Using AI to Hire? Legal Risks for UK Employers Using AI Recruitment Tools
Recruitment AI often arrives through familiar HR software rather than as a standalone legal project. Before employers rely on automated screening, scoring or ranking, they should understand how an AI recruitment tool affects three things. These are candidate fairness, data protection compliance and the evidence needed to defend hiring decisions.
Suppliers are increasingly building AI into recruitment platforms, applicant tracking systems, CV screening tools, interview software and candidate assessment products. For UK employers, the legal risk goes beyond whether the technology works. The bigger question is whether the business can use it lawfully, fairly and transparently when making decisions about people.
Employers using AI to screen, score, rank or shortlist candidates have several risks to manage. These include discrimination risk, candidate data protection, automated decision-making safeguards, supplier accountability and internal oversight. AI may sit hidden inside a recruitment platform. Even then, the employer may still be responsible for how it affects applicants.
Key takeaways
- Employers can use AI in recruitment, but they remain responsible for fairness, transparency and compliance.
- The higher the tool’s influence over screening, scoring, ranking or rejection, the greater the legal risk.
- Employers should assess discrimination risk under the Equality Act 2010, including indirect discrimination and reasonable adjustments.
- Candidate privacy information should explain meaningful AI use in the recruitment process.
- Human oversight must be real, not just a rubber-stamping exercise.
- Higher-risk tools may require a DPIA and careful supplier contract review.
Why AI recruitment needs particular care
Recruitment is a high-impact area of business decision-making. A hiring process can affect a person’s access to work, income, career progression and professional reputation. That means AI tools used in recruitment deserve closer scrutiny than tools used only for low-risk internal productivity.
Many employers do not set out to create legal risk. They may adopt a recruitment platform because it promises faster shortlisting, better candidate matching, reduced admin or more consistent screening. Suppliers may present the AI element as a feature inside a wider HR system, not as a separate legal issue.
This creates risk. The tool may influence which candidates the employer sees, ranks highly, filters out and invites to interview. The employer should be able to explain how the tool works and what data it uses. It should also know whether anyone has tested the tool for bias and how human oversight operates. Otherwise, the business may face legal exposure.
This article focuses on the recruitment-specific risks. For a fuller picture, employers using AI to hire should read our wider article on shadow AI in the workplace. It covers internal governance and staff policies. Our article on AI supplier terms covers the contracts agreed with recruitment technology providers.
What counts as AI in hiring?
AI in hiring can appear at different stages of the recruitment process. Sometimes it is obvious, such as an automated video interview tool. At other times it is less visible, such as a scoring function inside an applicant tracking system.
Common examples include CV screening tools, candidate matching systems, automated ranking, interview analysis and recruitment chatbots. Others include online assessments and AI features embedded inside HR platforms. Some tools may simply help with administration, while others may influence who progresses through the hiring process.
This distinction matters. A tool that helps schedule interviews carries a very different legal risk from one that screens out candidates. The same is true of tools that rank applicants for hiring managers, analyse video interviews or generate suitability scores.
Employers should therefore start by asking what the tool actually does in practice. Does it organise applications, or does it influence selection? Next, does it make recommendations, or does it filter candidates out? What data does it use, such as historic recruitment data, online profile data, behavioural analysis or assessment scores? Finally, does it explain the basis for its ranking?
The more the tool influences shortlisting, interviews or rejections, the more the employer must understand and control the legal risk.
Discrimination risk under the Equality Act
The Equality Act 2010 prohibits discrimination in recruitment. Employers must not discriminate against job applicants because of protected characteristics. These are age, disability, gender reassignment, marriage and civil partnership, and pregnancy and maternity. They also include race, religion or belief, sex and sexual orientation.
AI tools can create discrimination risk even where the employer has no intention to discriminate. A supplier may have trained a recruitment tool on historic hiring data that reflects past bias. It may favour criteria that appear neutral but disadvantage particular groups. It may also use proxy indicators that correlate with protected characteristics. Examples include employment gaps, educational background, address history, speech patterns, response times or career paths.
Direct discrimination risk may arise if a tool takes account of protected characteristics or information closely linked to them. For example, a tool might downgrade candidates because of pregnancy-related career gaps, age-linked experience patterns or ethnic names. The same applies to disability-related employment gaps or religious indicators. Any of these could create serious legal exposure.
Indirect discrimination and reasonable adjustments
Indirect discrimination is often the more practical concern. A screening tool may favour continuous employment history, certain universities or particular career paths. It may also favour full-time availability, specific communication styles or fast response times. Those criteria may appear neutral. However, they could disadvantage disabled candidates, carers, older applicants, candidates from certain ethnic groups or women returning from maternity leave.
