AI in hiring decisions and automated decision-making

AI tools that screen, rank, score or reject candidates make decisions the law restricts, and the restriction was amended in 2025 in a way that permits more while demanding safeguards the employer has to be able to show. Alongside sits the Equality Act, under which the employer is liable for a tool's discrimination whatever the vendor's terms say, and the transparency rules, under which a candidate is entitled to know how the tool was used on them. The clauses go into the employer's or agency's contracts with the vendor, its candidate notices and, for an agency, its client terms. A fixed £595 covers the drafting or review of the AI provisions for the agreement, delivered in five working days.

Who this is for

Employers, recruitment agencies, recruitment process outsourcers and HR technology buyers in England and Wales using or considering AI tools in hiring, promotion, performance or other decisions about people.

What matters in AI and automated decisions about people

The decision the law restricts and the amendment that changed it

Article 22 of the UK GDPR, as amended by the Data (Use and Access) Act 2025, governs decisions with legal or similarly significant effects taken solely by an AI tool, permitting them outside special category data where the person is informed, can make representations, can obtain human intervention and can contest; before the amendment such decisions were prohibited unless an exception applied, and after it they are permitted for ordinary personal data where the safeguards are in place, while decisions based on special category data remain restricted to the narrower grounds; rejecting a candidate, shortlisting or selecting for redundancy are decisions with significant effects.

The safeguards and the human who must be real

The safeguards require the employer to tell the person that a solely automated decision has been taken, to let them make representations, to obtain human intervention and to contest the decision, and the human intervention must be meaningful (a person with the authority and the information to change the outcome who considers the case, not a recruiter clicking through the tool's rejections at speed); the employer either builds a genuine human stage (which takes the decision out of Article 22) or builds the safeguards into the process and records them; the clauses require the vendor's tool to support both and the employer's process to apply one.

Discrimination, the Equality Act and the tool that learned the past

A tool trained on past hiring data reproduces past patterns, and a tool that disadvantages candidates with a protected characteristic (through a proxy such as a name, a gap, a postcode, a university, a speech pattern in a video interview) is indirect discrimination under section 19 of the Equality Act 2010 unless justified, for which the employer is liable under section 39 and an agency under section 55, with the vendor's opacity and the vendor's terms no defence; the employer needs the vendor's bias testing and documentation, its own monitoring of outcomes by protected characteristic, a prohibition on proxies, a way to make reasonable adjustments for disabled candidates the tool cannot assess fairly, and the willingness to stop a tool whose outcomes it cannot explain; personal data entered into an AI tool is processing under the UK GDPR that needs a lawful basis, a notice to the individuals, a data processing agreement under Article 28 with the provider and, where the tool is used on people in ways that affect them, an impact assessment under Article 35, and recruitment tools are on the regulator's list of processing that requires one.

Transparency, the candidate notice and the explanation the employer must give

Article 13(2)(f) of the UK GDPR requires the candidate notice to give meaningful information about the logic involved in automated decision-making and profiling and its significance and consequences, which means the employer must be able to say in plain terms what the tool uses, what it does with it and what follows, and Article 15 lets a candidate ask for that information and for the data the tool held; a candidate notice that says 'we may use automated tools' has not met the requirement; the notice drafted with the clauses describes the tools, their role (decide, recommend, assist), the safeguards and the route to a person.

The vendor, the documentation and the clauses to demand

The clauses for the vendor agreement require the vendor to document what the tool uses, how it scores or ranks, and what testing for bias it has done and will repeat, to provide the information the employer needs for its impact assessment and its candidate notice, to support meaningful human review and the Article 22 safeguards in the product, to exclude proxies for protected characteristics, to notify changes to the model, to process candidate data only as the employer's processor under a data processing agreement with training excluded, to permit the employer to stop using the tool without penalty where outcomes cannot be explained, and to indemnify the employer for discrimination claims caused by the tool's design; a vendor that will not give the documentation is telling the employer what its tool is.

The agency, the client and who answers for the tool

Where a recruitment agency uses the tool on its own candidates it is the controller and answers for the decisions and the discrimination; where it runs the client's process with the client's tool it is the client's processor and the client answers, with the agency liable for its own use; and where the agency's tool is used on the client's applicants the roles need to be stated, because each party's duties follow its role; the clauses for the agency's client terms state the tools and their role, allocate the Article 22 safeguards and the Equality Act exposure, require the client to provide what its own tool needs, and limit the agency's warranty to its process rather than the tool's outputs; the Conduct of Employment Agencies and Employment Businesses Regulations 2003 continue to apply to the agency regardless of the tools.

What it costs

AI provisions in a contract, £595. Review or draft AI-specific terms in a supply or customer agreement. Five working days.

AI use policy, £995. Internal policy plus the accompanying contract provisions. Five working days.

Email me at geoffrey@caesar.co.uk with what you need and any documents, and I will confirm the scope and the fee in writing, usually the same working day.

What you get

• An internal AI use policy your staff will follow, rather than a document that bans everything and is quietly ignored
• Contract provisions covering output ownership, training data, confidentiality and liability
• A defensible position to give customers who ask what your AI governance looks like
• Review of your AI suppliers' terms, including what they reserve the right to change
• Practical guidance on what to permit, what to restrict and what to prohibit outright
• One round of amendments

What is not included

• Technical AI assurance, model testing or bias auditing
• Sector-specific regulatory approval
• Advice on non-UK regulatory regimes beyond flagging where they apply
• Ongoing regulatory monitoring

Questions I am often asked

Can our tool reject candidates automatically since the 2025 Act?

For ordinary personal data, yes, with the safeguards: the candidate told, able to make representations, able to obtain meaningful human intervention and to contest. Without the safeguards, or for special category data, the restriction remains. A genuine human stage takes the decision out of Article 22 altogether.

Is the vendor liable if its tool discriminates?

You are, under the Equality Act, whatever the vendor's terms say. The clauses make the vendor document and test for bias, support human review, exclude proxies and indemnify you, but the claim comes to the employer or agency first.

What does the candidate notice have to say?

Meaningful information about what the tool uses, what it does and what follows, whether it decides or recommends, the safeguards and the route to a person. 'We may use automated tools' does not meet the requirement.

Related guidance and services

• AI contracts and AI use policies, £595, the service this page describes
• SaaS and technology contracts, £995
• Data protection agreements and privacy terms, £795
• AI use policy for a recruitment agency
• Job applicant privacy notice

This page is general guidance for businesses in England and Wales, not advice on your own circumstances. Last reviewed: October 2026. Email geoffrey@caesar.co.uk.