The ICO's 2026 Recruitment Report: What London Employers Should Take From It

Summary: On 31 March 2026 the ICO published a report on the use of automated decision-making in recruitment alongside draft guidance interpreting the DUAA's changes to the UK GDPR. The report drew on evidence from more than 30 employers plus public perceptions research covering graduates, civil society, government, trade unions, and industry bodies. Its headline finding was that many employers did not acknowledge they were carrying out automated decision-making at all, and consequently had no safeguards in place.

The central finding

The ICO's conclusion was not that employers were deliberately evading the rules. It was that they did not recognise the rules applied to them.

Many employers assumed that a person nominally sitting somewhere in the process meant the decision was not automated. The ICO's position is that this is not enough. Where the human presence is nominal, the decision remains solely automated, and the employer is therefore operating without the transparency, bias monitoring, accountability, and data subject rights the framework requires.

This is a recognition problem before it is a compliance problem. An employer who does not believe they are doing ADM will not have run a DPIA, will not have documented a lawful basis, will not have built a contest route, and will not be monitoring for bias, because none of those obligations appeared to apply.

What the report says about human review in practice

The most quoted finding concerns the quality of review. Where employers used AI-driven screening tools to filter candidates, the ICO found human review was often perfunctory, with reviewers rubber-stamping outputs without access to the underlying reasoning.

The phrase "without access to the underlying reasoning" is the operative part. This is not a criticism of recruiter diligence. It is a description of a tooling gap. Most screening interfaces present a score or a rank without exposing what drove it, which makes independent consideration impossible even for a conscientious reviewer with time and authority.

Employers reading this finding should look at their own screening interface rather than their own process documentation.

The enforcement signal alongside it

The report did not arrive alone. In March 2026 the ICO wrote to 16 organisations it believed were carrying out automated decision-making on candidates, indicating that enforcement may follow.

Publishing draft guidance, a sector report, and enforcement correspondence in the same month is a deliberate sequence. The ICO's message, as read by practitioners, is that it expects employers to follow the guidance in the report and that enforcement action may follow where organisations fall short.

The consultation on the draft guidance ran until 29 May 2026, with final guidance expected in summer 2026. The ICO has also indicated it will update its wider recruitment and selection guidance during 2026 to reflect the DUAA changes.

Waiting for the final text is a choice with cost attached, because the underlying regime has been in force since 5 February 2026.

Why the public perceptions research matters commercially

The report's evidence base included graduates, trade unions, and civil society, not only employers. That is a signal about where complaints will come from.

Graduate and high-volume recruitment is where automated screening is most heavily used and where candidates are most likely to be aware of it. It is also where a single well-organised complaint can generate regulatory attention disproportionate to the size of the process. London employers running large graduate schemes carry more exposure than headcount alone suggests.

What to do with the report

1. Test the recognition question first. Does anyone in your organisation currently believe you are carrying out ADM in recruitment? If not, that belief is the first thing to examine, because it is the finding the ICO led with.
2. Look at the screening interface. Can a reviewer see the drivers behind a score? If not, your review cannot be meaningful regardless of policy.
3. Locate your DPIA. If you concluded ADM was not happening, you may not have one.
4. Check the contest route actually functions. A form that goes nowhere is not a process. Candidates must be told how to request human review, and that route must work.
5. Start documented bias monitoring against protected characteristics under the Equality Act. Regular documented review is cited as good practice and is the artefact that demonstrates accountability.

The two-regime problem for London

London employers frequently hire across the UK and the EU, and the two frameworks diverge.

The EU AI Act classifies recruitment, candidate selection, and evaluation tools as high-risk systems under Annex III, which triggers conformity assessment, technical documentation, and human oversight obligations going beyond what the DUAA requires. The UK regime is lighter on process and heavier on data subject rights.

Running one hiring process across both means meeting the higher bar wherever the same tool touches candidates in both jurisdictions, or maintaining two genuinely separate processes, which is operationally expensive and rarely done well.

The Equality Act 2010 applies alongside both, independently, to every AI recruitment tool a UK employer procures regardless of vendor origin.

Frequently asked questions

Is the ICO's draft guidance binding? Draft guidance is not law. It is the regulator's stated interpretation, and the ICO has signalled it expects employers to follow the report's guidance. Departing from it is possible but requires a reasoned position you are prepared to defend.

Does the report create new obligations? No. It interprets existing ones under the DUAA-amended UK GDPR and describes how the ICO expects them to apply in recruitment.

We are a small employer. Does this apply? There is no size threshold. The obligations attach to the processing, not the headcount.

Should we wait for the final guidance in summer 2026? The underlying regime has been in force since February 2026, and the ICO wrote to organisations in March. The final guidance is likely to sharpen rather than reverse the draft position.

Does using a well-known vendor reduce exposure? Not materially. The obligations sit with the controller, which is the employer. Vendor reputation is not a defence, and the Equality Act position is that the algorithm producing the shortlist is not an answer in an Employment Tribunal.