An employer may be able to justify some criteria if they are a proportionate means of achieving a legitimate aim. However, that assessment is fact-sensitive. The business should be able to explain why it needs the criterion and how it links to the role. It should also be able to say whether it considered less discriminatory alternatives.
Employers should also consider reasonable adjustments. Timed assessments, video interview tools, gamified tests and communication analysis may disadvantage disabled or neurodivergent candidates unless suitable alternatives exist. A supplier may describe the tool as objective or standardised. That does not remove the employer’s responsibility to assess whether the recruitment process is fair and accessible. Employers should also tell candidates how they can request adjustments or an alternative assessment route. This matters where an AI-enabled process may disadvantage them.
Candidate data protection and automated decision-making
Recruitment involves significant personal data. Candidate data may include CVs, contact details, employment history, education, interview notes and assessment scores. It may also include right to work information, references, salary expectations, diversity data, disability information and special category data.
Where employers use AI to screen, score, rank or assess candidates, they need to consider how they handle that data. This covers how they collect, analyse, store, share and explain it. Employers should give candidates clear privacy information. This helps candidates understand how the employer uses their data and how AI may affect the recruitment process.
This does not mean the employer must disclose every technical detail of the system. It does mean the employer should not mislead candidates or leave them unaware of meaningful use of automated tools.
Employers also need to consider lawful basis, fairness and data minimisation. Recruitment AI should use only the data needed for the hiring purpose. Employers should be cautious about tools that scrape online profiles, infer personal characteristics or analyse social media activity. The same applies to tools that produce suitability scores from information not clearly relevant to the role.
Special category data requires particular care. Some AI recruitment tools may process or infer special category information. This can relate to health, disability, racial or ethnic origin, religious beliefs or biometric data. It can happen even where the tool does not ask for that information directly. The risk is especially high with video analysis, speech analysis, behavioural assessment or online profiling.
Automated decision-making and human review
Automated decision-making also needs careful treatment. UK data protection law includes specific safeguards for certain solely automated decisions. These are decisions with legal or similarly significant effects on individuals. The Data (Use and Access) Act 2025 has amended this area. Employers should therefore check the current legal position and ICO guidance before using certain AI tools. These include tools that automatically reject candidates or materially rank applicants. They also include tools that make decisions significantly affecting access to employment.
Many tools do not make the final decision but still influence it. They may rank candidates, flag “best fit” applicants or hide lower-scoring candidates from view. This may not always trigger the strictest automated decision-making rules. However, it can still create data protection, discrimination and fairness risks.
Employers should not assume that adding a human at the end is enough. Human review needs to be meaningful. In practice, a human reviewer should understand what the tool has done and have access to relevant information. They should also be able to question the output and have genuine authority to override it. Employers should train recruitment teams not to treat AI scores as objective truth.
DPIAs, supplier contracts and evidence
Employers may need to carry out a data protection impact assessment, or DPIA. This applies where AI recruitment tools are likely to result in a high risk to individuals. It is particularly relevant where tools involve profiling, automated decision-making, large-scale processing or special category data. The same goes for monitoring, innovative technology or decisions affecting access to employment.
A DPIA helps the employer identify risks before using the tool. Employers should not treat it as a paperwork exercise. It is a practical way to decide whether the tool is appropriate and what safeguards it needs. It also helps decide whether the business can justify the processing.
For recruitment AI, the DPIA or risk assessment should consider the role of the tool and the data it processes. It should also consider whether the tool uses or infers special category data. Another question is whether the criteria are relevant to the role. Finally, it should check whether anyone has tested the tool for adverse impact and how human oversight will work.
Checking AI recruitment suppliers
Supplier evidence is also important. Employers should not rely only on product demonstrations, sales materials or assurances that the tool is “bias-free” or “compliant”. They should ask what testing the supplier has carried out and what data it used. They should also ask when the supplier last audited the tool and whether it considered UK recruitment contexts. Finally, they should ask whether the results are available.
Employers should also review the supplier contract. The contract should explain what the tool does and how the supplier processes candidate data. It should state whether the supplier is a processor or controller and where it hosts data. It should also say whether the supplier uses subprocessors, whether international transfers occur and what contractual protections apply.
For higher-risk tools, employers should also consider liability, indemnities, audit rights and evidence access. A candidate may complain, make a data subject request, allege discrimination or challenge the process. The employer may then need information from the supplier to explain and defend what happened.
Even where the law does not strictly require a formal DPIA, a written AI recruitment risk assessment is often sensible. It records why the employer approved the tool, which risks it considered and what safeguards it put in place.
