AI in HR: What UK Employers Can and Cannot Do

How many UK employers use AI

The Office for National Statistics (ONS) reports that 35% of businesses with 10 or more employees used at least one AI technology in June 2026, up from about 12% in late 2023.

A separate government AI Adoption Survey, published on 29 October 2026, found that 32% of UK businesses were using AI in 2026, up from 16% in 2025. That survey drew on a sample of 3,503 businesses.

In May 2025 ACAS reported that 35% of employers thought AI would increase productivity.

The law on automated decisions

Since 5 February 2026, UK GDPR Articles 22A to 22D govern automated decision-making. They replaced the old Article 22 under section 80 of the Data (Use and Access) Act 2025. A decision is based solely on automated processing if there is no meaningful human involvement. The law covers decisions with a legal or similarly serious effect on the person, such as rejecting a job applicant.

Where such a decision is made solely by automated means, four safeguards apply: the person must be told, be able to make representations, obtain human intervention and contest the decision. Solely automated high-impact decisions using special category data, such as health or ethnicity, are allowed only in limited cases, including explicit consent.

The rules do not apply to decisions taken before 5 February 2026.

UK GDPR safeguards for high-impact automated decisions (Article 22C)

Safeguard	What it means
Information	Tell the person a high-impact decision about them was made by automated means
Representations	Let the person make representations about the decision
Human intervention	Let the person obtain human intervention
Contest	Let the person contest the decision

Source: legislation.gov.uk: UK GDPR Article 22C

What the ICO found in AI recruitment tools

The Information Commissioner's Office audited AI recruitment tool providers between August 2023 and May 2024 and set out 296 changes for providers to make, plus 42 advisory notes. Providers agreed to 97% of the changes in full and 3% in part. The problems found included tools inferring gender and ethnicity from names, filters that let recruiters exclude people by protected characteristics, excessive data collection, indefinite retention and weak transparency.

In March 2026 the ICO said it had engaged more than 30 employers on automated hiring decisions. It found that many treated decisions as human-supported when they were in practice solely automated. The ICO's guidance on automated decision-making is still in draft and was last updated on 31 March 2026.

Impact assessments and transparency

The Information Commissioner's Office states that an employer must carry out a data protection impact assessment before using solely or partly automated decision-making in recruitment. Employers must also give candidates meaningful information about the logic involved and a route to human review.

The Department for Science, Innovation and Technology published Responsible AI in Recruitment guidance on 25 March 2024. That guidance names risks of perpetuating existing biases, digital exclusion and discriminatory job advertising.

Discrimination risks

The Equality Act 2010 covers recruitment and employment decisions however they are made, including decisions supported by AI tools. The Equality and Human Rights Commission warned in 2022 that bias built into algorithms can lead to less favourable treatment of people with protected characteristics.

ACAS advises consulting staff before introducing AI, having a clear AI policy and checking AI output for bias.

Frequently asked questions

Can a UK employer use AI to reject job applicants?

Yes. A UK employer can use AI to reject job applicants, but a high-impact decision made solely by automated means carries four safeguards under UK GDPR Article 22C: informing the person, representations, human intervention and the right to contest.

When did the UK automated decision-making rules change?

The UK automated decision-making rules changed on 5 February 2026, when section 80 of the Data (Use and Access) Act 2025 replaced Article 22 with Articles 22A to 22D.

How many UK businesses use AI?

According to the ONS, 35% of businesses with 10 or more employees used at least one AI technology in June 2026.

Is a data protection impact assessment needed for AI hiring tools?

Yes. The ICO says employers must carry out a DPIA before using solely or partly automated decision-making in recruitment.

What did the ICO find in AI recruitment tools?

The ICO's audits set out 296 changes for providers to make and 42 advisory notes, covering issues such as inferring gender and ethnicity from names and excessive data collection; 97% were agreed in full.