Using AI in hiring lawfully in the United Kingdom
Reviewed by Mellow Editorial Team, HR & payroll content team
Using AI tools in recruitment can save time and reduce administrative burden. UK employers must also ensure those tools comply with data protection law, equality law, and emerging employment legislation — or risk discrimination claims, ICO enforcement, and tribunal exposure.
What counts as AI in hiring
AI in hiring covers a wide range of tools: CV screening software that ranks candidates by keyword match or predicted fit, video interview platforms that analyse facial expressions or speech patterns, psychometric tools that generate personality scores algorithmically, and chatbots that handle initial candidate queries or scheduling.
Some of these tools are transparent and rule-based. Others use machine learning models trained on historical data, where the logic behind a decision is harder to explain. The distinction matters legally, because the less explainable a decision, the harder it is to demonstrate fairness or justify an outcome to a candidate or regulator.
Data protection obligations under UK GDPR
The UK GDPR and the Data Protection Act 2018 govern how you collect and use candidate data. Key obligations when using AI in hiring:
Lawful basis. You need a lawful basis for processing personal data. Legitimate interests or the performance of pre-contractual steps (taking steps prior to entering a contract at the candidate's request) are the most commonly relied-upon bases in recruitment. Consent is rarely appropriate as the power imbalance between employer and candidate makes it difficult to show consent is freely given.
Automated decision-making. Article 22 of UK GDPR gives candidates the right not to be subject to a decision based solely on automated processing that produces a legal or similarly significant effect. If your AI tool makes or effectively makes the call — shortlisting, rejecting, scoring — without meaningful human review, you may be in breach. A human reviewer must genuinely consider the outcome, not just rubber-stamp it.
Transparency. Your privacy notice must explain that AI tools are used in hiring, what data is processed, and how it affects outcomes. Candidates should be able to request human review, express their view, or contest a decision.
Data minimisation. Only collect what you actually need. Video analysis tools that infer emotion or personality from facial geometry process sensitive data by inference, even if you have not asked for it directly. Consider whether that data is genuinely necessary.
The ICO has published specific guidance on AI and data protection. Auditing your tools against that guidance before deployment is a sensible baseline.
Equality law and algorithmic bias
The Equality Act 2010 prohibits direct and indirect discrimination across nine protected characteristics including age, race, sex, disability, and religion. AI tools can produce discriminatory outcomes even when they appear neutral.
Indirect discrimination is the principal risk. A CV screening tool trained on historical hiring data may embed past biases — for example, deprioritising candidates from certain universities, penalising career gaps, or favouring linguistic patterns associated with particular demographics. The tool is not intentionally discriminatory, but the effect can be.
Employers remain liable for the output of third-party tools they deploy. Passing responsibility to a vendor does not insulate you from an Employment Tribunal claim.
Practical steps to manage this risk:
- Request bias audit reports from vendors before purchase, covering protected characteristics.
- Run your own disparity analysis on the outputs — are certain groups consistently scoring lower?
- Avoid tools that assess characteristics with no clear job-relevance, such as personality inferences derived from video.
- Keep records of your assessments so you can demonstrate proportionality if challenged.
The Employment Rights Act 2025 and what is coming
The Employment Rights Act 2025 strengthens day-one employment rights and signals a broader direction of travel toward greater worker protections. While it does not yet contain specific AI-in-hiring provisions, it sits alongside a wider regulatory picture that is developing quickly.
The government has signalled interest in algorithmic accountability. The Equality and Human Rights Commission has been vocal about AI bias. The ICO continues to issue enforcement action on automated processing. Employers who build robust practices now — documented, audited, human-overseen — are better placed as the regulatory landscape firms up.
Practical governance when deploying AI hiring tools
Regardless of the specific tool, a consistent internal governance approach reduces risk:
Due diligence before deployment. Review vendor data processing agreements, ask about training data and bias testing, and complete a Data Protection Impact Assessment (DPIA) — this is mandatory where processing is likely to result in high risk to individuals, which AI-assisted hiring usually is.
Human oversight at every decision point. Design your process so that no candidate is rejected, shortlisted, or advanced solely on AI output. Document who reviewed what, and when.
Candidate communication. Tell candidates clearly if AI is used, what it assesses, and how they can seek review. Opaque processes erode trust and create legal exposure.
Regular review. AI tools change, training data shifts, and your candidate pool varies. Build in periodic review of outputs and outcomes rather than assuming a tool validated at deployment remains fair over time.
---
Run HR and payroll in United Kingdom with Mellow
Mellow brings HR, payroll and 12 AI agents into one platform — built to handle United Kingdom properly, with payroll included, from £4 per employee per month. The AI agents don't just answer questions; they generate contracts, run cost estimates and draft letters for you.
- United Kingdom payroll software
[Start a free trial →](/register)