FCA authorised · FRN 724952 0117 325 0027Quote & buy →
Aipedia: Recruitment agencies
Automated CV rejection without meaningful human involvement is a significant decision under UK GDPR, so candidates must get Article 22C safeguards. Agencies may screen at volume, which can make this a significant AI risk in recruitment.
Part of: AI in recruitment agencies
In short
Applicant tracking systems and AI screening tools can score CVs and shortlist or reject candidates. Since 5 February 2026, the Data (Use and Access) Act 2025 has treated automated shortlisting or rejection without meaningful human involvement as a significant decision. Candidates must be told, be able to make representations, get human intervention and contest the outcome. The ICO's March 2026 Recruitment rewired report found such decisions are likely common and safeguards weak. A tool that disadvantages a protected group can also lead to an Equality Act claim. Discrimination may be excluded or limited under PI.
Screening tools parse CVs, compare them with a job brief, score each applicant and sort them into shortlist, hold or reject. Some send rejection messages automatically. A consultant may look only at the shortlist, so for most applicants the tool alone decides the outcome. That is exactly the scenario the new automated decision rules target.
Section 80 of the Data (Use and Access) Act 2025 came into force on 5 February 2026 and inserted Articles 22A to 22D into UK GDPR. Automated shortlisting or rejection without meaningful human involvement is a significant decision, and the candidate must get the Article 22C safeguards:
Special category data stays restricted. The ICO's draft ADM guidance says designing or building a system is not meaningful human involvement, so setting the criteria up front does not count. A consultant who rubber-stamps a ranked list without real review may not count either.
The ICO's Recruitment rewired report (31 March 2026) said solely automated hiring decisions are likely common and safeguards weaker than the law requires. Its 2024 audit found tools that filtered candidates by protected characteristic.
Agencies are employment service-providers under section 55 of the Equality Act 2010 and must not discriminate in how they select who receives their services. A tool that marks down career gaps, certain universities or non-standard CVs may indirectly disadvantage protected groups. In Manjang v Uber Eats, automated facial recognition checks led to a courier being removed and a race discrimination claim; it settled after the tribunal refused to strike it out. REC Code principle 4 (respect for diversity) applies too. See AI bias and discrimination claims.
Illustrative: an agency running volume hiring for a client sets its screening tool to reject applicants without a continuous employment history. Several rejected applicants with disability-related gaps complain. None was told the decision was automated or offered a human review. They bring discrimination claims against the agency and the client, and one complains to the ICO. The client asks the agency to indemnify it under the terms of business.
Discrimination claims by candidates may be excluded under PI or left to employment practices liability cover, and applicants are often not the agency's own employees, so EPL may not respond either. A claim by the client for losses caused by the agency's faulty screening, such as a failed campaign, may fall within PI, subject to the wording and any contractual liability exclusion. Fines are generally not covered. Check the position before you rely on a screening tool at scale.
Apex arranges PI for recruitment agencies; a broker can review how your policy treats screening errors and discrimination allegations. See the AI in recruitment agencies hub, telling candidates you use AI and AI matching and bias audits.
Yes, but since 5 February 2026 an automated shortlisting or rejection without meaningful human involvement is a significant decision under UK GDPR Article 22A. The candidate must get Article 22C safeguards: information, representations, human intervention and a way to contest. Special category data stays restricted.
Only if the review is real. The ICO's draft ADM guidance says designing or building a system is not meaningful human involvement. A person who reviews the evidence and can change the outcome is more likely to count than one who approves a ranked list unseen.
The agency can be liable as an employment service-provider under section 55 of the Equality Act 2010, and the hirer may also face claims. Contracts with the client and the tool supplier decide who bears the cost between the businesses.
Where a rejection was a significant automated decision, tell the applicant it was made automatically, how to make representations and how to ask a person to review it. Answer challenges promptly, and log them, because the ICO expects the Article 22C route to work in practice, not just on paper.
Tell us about your firm and the work you do. A broker will review how your current PI treats AI-assisted work, or arrange new cover. No fee for a quote. Or call 0117 325 0027.
Start a PI quote Request a callbackApex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information about how AI is used in the profession and how insurance may respond. It is not legal, regulatory or insurance advice on your circumstances, and it does not guarantee that cover will be available or on what terms.
