FCA authorised · FRN 724952 0117 325 0027Quote & buy →
Aipedia: Recruitment agencies
No single AI rulebook governs UK recruiters: the ICO, the Fair Work Agency, the EHRC and the trade bodies each cover part of it. For an agency, the practical test is whether each AI-assisted step still meets duties that sit with the agency itself.
Part of: AI in recruitment agencies
In short
UK recruitment agencies using AI answer to several bodies. The Fair Work Agency enforces the Conduct Regulations 2003, which require the agency to confirm candidates and their suitability itself. The ICO audited AI recruitment tools in 2024 and, in Recruitment rewired (March 2026), said safeguards for automated hiring decisions are weaker than the law requires. DSIT's 2024 guide sets out bias audits and testing, while the REC and APSCo publish guidance for members. Only the legislation is binding; the guidance shows what a regulator or a court is likely to expect.
Recruitment has no AI-specific regulator. The Fair Work Agency began operating on 7 April 2026, replacing the Employment Agency Standards Inspectorate, and enforces the Employment Agencies Act 1973 and the Conduct Regulations 2003. The ICO regulates candidate data and the EHRC enforces the Equality Act 2010. The REC and APSCo are trade bodies whose codes and guidance bind members by membership, not by law.
| Body | Publication | Date | Status | Key points |
|---|---|---|---|---|
| ICO | AI recruitment tools audit | 6 November 2024 | Audit outcomes | Almost 300 recommendations; tools filtering by protected characteristic, inferring ethnicity or gender, building databases without telling candidates |
| ICO | Recruitment rewired | 31 March 2026 | Regulatory report | Solely automated decisions likely common; safeguards weaker than the law requires; platforms to be scrutinised |
| ICO | Draft ADM guidance | Consultation closed 29 May 2026 | Draft guidance | Designing a system is not meaningful human involvement |
| Parliament | DUAA s.80, UK GDPR Articles 22A to 22D | In force 5 February 2026 | Binding law | Article 22C safeguards for significant automated decisions |
| DSIT | Responsible AI in Recruitment | 25 March 2024 | Government guidance | Assurance at procurement, pilot and live use; DPIA, bias audit, performance testing |
| REC | AI hub and Model Policy 33 | Undated | Member guidance | Humans in decisions, bias audits, no sensitive data in free tools |
| APSCo Global | AI and Recruitment: Global Regulation | 22 September 2025 | Member guidance | Board-level AI lead, risk assessment, AI literacy training |
| FWA | Conduct Regulations 2003 (guidance updated 22 June 2026) | In force | Binding law | Agency must confirm and pass on candidate information itself |
The ICO's 2024 intervention examined AI tool providers and made almost 300 recommendations. Its outcomes report found tools that filtered candidates by protected characteristic, inferred ethnicity or gender from names, and kept personal data indefinitely to build candidate databases without candidates knowing. Agencies are often controllers for candidate data, so these are agency problems as well as supplier problems.
Recruitment rewired (31 March 2026) went further. The ICO said solely automated hiring decisions are likely common, that the safeguards in place are weaker than the law requires, and that it will scrutinise recruitment platforms as well as employers. Its draft ADM guidance says that designing or building a system is not meaningful human involvement, and that Article 22C safeguards apply where it is unclear who is significantly affected. Final guidance, and updated recruitment and selection guidance, are expected in Winter 2026.
Since 5 February 2026, automated shortlisting or rejection without meaningful human involvement is a significant decision. The candidate must get information about it, a chance to make representations, human intervention and a route to contest it under Article 22C. Special category data remains restricted. See AI CV screening and automated rejection and telling candidates you use AI for how this works in practice.
The DSIT guide, written with contributions from the REC and APSCo, is not binding. It describes assurance at three stages: procurement, pilot and live use. Its tools include a data protection impact assessment, a bias audit, performance testing, model cards, transparency to candidates and a feedback route. It is a concrete public description of what reasonable diligence on a recruitment AI tool looks like.
The REC Code of Professional Practice has 10 principles and does not mention AI. Two matter most for AI:
Principle 2 (honesty and transparency) and principle 6 (professional knowledge) also apply. The REC AI hub advises defining needs before buying a tool, keeping sensitive or confidential data out of free AI tools, keeping humans in decisions, being transparent and auditing for bias. APSCo Global recommends a board-level AI lead, risk assessment of tools, AI literacy training for all staff and holding suppliers accountable for security.
Under the Conduct Regulations, reg 19 requires the agency to confirm a work-seeker's identity, experience, training, qualifications, authorisations including right to work, and willingness to do the work, and to keep evidence. AI CV screening or parsing does not discharge that duty: it reads what the candidate wrote. Reg 20 requires all reasonably practicable steps so a placement is not detrimental, and action on unsuitability information. Reg 21 requires the information to go to the hirer and be confirmed in writing within 3 business days, reg 22 adds checks for vulnerable roles, reg 28 protects confidentiality and reg 29 requires records for at least 12 months. See AI checks and the reg 19 suitability duty.
No regulator has published a statement on AI and PI, and there is no statutory PI requirement for agencies. In practice, an agency that cannot show it met reg 19 to 22 or the DSIT-style checks will find a negligence claim harder to defend, whichever tool was used. PI usually responds to negligent professional services subject to the wording, while fines and discrimination claims may be excluded. See does recruiters' PI cover AI mistakes?, the AI in recruitment agencies hub and our recruitment PI guide. Apex arranges PI for recruitment agencies, and a broker can review how your policy treats AI-assisted work.
No. It is government guidance published on 25 March 2024 with contributions from the REC and APSCo. It is still useful evidence of what reasonable diligence on an AI tool looks like, covering DPIAs, bias audits, performance testing and transparency.
No FWA or EAS enforcement action specifically about an agency's use of AI was found as at October 2026. The FWA began operating on 7 April 2026 and its enforcement priorities are still emerging, but the Conduct Regulations apply to AI-assisted work in the same way as to manual work.
Published on 31 March 2026, it said solely automated hiring decisions are likely common, that safeguards in place are weaker than the law requires, and that the ICO will scrutinise recruitment platforms as well as employers.
Tell us about your firm and the work you do. A broker will review how your current PI treats AI-assisted work, or arrange new cover. No fee for a quote. Or call 0117 325 0027.
Start a PI quote Request a callbackApex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information about how AI is used in the profession and how insurance may respond. It is not legal, regulatory or insurance advice on your circumstances, and it does not guarantee that cover will be available or on what terms.
