Plain-English guide
Can you use AI to decide
who to hire?
The rules on letting software make consequential decisions about people changed in February 2026, and most guidance you'll find still quotes the old ones. Here is what actually applies now, why it is looser than it was, and why that makes the duties more important rather than less.
Since 5 February 2026, UK law permits solely automated decisions with significant effects provided you apply safeguards: tell the person, let them make representations, let them obtain human intervention, and let them contest the decision. The old default prohibition now survives only where the decision is based on special-category data. Discrimination risk under the Equality Act applies regardless.
Published
The short answer
Using AI to help you decide is straightforward. Sorting applications, summarising CVs, drafting questions, spotting things you missed — all fine, provided a person is genuinely making the call.
Letting AI make the decision on its own is a different legal animal. If a system rejects candidates with nobody meaningfully looking at the outcome, you are making a solely automated significant decision, and a specific set of duties attaches to that.
The good news is those duties are reasonable and mostly a matter of process. The bad news is that most firms running automated sifting have never heard of them, and the guidance floating around online is largely out of date.
The date that matters
What changed in February 2026
On 5 February 2026, the automated decision-making reforms in the Data (Use and Access) Act 2025 came into force. Section 80 of that Act replaced Article 22 of the UK GDPR with four new articles, 22A to 22D.
The change is structural rather than cosmetic. Under the old Article 22, solely automated decisions with legal or similarly significant effects were prohibited by default, permitted only where a narrow exception applied. Under the new regime they are permitted by default, provided you put the required safeguards in place.
One important exception survives. Where a significant automated decision is based on special-category data — health information and the like — the stricter regime still applies and you need a specific lawful condition such as explicit consent.
Almost every article you will find on this subject still describes the old Article 22 prohibition. If something you are reading does not mention Articles 22A to 22D or the February 2026 date, it predates the change and is describing a regime that no longer exists.
Whether your decision is even in scope
Before worrying about safeguards, check whether the rules apply at all. Two conditions have to be met together.
1. Is it a significant decision?
One that produces a legal effect for the person, or has a similarly significant effect on them. Hiring, dismissal, credit, insurance, access to a service, materially different pricing. Suggesting a product is not.
2. Is it based solely on automated processing?
A decision is solely automated if there is no meaningful human involvement in taking it. If a person genuinely reviews and can change the outcome before it takes effect, the specific safeguards in Article 22C do not apply.
If either answer is no, these particular rules are not your problem. Your ordinary data protection duties still apply — lawful basis, transparency, fairness — and so does the Equality Act. But you are not in automated-decision territory.
For most small businesses, most of the time, the honest answer is that they are out of scope because a human is genuinely doing the deciding. The trouble starts when volume grows and the review becomes a formality.
The four safeguards
If you are in scope, Article 22C requires you to put safeguards in place, and they must include these four. They are not optional extras and they are not difficult, but they have to be real.
- 01
Tell them. The person must be given information about the decision taken in relation to them. Not a vague line in a privacy notice — they need to know a solely automated decision was made.
- 02
Let them make representations. A route for them to put their side of it, and someone who actually reads it.
- 03
Let them obtain human intervention. A real person, with the authority to look again and reach a different answer.
- 04
Let them contest it. A way to challenge the outcome, not just be told about it.
Read practically, these four amount to one thing: a person on the wrong end of an automated decision must be able to reach a human being who can change it. If your process cannot deliver that, the automation is running ahead of what you can stand behind.
What "meaningful human involvement" means
This is where firms talk themselves into trouble, because it is the test that decides whether you are in scope at all, and it is tempting to answer it generously.
The bar is whether a person genuinely has the opportunity to accept, reject or influence the decision. Not whether a person was technically present in the workflow. Someone approving a screen of forty AI rejections in ninety seconds has not meaningfully reviewed forty decisions, and describing it as human oversight does not make it so.
The practical test I would apply: could that person explain, for any individual case, why the answer was what it was? If they could not, the involvement was not meaningful, and you are running solely automated decisions whether you meant to or not.
Note also that this is exactly the sort of question the ICO's forthcoming statutory code is expected to address, and the direction of travel is towards active review before the decision takes effect rather than sign-off afterwards.
The discrimination risk sitting alongside
Data protection is only half of it, and arguably the less dangerous half for a small employer.
If an AI system produces outcomes that disadvantage people because of a protected characteristic — age, sex, race, disability and the rest — that is potentially unlawful discrimination under the Equality Act, entirely separately from anything in the UK GDPR. It does not matter that you did not intend it, and it does not matter that you could not see inside the model.
