Using AI in Recruitment Legally: GDPR, the EU AI Act and Bias Checks for Agencies

Recruitment agencies can use AI legally, but candidates must be told, a person must be able to review and change any significant decision, and the tool must be checked for unfair or discriminatory effects. In the UK and EU, data protection law already applies to every AI screening tool, and in the EU the AI Act treats recruitment AI as high-risk, with those obligations currently expected from December 2027.

This guide sets out the rules for agencies in plain language, with a checklist. It was last updated on 15 October 2026. It is a general guide, not legal advice: the law is changing quickly, and you should take advice on your own tools and circumstances.

What changed in UK law in 2026?

On 5 February 2026, the Data (Use and Access) Act 2025 replaced Article 22 of the UK GDPR with new Articles 22A to 22D. Solely automated decisions with a legal or similarly significant effect, and job screening is the classic example, are no longer generally prohibited for ordinary personal data. Instead, they are allowed if safeguards are in place. A decision is solely automated when there is no meaningful human involvement in taking it.

The safeguards in Article 22C are clear: tell the person about the decision, let them make representations, give them a route to human intervention, and let them contest the decision. Stricter limits remain where a significant decision is based on special category data, such as health or ethnicity; in that case, solely automated decisions are allowed only with explicit consent or under narrow legal conditions.

What does the ICO expect from recruiters?

The ICO's November 2024 audit of AI recruitment tool providers found tools that let recruiters filter candidates by protected characteristics, tools that inferred gender and ethnicity from names, excessive data kept indefinitely, and poor privacy information.

On 31 March 2026 the ICO announced the findings of "Recruitment rewired", its work with more than 30 employers. Its key finding was that "many employers engaging in automated recruitment are likely relying on solely automated decisions", often without realising it. It expects employers to tell candidates about automated decision-making, apply meaningful human involvement consistently to every candidate at a stage, test regularly for biased outputs, and tell candidates how to challenge a decision.

The ICO consulted on draft automated decision-making guidance from 31 March to 29 May 2026; the final version is planned for winter 2026. The draft says meaningful human involvement means a reviewer with real authority who understands the output and can override it. Rubber-stamping does not count.

What do UK and EU data protection rules require?

A lawful basis. AI screening is processing of personal data. Agencies usually rely on legitimate interests, with a documented legitimate interests assessment. Consent is weak in recruitment because of the imbalance of power.
Transparency. Privacy notices must say that AI or automated decision-making is used, explain the logic in an intelligible way, and set out the consequences and retention periods.
A DPIA before you deploy. The ICO expects a data protection impact assessment early, before an AI recruitment tool goes live.

In the EU, Article 22 of the GDPR is unchanged: solely automated significant decisions are prohibited unless necessary for a contract, authorised by law, or based on explicit consent, with rights to human intervention and to contest. The Court of Justice has held that an automatically produced score can itself be the decision if a third party relies on it heavily (SCHUFA, December 2023). So a score a client relies on to reject candidates could fall within Article 22. A 2025 ruling (Dun & Bradstreet Austria) confirmed that candidates are entitled to an intelligible explanation of how the logic was applied to them. A proposal to amend Article 22 has not passed.

How does the EU AI Act affect recruitment?

The AI Act lists AI systems used "to analyse and filter job applications, and to evaluate candidates" as high-risk. Systems that only perform a narrow procedural or preparatory task and do not profile people can fall outside that category. A pure CV parser may; ranking or matching candidates is likely profiling. That is interpretation, so check the European Commission's guidance.

The vendor is usually the provider, and the agency using the tool is a deployer. Deployers of high-risk AI must use it as instructed, assign trained human oversight with authority, monitor it, keep its logs for at least six months, use the vendor's information for their DPIA, and tell people when a high-risk system makes or assists decisions about them.

Some rules already apply. Since 2 February 2025, emotion recognition in the workplace has been prohibited, and Commission guidelines say this extends to job candidates, such as emotion-reading video interview analysis. AI literacy duties for staff have also applied since February 2025. The high-risk obligations for recruitment were due in August 2026, but according to law-firm summaries of the Digital Omnibus on AI (Regulation (EU) 2026/1744), they now apply from 2 December 2027. Check the final text in the Official Journal before relying on exact dates.

