AI in recruitment: an employer’s guide to managing bias and legal risk

The risk for bias often starts with the data used to train the tool. AI can reproduce patterns in that data, including flaws in previous hiring decisions, and depending on the data set and algorithms used, it may entrench practices and unconscious biases that favoured one group over another, particularly where the data is not sufficiently representative.

Removing names or other personal details is not enough. Education or employment history can indirectly reflect protected characteristics such as age, race or disability.

A well-known example is Amazon, which in 2018 reportedly discontinued an experimental recruitment tool that favoured male applicants. It had been trained on ten years of the company’s own hiring data, and taught itself that male candidates were preferable.

The Equality Act 2010 applies at every stage of hiring, from advertising and reviewing applications to interviews and appointment, even when AI carries out or supports those steps.

A neutral rule or criteria that appears to treat and apply to everyone equally, can still create a risk for employers. Applying such a rule in recruitment can amount to indirect discrimination if it puts people who share a protected characteristic (for example, a particular disability) at a disadvantage, and puts the individual applicant at that disadvantage too. This is unless the employer can show it is a proportionate means of achieving a legitimate aim. For example, an AI tool might mark down employment gaps even where continuous employment is unnecessary for the role. This could disadvantage women returning from childcare career breaks.

Lack of transparency when using AI makes justification harder. Where a third-party supplier provides the tool, employers may not have the information they need to understand or explain how the algorithm works, which makes the objective justification defence difficult to run. An unexplained automated score is a weak foundation for defending a rejection.

Fair recruitment also means an accessible process. Employers must consider reasonable adjustments where a tool substantially disadvantages an individual, and must give candidates a clear way to request them before assessment. For example, a video-interview tool that scores speaking speed and fluency could mark down a suitable applicant with a stammer. A reasonable adjustment might be a human-led interview that assesses relevant skills without penalising the speech impairment. Other situations may call for an accessible assessment format or an alternative process.

Human oversight can help address these risks, but only if it is more than a rubber stamp. Calling AI a “decision-support tool” is not enough. If it automatically rejects applicants, subsequently interviewing the successful candidates later does not amount to oversight of those initial rejections. Nor does simply approving the system’s recommendation.

For human input to be meaningful, the reviewer must be able to change the outcome before it takes effect. That requires training, understanding relevant information and the authority to challenge the result. Spot checks alone leave other decisions unchecked, and reviewers’ own biases also need attention.

Employers must also consider how the tool uses applicants’ personal information. They need a lawful basis for processing, and must clearly explain to candidates what is collected, how AI influences selection and how candidates can raise concerns or challenge any automated decisions. The Information Commissioners Office (“ICO”) suggests this should be done with clear privacy information to explain to candidates how and why the tool is being used and the logic behind the production of the predictions and outputs. They should collect only what is needed, set retention periods and check whether the supplier reuses applications to train its systems. High-risk processing requires a data protection impact assessment (DPIA): a documented review of risks and safeguards. Using AI in recruitment is likely to be considered high-risk processing as it will use extensive profiling with significant effects as well as process special category data. A sample DPIA template can be found on the ICO website along with further information.

Further safeguards apply when significant decisions are made without meaningful human involvement. The Data (Use and Access) Act 2025 has widened the lawful basis in which such automated decisions are permitted when using personal information, however this won’t apply to special category data. Candidates must still be given information about them and be able to make representations, obtain human intervention and challenge the outcome. Stricter rules apply to special category data, such as racial, ethnic origin and health data, where a specific condition must be met.

The ICO has been clear about its expectations. Its November 2024 audit of AI recruitment tools produced seven recommendations covering fair processing, bias monitoring, data protection compliance, candidate information, technical transparency, data minimisation and DPIAs for high-risk processing. Its March 2026 recruitment report reinforced the importance of transparency, meaningful oversight and bias monitoring.

• Assess before buying. Map where AI affects decisions. Ask suppliers for evidence of accuracy, accessibility and bias testing, and check contractual responsibilities and data use.
• Test relevance and fairness. Use job-related criteria and assess risks before deployment. Complete your own DPIA where required; a supplier’s assessment does not replace it.
• Be transparent. Tell candidates early that AI is involved, what it does and what the consequences may be. Explain what personal data is collected and why.
• Build in safeguards. Provide routes for adjustments and challenges, and make sure candidates understand the process.
• Train your people. HR staff and managers should understand how the algorithms work, how to interpret their outputs, how to check the accuracy of the data relied on, and what pitfalls to avoid.
• Monitor after launch. Review outcomes, complaints and system updates. Investigate disparities, reassess safeguards and pause use if concerns cannot be resolved. Equality monitoring must itself comply with data protection law.
• Keep evidence. Record checks, selection criteria, decision reasons and human interventions, and assign responsibility for ongoing oversight.

These steps help employers benefit from AI while keeping responsibility for hiring decisions. The aim is a process you can explain and defend, with fairness, accessibility and accountability built in from the outset rather than added after a complaint.

If you are introducing AI into recruitment or reviewing existing tools, our employment team can help put these principles into practice. We can identify discrimination risks, review your hiring procedures and help you establish practical safeguards. Get in touch to discuss support for your organisation.