FCA authorised · FRN 724952 0117 325 0027Quote & buy →
Aipedia: Recruitment agencies
Agencies must tell candidates when AI is used to make or shape decisions about them, and offer a real route to human review where decisions are automated. The ICO has said safeguards in recruitment are weaker than the law requires.
Part of: AI in recruitment agencies
In short
Candidates are entitled to know how their data is used, including any automated decision-making or profiling. Since 5 February 2026, an automated shortlisting or rejection without meaningful human involvement is a significant decision, and candidates must be told and given the chance to make representations, obtain human intervention and contest it under Article 22C. The ICO's Recruitment rewired report (March 2026) found these safeguards are often weak. Agencies also need a data protection complaints procedure from 19 June 2026. Terms of business with hirers should say who uses which AI tools and who handles candidate challenges.
Privacy information must cover the purposes of processing, the source of data not obtained from the candidate and the existence of automated decision-making, including profiling. Under UK GDPR Article 14, where you collect data from elsewhere, such as a sourcing tool, that information is due within a reasonable period and at the latest one month, or at first contact. In practice, candidates should understand:
Write this in plain language and put it where candidates will see it: on application forms, in chatbot openers and in the first outreach message, not only in a long privacy policy. Layered notices work well: a short statement at the point of use, linking to fuller detail. Keep the notice in step with the tools you actually use, and update it when you add or change one.
The ICO's 2024 audit found tools that built candidate databases without candidates' knowledge and inferred characteristics such as ethnicity or gender. Recruitment rewired (31 March 2026) said solely automated hiring decisions are likely common and safeguards weaker than the law requires, and that platforms as well as employers will be scrutinised. The draft ADM guidance says designing a system is not meaningful human involvement, and that Article 22C safeguards apply where it is unclear who is significantly affected. In a three-way relationship between candidate, agency and hirer, that last point matters: do not assume someone else is responsible for telling the candidate. Final guidance is expected in Winter 2026.
Article 22C requires information about the decision, the ability to make representations, human intervention and a way to contest. To make that real:
From 19 June 2026, you also need a data protection complaints procedure and must acknowledge complaints within 30 days.
Some hirers may ask what AI their agencies use. Terms of business can set out:
The REC Model Policy 33 offers members an AI policy template, and the APSCo Global guide stresses transparency with both candidates and clients. Before agreeing indemnities, check them against your policy; see PI and terms of business liability caps.
Illustrative: an agency's privacy notice says it "may use technology" in recruitment. A rejected candidate asks whether a person reviewed her application. The agency cannot say, and its hirer client says the agency ran the screening. The candidate complains to the ICO and the client asks why its terms did not cover this.
Transparency failures usually lead to regulatory complaints rather than damages, and fines are commonly excluded. If a client claims its losses from the agency's failure to handle candidate challenges as agreed, PI may respond subject to the wording. Apex arranges PI for recruitment agencies and a broker can review how your policy treats AI-assisted work. See the AI in recruitment agencies hub, AI CV screening, recruitment chatbots and data subject rights.
You must tell candidates about automated decision-making, including profiling, in your privacy information, and explain the purposes and sources of their data. Where a decision is significant and automated, Article 22C requires information about it, plus the chance to make representations, obtain human intervention and contest it.
Whoever is the controller for that processing, and sometimes both. The ICO's draft ADM guidance says Article 22C safeguards apply where it is unclear who is significantly affected, so agree responsibilities with hirers in writing rather than leaving gaps.
The ICO's draft guidance says designing or building a system is not enough. A reviewer should look at the evidence and have the authority to change the outcome, rather than approving a tool's recommendation by default.
It helps. Setting out which tools you use, who sets screening criteria, who is controller and who handles candidate challenges reduces disputes with hirers. Check any indemnity or warranty about AI against your PI before agreeing it.
Tell us about your firm and the work you do. A broker will review how your current PI treats AI-assisted work, or arrange new cover. No fee for a quote. Or call 0117 325 0027.
Start a PI quote Request a callbackApex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information about how AI is used in the profession and how insurance may respond. It is not legal, regulatory or insurance advice on your circumstances, and it does not guarantee that cover will be available or on what terms.