What about the United States?

New York City has required annual independent bias audits and candidate notice for automated employment decision tools since July 2023, including for employment agencies.
Illinois has regulated AI analysis of video interviews since 2020, and since 1 January 2026 it has been a civil rights violation to use AI that has the effect of discriminating, with notice required.
Colorado repealed its 2024 AI Act in May 2026 and replaced it with a narrower law due to take effect in 2027; check the enacted text for detail.
Federal law still applies. The EEOC removed its AI guidance in January 2025, but Title VII, the ADEA and the ADA are unchanged.

How does the Equality Act 2010 apply to AI tools?

Discrimination law applies whatever tool makes the recommendation. A neutral criterion that disadvantages a protected group, such as penalising CV gaps or certain postcodes, can be indirect discrimination unless it is a proportionate means of achieving a legitimate aim. There is no "the algorithm did it" defence. Timed tests or video analysis may need reasonable adjustments for disabled candidates. The Equality Act covers recruitment agencies directly, and agencies that follow a client's discriminatory instructions can also be liable.

The government's "Responsible AI in Recruitment" guide (March 2024), developed with the ICO, EHRC, REC, APSCo and CIPD, sets out practical assurance steps.

What checklist should an agency follow?

Map your AI. List every tool that sources, parses, ranks, scores, chats with or rejects candidates, including features inside your ATS.
Decide the role of the human. Find any solely automated step, such as auto-reject or score thresholds, and either add meaningful human review applied to every candidate at that stage or meet the safeguards.
Do a DPIA and a legitimate interests assessment before go-live, and record controller and processor roles with the vendor and the client.
Ask vendors: what data is used, whether protected characteristics are inferred, what bias testing they have done with what results, field-level accuracy, retention and training on your data, sub-processors and hosting, their EU AI Act role, and whether they detect hidden text in CVs.
Avoid prohibited uses, such as emotion-recognition video interviews for EU candidates.
Tell candidates that AI is used, what it does, the main factors and how to ask for human review, contest a decision or request adjustments.
Offer adjustments, never use proxies such as postcodes or gap penalties, and train staff on when to override a tool.
Keep records and monitor outcomes: log which tool scored whom and what the human decided, check results by group where you lawfully hold the data, and review annually.

How does Crumblelead's AI fit?

Crumblelead's AI matching does not decide who gets hired. When you run AI Match on a job, it shortlists up to ten people from your own database and asks a language model to score each one against the job's title, description, requirements and location, based on their current role, skills and profile summary. It shows candidates who score 65 or more, each with a one-line summary, strengths, concerns and gaps. Nothing in Crumblelead rejects a candidate or moves them between stages automatically: a recruiter decides who to contact and who to put forward.

CV parsing also uses a language model, and CVs containing text aimed at AI tools are flagged on the candidate's profile for a person to review. Our FAQ states that we never train or fine-tune AI models on your candidates, and that our third-party AI provider does not use data sent through its API for training. None of this makes an agency compliant on its own. You remain responsible for your lawful basis, notices, human review and outcome monitoring, so ask us, as you would any vendor, the questions in the checklist above. See also why we built AI to assist recruiters and our GDPR tools.

FAQ

Can a recruitment agency reject candidates using AI alone?

In the UK, since February 2026, solely automated significant decisions are allowed for ordinary personal data only with safeguards: notice, a chance to make representations, human intervention and a right to contest. In the EU they remain prohibited unless an exception applies.

When do the EU AI Act's recruitment rules apply?

Prohibitions and AI literacy duties have applied since February 2025. According to law-firm summaries of the Digital Omnibus on AI, the high-risk obligations for recruitment now apply from 2 December 2027.

What counts as meaningful human involvement in a hiring decision?

According to the ICO's draft guidance, the reviewer must have real authority, understand the basis of the output and be able to challenge or override it, consistently for every candidate at that stage. Rubber-stamping does not count.