FCA authorised · FRN 724952 0117 325 0027Quote & buy →
Aipedia: Data protection consultants
Consultants who audit a client's AI recruitment tools are checking processing the ICO has already raised concerns about. If the audit misses unlawful automated decisions or discriminatory processing, the client may hold the auditor responsible.
Part of: AI in Data protection consultants
In short
AI tools can sift CVs, score assessments and rank candidates, and clients ask data protection consultants to audit them. The ICO's November 2024 audit of AI recruitment tool providers produced almost 300 recommendations. Its March 2026 Recruitment rewired report found solely automated hiring decisions are likely widespread, with weaker safeguards than the law requires. Since February 2026, Articles 22A to 22D govern those decisions. Discrimination risk sits alongside, as Manjang v Uber Eats showed for automated checks. An audit that misses these issues can lead to a negligence claim. PI usually responds, subject to the wording.
Clients using AI in hiring, or vendors selling recruitment AI, ask consultants to review the tools against data protection law. A typical audit covers the data collected, the lawful basis, what the tool infers about candidates, whether decisions are solely automated, the safeguards offered, retention, vendor terms and the information given to candidates. Some audits are commissioned before procurement; others follow a complaint.
Who commissions the audit affects what can be seen. A client using a vendor's tool can show its own configuration, candidate communications and outcomes, but may have little visibility of how the model was built. A vendor can show the model and training data, but not how each customer uses it. The report should say which perspective it takes, because each leaves gaps the other would cover.
These publications give a ready benchmark. An audit that does not test the points the ICO has already raised will be hard to defend.
Since 5 February 2026, Article 22A defines a solely automated decision as one with no meaningful human involvement, and a rejection at application stage is likely to be a significant decision. Where Article 22A applies, Article 22C safeguards are required. Special category data, which can be inferred from CVs, video or assessment answers, is subject to the tighter limits in Article 22B. Discrimination law runs alongside data protection: the Manjang v Uber Eats claim, supported by the EHRC and settled in 2024, concerned automated facial recognition checks and alleged race discrimination. See also AI CV screening for HR consultants.
Illustrative scenario: a consultant audits a client's AI shortlisting tool and concludes it is compliant because recruiters review the shortlist. The audit does not examine rejected applications, which are never seen by a person. A rejected candidate complains, the ICO makes enquiries, and an analysis then suggests the tool disadvantages older applicants. The client suspends the tool and faces claims, and alleges the audit should have identified both problems.
An audit that fails to find what a competent auditor would have found is a negligence claim, and PI usually responds to it, subject to the terms. Discrimination-related losses claimed back from the consultant can raise questions under some wordings, and the client's own employment practices cover may respond to claims by candidates; see employment practices liability explained. The scope and limits of the audit, stated in writing, are a central part of any defence. If you later learn that an audit may have missed something, consider whether it is a circumstance to notify to your insurer.
Apex arranges PI for data protection consultants. A broker can review how your policy treats audit work and discrimination-related losses; see the data protection consultants' AI hub.
Its November 2024 intervention made almost 300 recommendations to AI recruitment tool providers. Its March 2026 Recruitment rewired report found solely automated hiring decisions are likely widespread, with weaker safeguards than the law requires.
It is likely to be, because it has a significant effect on the candidate. If there is no meaningful human involvement, Article 22A applies and the Article 22C safeguards are required.
Ideally it looks at both: the client's configuration, human review and candidate information, and the vendor's model, training data and contract terms. Where the auditor cannot see one side, the report should say so, so the client does not assume the gap has been checked.
Data protection fairness and discrimination law overlap, and the Manjang v Uber Eats claim shows how automated checks can lead to discrimination claims. If an audit excludes discrimination testing, it should say so clearly.
Tell us about your firm and the work you do. A broker will review how your current PI treats AI-assisted work, or arrange new cover. No fee for a quote. Or call 0117 325 0027.
Start a PI quote Request a callbackApex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information about how AI is used in the profession and how insurance may respond. It is not legal, regulatory or insurance advice on your circumstances, and it does not guarantee that cover will be available or on what terms.
