FCA authorised · FRN 724952 0117 325 0027Quote & buy →
Aipedia: HR consultants
HR advisers must make sure significant decisions about people have meaningful human involvement or, if not, that the Article 22C safeguards apply. The ICO has said many employers using automated recruitment fall short, and HR consultants may be the ones advising on those tools.
Part of: AI in HR consultants
In short
Since 5 February 2026, UK GDPR Articles 22A to 22D govern solely automated significant decisions, including hiring, rejection, dismissal and pay. Article 22C requires telling people, letting them make representations, and allowing human intervention and challenge. The ICO's Recruitment rewired report (March 2026) found many employers likely fall short. Its draft ADM guidance says human review must be active, not tokenistic. The CIPD Code does not mention AI, but its duties on up-to-date service, data protection and bias apply.
No single body regulates HR consultants, and no body regulates AI in HR as such. Instead several sets of rules overlap. The ICO enforces data protection law, which now includes specific rules on automated decisions. The EHRC enforces the Equality Act 2010. Employment tribunals decide claims. The CIPD sets professional standards for its members. Government guidance from DSIT sits alongside as good practice.
| Publication | Body and date | Status | Key points for HR |
|---|---|---|---|
| UK GDPR Articles 22A to 22D (DUAA 2025 s.80) | Parliament; in force 5 February 2026 | Binding law | Rules on solely automated significant decisions and the Article 22C safeguards |
| AI recruitment tools audit outcomes | ICO, 6 November 2024 | Regulator findings | Almost 300 recommendations to tool providers; key questions for buyers |
| Recruitment rewired | ICO, 31 March 2026 | Regulator report | Likely solely automated decisions with weak safeguards; consistent human review |
| Draft ADM guidance | ICO, consultation 31 March to 29 May 2026 | Draft, not final | Active human review; decision-support tools may make significant decisions |
| Responsible AI in Recruitment | DSIT, 25 March 2024 | Non-statutory guidance | Assurance across procurement, pilot and live use |
| Code of Conduct and Ethics | CIPD, February 2023 | Binding on members | Competence, data protection, fairness; no mention of AI |
| AI use in the workplace advice | CIPD, July 2023 | Practical guidance | Principles-based AI policies; fairness, transparency, accountability |
Article 22A defines a decision as solely automated where there is no meaningful human involvement, and says the extent of profiling must be considered. A significant decision is one with a legal or similarly significant effect, which covers hiring, rejection, dismissal and pay. Where those decisions are made, Article 22C requires safeguards: the individual must be informed, be able to make representations, and be able to obtain human intervention and contest the decision. The wider lawful bases for automated decisions do not extend to special category data, such as health or ethnicity. The rules were commenced by SI 2026/82.
Separately, from 19 June 2026 controllers must have a complaints procedure and acknowledge data protection complaints within 30 days (DUAA s.103). For HR, that includes complaints from candidates and staff about how AI tools treated them.
The 2024 audit looked at providers of AI recruitment tools. Some tools allowed filtering by protected characteristic, inferred gender or ethnicity from names, or kept excessive data indefinitely. All of the almost 300 recommendations were accepted or partly accepted, and the ICO said recruiters should use its key questions when buying tools.
Recruitment rewired drew on evidence from more than 30 employers. It found many employers using automated recruitment were likely making solely automated significant decisions with weaker safeguards than the law requires. Employers should be more transparent, apply human review consistently to all candidates and widen bias monitoring. The ICO has said it will scrutinise major employers and recruitment platforms.
The draft ADM guidance adds detail, though it is not yet final:
DPIAs are usually needed for employee monitoring tools and HR chatbots. The ICO's recruitment and monitoring guidance is being rewritten for DUAA, with finals due Winter 2026 and Winter 2026/27.
The CIPD Code does not mention AI, but its clauses map onto the ICO's expectations:
For an HR consultant, the practical test is whether you can show where a human genuinely makes the decision. Map each AI tool a client uses to the decisions it touches, record who reviews outputs and on what basis, and check that candidates and staff are told and can challenge. Advise on a DPIA before a tool goes live and on bias monitoring once it is running. Our guides on AI CV screening, AI monitoring tools and redundancy scoring apply this to specific tasks.
If a client is found to have made unlawful automated decisions on your advice, its losses and defence costs may be claimed back from you. PI usually responds to negligent advice, subject to the policy terms, but regulatory fines are commonly not insurable and some wordings restrict data protection claims. See GDPR cover within PI, PI versus client EPL and the AI in HR consulting hub. Apex arranges PI for HR consultants and a broker can check how your wording treats data protection and AI-assisted advice.
No. It is draft guidance and the consultation closed on 29 May 2026. The underlying law in Articles 22A to 22D is binding from 5 February 2026, and the draft shows how the ICO is likely to read it.
Probably not. The draft guidance says human review must be active, not tokenistic, and reviewers must understand the system's limits. A rubber stamp is likely to leave the decision solely automated.
No. Responsible AI in Recruitment is non-statutory guidance. It is still useful evidence of good practice, and following it helps show a reasonable approach if a tool is later challenged.
The Code does not mention AI, but its duties on competence, evidence-based service, data protection and bias apply to AI-assisted work, and complaints go through the CIPD process. No AI-related disciplinary outcome against an HR consultant has been found.
Tell us about your firm and the work you do. A broker will review how your current PI treats AI-assisted work, or arrange new cover. No fee for a quote. Or call 0117 325 0027.
Start a PI quote Request a callbackApex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information about how AI is used in the profession and how insurance may respond. It is not legal, regulatory or insurance advice on your circumstances, and it does not guarantee that cover will be available or on what terms.
