employer can justify it as a proportionate means of achieving a legitimate aim. A bad score or an unfair process alone does not prove discrimination.

Look for the rule behind the score. A penalty for maternity-related CV gaps can disadvantage women. A voice assessment may penalise an accent associated with racial or ethnic origin. A distance filter can exclude a warehouse applicant who plans to move nearby. Class and postcode are not protected characteristics themselves, but a postcode rule may produce racial disadvantage.

Disabled applicants also have a right to reasonable adjustments to the recruitment process. That might mean extra time, an accessible test or a different assessment method. Tell the recruiter what barrier you face and what would remove it. The duty depends on the circumstances, including what the employer knew or should reasonably have known about your disability and the disadvantage.

You do not need the code to start a complaint. Keep facts that connect the treatment to discrimination, such as the test rules, a refused adjustment or evidence of different treatment. If you establish facts from which a tribunal could infer discrimination, the burden shifts to the employer to explain the treatment.

Discrimination compensation has no statutory cap. It can include proved financial loss and injury to feelings. The current Great Britain guidance for claims presented on or after 6 April 2026 sets injury-to-feelings bands of £1,300 to £12,600, £12,600 to £37,700, and £37,700 to £62,900, with exceptional cases above the top band. See the Vento guidance. A band is not a promised payout, and these figures are not the total value of a claim.

Video interviews, face and emotion analysis

Ask what the platform measures. Recording your answers is different from scoring your gaze, voice or facial movements. A video is not automatically special category biometric data. Processing it to identify you uniquely can be; using it to infer health or other sensitive characteristics can also bring special category rules into play.

A system that mistakes a disabled applicant’s speech or facial movements for poor performance may raise adjustment and discrimination issues. Challenge the suitability of the assessment for the job and any inaccurate inference about you. You do not have to accept the premise that a face reveals how well someone will care for a patient or clean a hotel room.

The TUC’s model AI Bill proposes additional workplace protections, including restrictions on detrimental emotion recognition. It is a campaign proposal, not an enacted right. Do not wait for it to challenge a breach of existing data-protection or discrimination law.

What data can hiring AI lawfully use?

The employer needs a lawful basis and must use relevant, accurate data fairly, limiting collection to what is necessary. Skills and experience can be relevant. A complete scrape of your social media is not justified simply by calling it a “fit” assessment. Information being public does not remove data-protection duties.

Health, race or religion may sometimes be processed lawfully for a specific purpose, such as an adjustment or equality monitoring. That is not permission to use it to rank you. Ask whether equality monitoring information is kept separate from selection.

Trade union membership has its own protection. Refusing employment because someone is or is not a union member is unlawful under trade union legislation, separate from the Equality Act. A tool that searches for union activity does not put the employer beyond that rule. See Acas on recruitment.

Right-to-work checks are a separate obligation, but a software error still needs correction. If an automated check wrongly flags your documents, ask the recruiter to identify the problem and arrange an appropriate manual check. The ICO expressly warns about systems that wrongly decide someone has no right to work in the UK.

AI employment law: dismissal and redundancy decisions

A productivity score, absence trigger or delivery-app rating can feed a dismissal decision. The same automated-decision safeguards can apply when the decision is solely automated and significant. Discrimination law also applies to dismissal and redundancy selection.

For employees who qualify for ordinary unfair-dismissal protection, the employer still needs a fair reason and must act reasonably, including in its procedure. Ask for the underlying records and how the score was used. If care workers lose points for disability-related absence, or a warehouse redundancy ranking contains errors, challenge those facts and use the appeal process. See our guide to fair disciplinary procedures.

As at 1 October 2026, most employees in Great Britain need two years’ service to claim ordinary unfair dismissal. Discrimination claims do not require that service. Many automatically unfair-dismissal claims, including dismissal for protected trade union activities, do not either. Automatic unfairness is not a way around the need for employee status.

Agency, zero-hours and platform work

A label on an app or contract does not settle your status. In Great Britain, discrimination protection covers employees, many people contracted personally to do work, and contract workers supplied by an agency. It does not automatically cover every genuinely independent business. UK GDPR rights apply to your personal data regardless of whether you are an employee.

Ordinary and automatically unfair-dismissal claims generally require employee status. If you are a worker but not an employee, you may have a discrimination or data-protection claim, but not an unfair-dismissal claim merely because an app deactivated you. Get advice on the status question rather than accepting the platform’s answer. See employee, worker and self-employed status.

