Your CV screening and video-scoring tools may already be making legal decisions about candidates
The ICO has audited recruitment-AI providers, published a dedicated report on recruitment ADM, and named recruitment as an explicit enforcement priority. Recruitment agencies and in-house talent teams need a defensible, evidence-backed assessment of every AI tool used to screen, score or rank candidates — and increasingly, that question arrives sooner than an audit: from a client's own supplier or tender questionnaire, asking exactly this before they'll keep you on their framework.
The ICO has already looked, and found gaps
The ICO's Recruitment Rewired report, based on engagement with over 30 employers between March 2025 and January 2026, found that most employers believed it "unlikely" they were using ADM — yet the ICO concluded several were doing so in practice. The report also found that existing DPIAs for recruitment AI "lacked the detail and specificity needed to comply with the law." Over 70% of employers surveyed expect to increase AI use in recruitment over the next five years, meaning the exposure is growing, not shrinking.
CV-screening tools that automatically reject candidates, video-interview platforms that score facial expression or tone, and ranking tools that determine who a human ever sees are all candidates for classification as significant solely automated decisions under Article 22A. Where a "human reviewer" only glances at an AI-generated shortlist without genuine ability to change the outcome, the ICO's draft guidance treats that as a token gesture that does not remove ADM status.
A 40-person recruitment agency using three AI tools across its desks
A mid-sized agency uses an AI CV-parsing tool to auto-reject candidates below a threshold score, a video-interview platform that scores tone and expression, and a ranking tool that orders shortlists for consultants. No one at the agency has assessed which of the three tools constitutes ADM, and no DPIA exists for any of them. Illustrative example — not a real client or verified statistic.
Consultants trust the AI shortlist; no one can say which tool is legally ADM, or what safeguards apply.
Each tool is assessed against Article 22A–22C, risk-scored, and issued with an audit-ready report identifying any gaps.
Where to start
- Classify every AI recruitment tool against the Article 22A "solely automated, significant decision" test, not just the ones that look automated.
- Test whether any human review is genuinely capable of changing the outcome before it is applied — not a post-hoc sign-off.
- Complete a DPIA for any tool involving profiling, video/biometric analysis, or special-category inference.
- Document the Article 6 lawful basis relied on for each tool, and confirm it is not "recognised legitimate interests."