Practical steps before using AI recruitment tools
Employers do not need to reject AI in recruitment altogether. Carefully selected and properly controlled, AI tools can help reduce administrative burden and support more consistent processes.
Before using AI to hire, UK employers should take the following steps.
- Map where you use AI in the recruitment process. Start by identifying whether AI is already present in recruitment systems. Ask whether any platform screens, scores, ranks, recommends, filters, records, analyses or predicts candidate suitability. This is particularly important where AI sits inside an existing applicant tracking system or HR platform.
- Decide what the AI tool may do. The employer should decide whether the tool can support administration only, assist shortlisting, recommend candidates or influence interview selection. The more influence the tool has, the stronger the safeguards need to be.
- Check the selection criteria. The criteria used by the tool should be relevant to the role. Employers should be cautious about opaque suitability scores, personality predictions and behavioural analysis. They should take the same care with online profile data or historic hiring patterns that may reflect past bias.
- Provide candidate information. Employers should tell candidates where they use AI in a meaningful way. Recruitment privacy information should cover this and, where appropriate, so should candidate communications. The explanation should be clear enough for candidates to understand how the employer uses their data. It should also explain how the process may affect them.
- Train hiring managers. Recruitment teams should understand the limitations of AI tools. They should know that AI outputs may be wrong, biased or incomplete, and that human review matters. Training should also cover equality risks, reasonable adjustments, data protection and how to respond if a candidate challenges the process.
- Keep records. Employers should keep records of the tool selected, the supplier review and the DPIA or risk assessment. Records should also cover the approval decision, human review process, candidate communications and any monitoring of outcomes. These records may be important if the business later needs to respond to a complaint or a data subject request. The same applies to a discrimination claim, regulator enquiry or customer due diligence question.
Are you considering an AI recruitment tool? Or have you found AI features already built into your hiring platform? Either way, we can help review the recruitment process, supplier terms, privacy documents and internal controls. We can do this before the tool creates avoidable legal risk.
AI recruitment risks for larger and higher-growth employers
AI recruitment risk increases where hiring is high-volume, fast-moving or decentralised. A small business hiring occasionally may have fewer systems and fewer candidates affected. A larger employer, scale-up or group company may recruit across multiple teams. It may then expose many applicants to the same automated process.
This matters for several reasons. A biased tool may repeat its impact across many candidates before anyone detects the issue. Managers in different teams may also use the tool inconsistently, making the employer’s process hard to explain. Processing candidate data at scale also makes data protection and DPIA issues more significant.
Higher-growth businesses should also think about future scrutiny. Investors, acquirers, enterprise customers and insurers may ask how the business manages AI, data protection and employment risk. Recruitment systems can form part of that review, particularly where the business has grown quickly and adopted tools informally.
For these businesses, legal review is part of building a scalable hiring function. It helps protect the business while allowing recruitment teams to use technology sensibly.
What to do if AI is already in your hiring process
Many employers will discover that AI is already present in their recruitment systems. That does not automatically mean the employer must switch the tool off immediately. It does mean the employer should review the position.
The first step is to identify the tool and its function. Does it simply organise applications, or does it score and rank candidates? Ask too whether it filters candidates before a human review. Finally, check whether it analyses video interviews, tests or behavioural data.
The second step is to review the supplier terms and data protection documents. The employer should understand who processes candidate data and where the supplier stores it. It should also know whether the supplier uses the data for model training and whether international transfers occur. Finally, it should know what contractual protections exist.
The third step is to assess discrimination and fairness risk. This may involve reviewing selection criteria, candidate outcomes and reasonable adjustment processes. It may also involve checking whether anyone has validated the tool for the relevant roles.
The fourth step is to update internal controls. The employer may need to amend recruitment policies, privacy notices, hiring manager guidance and candidate communications. If the tool is high risk, the employer should complete or refresh a DPIA.
The final step is to monitor the tool over time. Employers should not approve AI recruitment tools once and then forget them. The employer should periodically review outcomes, supplier changes, settings, complaints and whether the tool remains appropriate.
How the Jonathan Lea Network can help with AI recruitment
JLN can help employers, founders, in-house counsel and HR teams manage the legal risks of using AI in recruitment. We can support businesses considering a new AI hiring tool or reviewing an existing recruitment platform. We can also help if you have concerns about automated shortlisting, candidate scoring or AI-driven selection.
Depending on the tool and the hiring process, we can assist with:
- AI recruitment legal risk reviews: We can review how your recruitment process uses AI. We then identify the key employment, equality, data protection and contractual risks. This can be a focused review before you adopt a tool or a wider audit of existing recruitment systems.
- Supplier contract review: We can review recruitment platform terms, data processing agreements and AI product terms. Our review also covers acceptable use policies and supplier documentation. We can flag issues around data use, model training, subprocessors, international transfers, liability, audit rights and evidence of bias testing.
