Module 1 of 2 · 45 minutes
When the tool is really deciding, and what candidates must be told
By the end of this module you will be able to
- Describe where AI is used in recruitment
- Tell a solely automated decision from meaningful human involvement
- State the four safeguards for solely automated decisions
- Explain what candidates must be told
- Explain when a data protection impact assessment is needed
Work through it
1 interactive for this module, built on the WAJD Teach engine. Nothing moves until you ask it to, and every one has a written version if you would rather read it.
Watch: Emma and George talk it through
3 minutes. Captions are on, and the same conversation is written out in full below. The voices are computer generated.
Emma George, our applicant system scores every CV and gives me a shortlist. The supplier calls it decision support. Am I fine?
George Depends what you do with the shortlist. Let me tell you what the Information Commissioner's Office found. On 31 March 2026 they published a report on automated decision making in recruitment, after working with more than thirty employers.
Emma And?
George Employers underestimated when tools were making the decision. Many tools described as supporting a human showed no meaningful human involvement in practice.
Emma I do look at the shortlist.
George Do you ever change it? Do you ever pull someone back in that it rejected?
Emma ...No. I've never seen the ones it rejected.
George Then for those candidates, the tool decided. If nobody ever overrules it, it's deciding. Count how often a reviewer changes its outcome. A figure of zero tells you the answer.
Emma What would proper human involvement look like?
George The ICO's draft guidance says active, not tokenistic. The reviewer has to be trained to understand the system's logic, outputs, limitations and risks. And they need the information, the time and the authority to reach a different outcome.
Emma Our IT lead configured it. Doesn't that count?
George No. The guidance says someone who designed or built the system isn't meaningful human involvement. That happened before any real decision was made.
Emma So is a fully automated rejection illegal?
George Not necessarily, since 5 February 2026. The law was amended. A solely automated decision with a significant effect is permitted on ordinary personal data, with safeguards. And rejecting a job application is a significant effect.
Emma Which safeguards?
George Four. The person is told about the decision. They can make representations. They can obtain human intervention. And they can contest it.
Emma And if the tool uses health or ethnicity?
George Special category data. Then solely automated decisions are generally prohibited, unless there's explicit consent or a narrow legal condition.
Emma What do I have to tell candidates?
George Clearly, that automated decision making is used and how it works. Not a technical essay. And how to ask for a human review. Plus a data protection impact assessment where the risk is high, kept up to date.
Emma Is that guidance final?
George No. It went out for consultation, which closed on 29 May 2026, so it may change. The four safeguards are in the legislation and they're in force now.
The written material
Where it turns up
AI is used at every stage: writing and targeting the advert, sifting applications against criteria, scoring recorded video interviews and online tests, ranking a shortlist, and later in performance and absence management. Each stage can filter people out before a human has seen their name.
Suppliers almost always describe their product as decision support. Whether that is true depends on what your people do with it, not on the brochure.
What the ICO found
On 31 March 2026 the Information Commissioner's Office published a report on automated decision making in recruitment, based on voluntary work with more than thirty employers between March 2025 and January 2026, alongside draft guidance for consultation.
Its main finding was that employers underestimated when tools were making decisions. Many tools described as supporting a human showed no meaningful human involvement in practice. It also found too little transparency with candidates and too little monitoring for fairness and bias.
Meaningful human involvement
The draft guidance says human involvement must be active rather than tokenistic. The reviewer has to be trained and qualified to understand the system's logic, its outputs, its limitations and its risks. They need the information, the time and the authority to reach a different outcome.
It also says something worth remembering: a person who designed or built the system is not meaningful human involvement, because that happened before any real decision was made. And a system that only applies a fixed rule you have set, such as a required licence, is treated differently from one that scores or ranks.
The safeguards, and what to tell candidates
Since 5 February 2026 the UK GDPR, as amended by the Data (Use and Access) Act 2025, permits a solely automated decision with a legal or similarly significant effect on ordinary personal data, with safeguards. The ICO describes the change as moving from a prohibition with exceptions to a right of challenge with safeguards. Rejecting a job application is a significant effect.
The person must be given information about the decision. They must be able to make representations, to obtain human intervention, and to contest the decision. Where special category data such as health or ethnicity is used, solely automated decisions are generally prohibited unless there is explicit consent or a narrow legal condition applies.
Candidates must be told clearly that automated decision making is used and how it works, without a technical explanation that confuses more than it informs, and how to ask for a human review. Where the processing is likely to be high risk, a data protection impact assessment must be carried out and kept up to date.
- Tell the person a decision was automated
- Let them make representations
- Give them a human to review it
- Let them contest the outcome
Knowledge check
The knowledge check and your certificate need a free account, so that your progress and results can be saved as evidence.
The learning itself stays free and open. You are reading all of it right now without an account.
Was this module useful? Tell us in two minutes, it decides what we improve next.