A union can help you gather evidence and challenge the process collectively. Couriers and riders can approach IWGB; retail staff, Usdaw; care and NHS support staff, UNISON; and warehouse staff and drivers, GMB or Unite. Ask about eligibility and legal help before assuming a newly joined union will cover an existing dispute. If several colleagues face the same scoring rule, take the evidence to a representative together.

What differs in Northern Ireland?

The UK GDPR automated-decision rules apply UK-wide. The Equality Act employment provisions and the GB employment reform timetable do not apply in Northern Ireland. Separate discrimination laws cover matters including sex, race, disability, religion and political opinion.

Use the Labour Relations Agency, not Acas, for early conciliation. Most claims have a three-month time limit, subject to the conciliation rules. Religion and political-opinion discrimination claims go to the Fair Employment Tribunal; other employment claims generally go to the Industrial Tribunals. The nidirect tribunal guide explains the process and help available from the Equality Commission for Northern Ireland. Do not use the GB six-month limit.

AI hiring rules: what is law and what is guidance?

The government’s responsible AI recruitment guide gives employers assurance advice, not a new right for applicants. If a recruiter points to guidance as proof of compliance, ask how it met the legal duties in your application. Public-sector employers also have equality duties when choosing and using systems; see the EHRC’s public-services guidance.

1. 5 Feb 2026Automated-decision rules changed

   Articles 22A to 22D are in force. Solely automated significant decisions using ordinary data are more widely permitted, but safeguards and restrictions remain.

2. 1 Oct 2026GB tribunal time limits increased

   The usual limit becomes six months less a day. Earlier events can remain subject to the shorter limit; Northern Ireland is separate.

3. 1 Jan 2027Unfair-dismissal reform is scheduled

   The GB qualifying period is due to fall to six months and the compensatory cap to be removed. This is not the rule at our review date.

Questions people ask

Can a UK employer reject me by AI with no human involved?

Sometimes. A solely automated significant decision using ordinary personal data can be lawful, but the employer needs a lawful basis and the required safeguards. Special category data and the recognised legitimate interests basis have additional restrictions. You can ask for human intervention without first proving discrimination.

Does every use of AI give me a right to human review?

No. The specific Article 22C right applies to solely automated significant decisions. AI that merely schedules interviews or helps a person reach a genuine decision is different. A human rubber stamp does not remove the right.

Can they refuse an adjustment to an online test?

They must make reasonable adjustments for disabled applicants where the duty applies. Tell them about the barrier and ask for an accessible test, extra time or another suitable method. What is reasonable depends on the circumstances; no single adjustment is guaranteed in every case.

Do I need proof of bias before complaining to the ICO?

No. A data-protection complaint can concern an unexplained automated decision, inaccurate information or refusal of human intervention. A discrimination claim is a separate route and needs facts supporting discrimination. You can pursue both.

Does waiting for the employer’s reply extend my tribunal deadline?

No. A review request, grievance or ICO complaint does not stop the tribunal clock. Notify Acas in time in Great Britain, or the Labour Relations Agency in Northern Ireland. Early conciliation has its own rules for calculating the final filing date.

Am I covered if I work through an agency or delivery app?

UK GDPR protects your personal data regardless of employment status. Many agency and platform workers also have discrimination protection. Unfair-dismissal claims generally require employee status. Ask an adviser to check your actual working arrangements rather than accepting the contract’s label.

Sources

1. Data (Use and Access) Act 2025, section 80, inserting UK GDPR Articles 22A to 22D, legislation.gov.uk
2. Data (Use and Access) Act 2025 commencement regulations, SI 2026/82, legislation.gov.uk
3. Automated decision-making and profiling for recruitment, ICO, draft guidance under review following the 2025 Act
4. Equality Act 2010, Part 5, legislation.gov.uk
5. How employers should recruit, Acas
6. Employment Rights Act 2025, commencement and upcoming changes, Acas
7. Vento bands presidential guidance, April 2026, judiciary.uk
8. Employment-related tribunals in Northern Ireland, nidirect
9. Responsible AI in recruitment, Department for Science, Innovation and Technology
10. Artificial intelligence in public services, Equality and Human Rights Commission
11. Tribunal statistics quarterly, January to March 2026, section 6, Ministry of Justice, published 11 June 2026
12. Amazon scraps secret AI recruiting tool that showed bias against women, Reuters, 10 October 2018
13. AI Bill project, TUC
14. Make a complaint, ICO