- Equality Act and discrimination risk advice: We can advise on discrimination risk, indirect discrimination and reasonable adjustments. We also cover selection criteria, candidate scoring and human oversight. This helps you design a process that is more defensible and easier to explain.
- Data protection and DPIA support: We can advise on UK GDPR, DPIAs, privacy notices, lawful basis and transparency wording. We also cover automated decision-making safeguards, data retention, international transfers and candidate rights.
- Recruitment policy and candidate communications: We can help update recruitment policies, candidate privacy notices and hiring manager guidance. We can also help with AI acceptable use policies and internal approval processes.
- Support where something has gone wrong: A candidate may challenge a decision, raise a data protection concern or allege discrimination. If so, we can help assess the position, preserve evidence and respond appropriately.
Related AI recruitment articles
- Shadow AI in the Workplace: Legal Risks for UK Businesses and Employers
How informal staff use of AI tools creates governance, confidentiality, data protection and employment risk for UK employers.
Frequently Asked Questions: AI Recruitment
Yes, but employers should use AI screening tools carefully. They need to consider discrimination risk, candidate data protection, transparency, supplier terms and whether there is meaningful human oversight. The employer should understand how the tool screens candidates, what data it uses and whether the criteria are relevant to the role. AI recruitment is not automatically unlawful in the UK. The legal risk depends on how the tool is used, what data is processed, how much influence it has over hiring decisions and what safeguards are in place. Employers still need to comply with the Equality Act 2010, UK GDPR, the Data Protection Act 2018 and ordinary employment law principles. Yes. AI hiring tools can create discrimination risk if they rely on biased data, irrelevant criteria, proxies for protected characteristics or scoring methods that disadvantage particular groups. This can create risk under the Equality Act 2010, including indirect discrimination and disability-related issues. Where AI is used in a meaningful way to process candidate data or influence recruitment decisions, employers should provide clear privacy information. Candidates should understand how their personal data is being used and how the process may affect them. The level of explanation will depend on the tool and the role it plays in the hiring process. A DPIA may be required where the AI tool is likely to create a high risk to individuals. This is particularly relevant where the tool involves profiling, automated decision-making, large-scale processing, special category data, monitoring or decisions affecting access to employment. Even where a DPIA is not strictly required, a written risk assessment is often sensible. This is legally sensitive and should not be implemented without legal and data protection review. If a candidate is rejected by a solely automated decision, or if AI has a decisive effect on whether they progress, the employer should consider automated decision-making safeguards, transparency, human review and challenge routes. The employer should still review it. AI embedded inside an applicant tracking system or HR platform can still affect candidates and create legal risk. Employers should ask the supplier what AI functions are included, how they work, what data they use and whether they can be switched off or configured. The supplier may have responsibility under the contract, but the employer using the tool may still face claims or scrutiny from candidates, regulators or other stakeholders. Employers should review supplier terms, ask for evidence of bias testing and ensure there is human oversight and a defensible recruitment process. It can be, but video interview analysis can be high risk, particularly if it analyses behaviour, facial expressions, voice, eye contact or other characteristics. These tools may raise discrimination, disability, data protection and transparency concerns. Employers should carry out careful legal, technical and operational review before using them. Yes. JLN can review AI recruitment tools, supplier contracts, candidate privacy notices, DPIAs, recruitment policies and hiring manager guidance. We can help employers manage discrimination, data protection, automated decision-making and supplier contract risks before AI tools are rolled out or after concerns have been identified.
Contact Us
We provide most enquiries with an indicative scope of work and fee estimate, based on the information you share. We aim to respond within one working day.
In the same email you will be invited to arrange a 20-minute complimentary, no-obligation video consultation, should the proposed scope of work and fee estimate be of interest. This initial discussion is designed to better understand your requirements, refine the scope and ensure our approach is fully aligned with your objectives, at the end of which we will email you a definitive formal fee estimate to consider and approve.
Where you would prefer to receive initial advice and guidance from the outset, or where a short introductory call would not be the most appropriate starting point, we may instead recommend a 2.5-hour fixed-fee appointment, starting from £700 + VAT. This enables us to review the information you provide, discuss your situation with you and provide considered, tailored advice at an early stage.
To make an enquiry, please email us at wewillhelp@jonathanlea.net, complete our contact form, or call us on 01444 708640.
VAT is charged at 20%.
This article is intended for general information only, applies to the law at the time of publication, is not specific to the facts of your case and is not intended to be a replacement for legal advice. It is recommended that specific professional advice is sought before relying on any of the information given. © Jonathan Lea Limited.