The mechanism is well documented: a system trained on your historic hiring decisions learns your historic patterns, including the ones you would not defend out loud. It then applies them faster and more consistently than any human ever did. Efficiency is not a virtue when what is being made efficient is a bias.
The practical protection is boring and effective: keep a human accountable, keep records of why decisions were made, and periodically check outcomes for patterns you would not want to explain to a tribunal.
What's coming
Two things worth having in the diary.
The ICO now has a statutory duty to produce a code of practice on AI and automated decision-making. Draft guidance went out for consultation in 2026 and the code itself is expected in 2027. When it lands it will carry genuine legal weight, because courts and the ICO must take it into account, and departing from it will need justifying. Anyone running automated decisions should read the draft rather than waiting.
Separately, if you serve EU customers, AI used in recruitment sits on the EU AI Act's high-risk list, with substantially heavier obligations arriving in December 2027.Whether that Act reaches you at all is worth establishing first.
What to do this week
- 01
List any decision software makes about a person in your business. Sifting, scoring, declining, pricing. Most owners find one they had forgotten about.
- 02
For each, ask the explanation test. Could the person signing it off explain any individual outcome? If not, you are running solely automated decisions.
- 03
Check the four safeguards exist for anything in scope, and that the human intervention route reaches someone with actual authority.
- 04
Never let special-category data drive an automated significant decision. That is the corner where the old strict regime survives, and it is not a place to be improvising.
- 05
Look at outcomes, not just process. Whatever the system is doing, check who ends up rejected. That is the Equality Act question and no amount of documentation answers it.
Where this comes from
- Section 80, Data (Use and Access) Act 2025 — automated decision-making ↗
- Section 80 as enacted — Articles 22A to 22D in full ↗
This is plain-English guidance for small businesses, not formal legal advice. Where something genuinely needs a solicitor or a data-protection specialist, I'll tell you straight.
Straight answers
- Can I use AI to help decide who to hire?
- To help, yes. To decide on its own, be very careful. If a real person meaningfully reviews the decision before it takes effect, the specific automated-decision rules do not bite. If the AI sifts and rejects with nobody genuinely looking, you are making a solely automated significant decision and a set of legal safeguards applies.
- Did the law get stricter or looser in 2026?
- Looser in structure, but with clearer duties. Before 5 February 2026 the default was that solely automated significant decisions were prohibited unless an exception applied. Now the default is that they are permitted, provided you put safeguards in place. The prohibition survives only where the decision is based on special-category data such as health.
- What are the safeguards?
- Four things: tell the person a solely automated decision has been made about them, let them make representations about it, let them obtain human intervention from you, and let them contest it. If you cannot offer all four, you should not be running the decision automatically.
- What counts as "meaningful human involvement"?
- Not a rubber stamp. The test is whether a person genuinely has the ability to accept, reject or influence the decision, with the competence and authority to do so, before it takes effect. Someone clicking approve on a list of forty AI rejections in two minutes is not meaningful involvement, and calling it review will not help you.
- What is a "significant decision"?
- One that produces a legal effect for the person, or has a similarly significant effect. Hiring and dismissal, credit, insurance, access to a service, pricing that materially affects someone. Recommending which of two paint colours they might like is not.
- Does this apply to a small business?
- Yes. There is no headcount threshold. If you are running a tool that sifts job applicants, scores customers for credit, or automatically declines people, the rules apply whether you employ four people or four hundred.
- What about discrimination?
- A separate and equally serious risk. If an AI system produces outcomes that disadvantage people on the basis of a protected characteristic, that is potentially unlawful under the Equality Act regardless of what data protection law says, and "the algorithm did it" is not a defence. Systems trained on historic hiring data can reproduce historic bias.
- Is more regulation coming?
- Yes. The ICO has a statutory duty to produce a code of practice on AI and automated decision-making, expected in 2027. Once published, courts and the ICO must take it into account, which gives it real weight. If you serve EU customers, recruitment AI is also on the EU AI Act’s high-risk list, with those obligations due in December 2027.
Read next
Is my business ready for AI? A ten-point check
Score yourself in ten minutes. Where you already stand, what is missing, and what is worth fixing first.
Does the EU AI Act apply to my UK business?
It came into force on 2 August 2026 and being in Cornwall does not put you outside it. Who it catches, what it asks for, and the December deadline.
Running something that scores or sifts people?
That is the corner of this subject where getting it wrong is expensive. A readiness check covers what your system actually does, whether the safeguards are real or nominal, and what you would need to show if someone challenged a decision.
Ask about a readiness check