AI use policy for a recruitment agency

Recruitment is where AI tools make decisions about people that matter to them (who is found, who is shortlisted, who is rejected before a human looks), and where the law on automated decisions, discrimination and candidates' data is most engaged. An agency using AI to parse CVs, rank applicants or generate outreach needs a policy that keeps a human in the decisions, tests the tools for bias, tells candidates what is happening and keeps their data in vetted tools, and client terms that say what the agency warrants about its tools. For £995, fixed, with delivery in five working days, I draft the business's AI use policy and the contract provisions that accompany it.

Who this is for

Recruitment agencies, executive search firms, recruitment process outsourcers and in-house talent teams in England and Wales using AI tools in sourcing, screening, assessment or candidate communication.

What matters in a recruitment agency's AI use policy

The tools recruiters use and the candidates they affect

CV parsing and matching, candidate ranking, automated sourcing from professional networks, chatbots that screen applicants, video interview analysis, psychometric scoring and generated outreach are all in use in recruitment, each affects candidates in ways they do not see, and the policy begins by listing the tools the agency uses, what each does to a candidate's prospects, and the tier each falls in (assistance to a recruiter who decides; a recommendation a recruiter reviews; a decision the tool takes), because the legal obligations follow the tier; the policy is the agency's answer to the question the regulator's audits of recruitment tools have asked.

Screening, ranking and the automated decision the law restricts

under Article 22 of the UK GDPR as amended by the Data (Use and Access) Act 2025, a solely automated decision with legal or similarly significant effects is permitted outside special category data only with safeguards: the person is told, can make representations, can get human intervention and can contest, and rejecting a candidate is a decision with significant effects; the policy requires that no candidate is rejected solely by a tool (a recruiter reviews the rejections, not just the shortlist), that ranking and scoring are recommendations with the recruiter's reasons recorded, and that the agency can explain to a candidate in plain terms how a tool was used on their application, which Article 13(2)(f) requires it to be able to do.

Discrimination, bias and the tool that learned from the past

A tool trained on past hiring data learns past hiring patterns, and a tool that ranks candidates lower because of a career gap, a foreign qualification, a name or a postcode is discriminating in a way for which the agency is liable under the Equality Act 2010 (sections 39 and 55 cover employers and employment agencies, and section 19 covers indirect discrimination through a practice that disadvantages a protected group), with the tool's opacity no defence; the policy requires the agency to obtain from each tool provider its bias testing and the documentation of what the tool uses, to test the tool's outcomes against protected characteristics where the agency can, to prohibit tools that use proxies for protected characteristics (names, photographs, addresses, dates), to monitor rejection and shortlist rates by group, and to stop using a tool whose outcomes it cannot explain, because the agency cannot delegate its liability to the provider's terms.

Candidates' data, the tools and the notice candidates get

putting personal data into an AI tool is processing under the UK GDPR, so it needs a lawful basis, transparency to the individuals, an Article 28 agreement with the provider and, for uses that affect people, an Article 35 impact assessment, and recruitment tools that profile and score candidates are on the Information Commissioner's list of processing requiring an assessment; the policy requires candidates' data to be processed only in tools under the agency's data processing agreements (not pasted into a chatbot to summarise a CV), the candidate privacy notice to describe the tools, the impact assessment to exist before a tool is adopted, special category data to be kept out of screening tools, and sourcing tools to be used only within the networks' terms and with the Article 14 notice to the people found.

Generated job adverts, outreach and the messages candidates receive

Generated job adverts must not contain discriminatory wording (age-coded language, gendered terms, requirements that exclude a protected group without justification), must be accurate about the role and the terms, and must comply with the Conduct of Employment Agencies and Employment Businesses Regulations 2003, and generated outreach must identify the agency, must not pretend to be a personal message where it is a template sent to hundreds, and must comply with regulation 22 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 where it is marketing to an individual; the policy requires a recruiter to check every generated advert and message before it goes out, and prohibits chatbots from conducting screening conversations that the candidate is not told are automated.

Clients, the agreements and the contract provisions that go with the policy

Clients ask what tools the agency uses, some require the agency to use the client's own tools (which makes the client responsible for the tool's compliance and the agency responsible for its use), and some prohibit AI screening, and the contract provisions drafted with the policy go into the agency's client terms (the tools the agency uses and their role, the human review the agency applies, the warranty the agency gives about its process and the warranty it does not give about the tool's outputs, the client's obligations where the client's tools are used, the allocation of discrimination liability), its supplier terms with tool providers, and its staff contracts and handbook; the business's trade secrets, confidential information and clients' data must not be put into tools that may retain inputs or train on them, which is what the reasonable-steps requirement in the Trade Secrets (Enforcement, etc.) Regulations 2018 and the business's confidentiality obligations demand, and a client's vacancy and salary data is confidential.

What it costs

AI use policy, £995. Internal policy plus the accompanying contract provisions. Five working days.

AI provisions in a contract, £595. Review or draft AI-specific terms in a supply or customer agreement. Five working days.

Email me at geoffrey@caesar.co.uk with what you need and any documents, and I will confirm the scope and the fee in writing, usually the same working day.

What you get

• An internal AI use policy your staff will follow, rather than a document that bans everything and is quietly ignored
• Contract provisions covering output ownership, training data, confidentiality and liability
• A defensible position to give customers who ask what your AI governance looks like
• Review of your AI suppliers' terms, including what they reserve the right to change
• Practical guidance on what to permit, what to restrict and what to prohibit outright
• One round of amendments

What is not included

• Technical AI assurance, model testing or bias auditing
• Sector-specific regulatory approval
• Advice on non-UK regulatory regimes beyond flagging where they apply
• Ongoing regulatory monitoring

Questions I am often asked

Can our tool reject candidates automatically?

Not without the safeguards the law requires, and the policy's position is that a recruiter reviews the rejections, not only the shortlist. Ranking and scoring are recommendations a recruiter acts on with reasons recorded.

Who is liable if the tool discriminates?

The agency, under the Equality Act, with the tool's opacity no defence. The policy requires bias documentation from providers, monitoring of outcomes by group, no proxies for protected characteristics, and stopping a tool the agency cannot explain.

Can recruiters paste a CV into a chatbot to summarise it?

Not into a consumer tool: the candidate's data goes only into tools under the agency's data processing agreements and described in the candidate notice. The policy says which tools and provides business accounts.

Related guidance and services

• AI contracts and AI use policies, £995, the service this page describes
• Data protection agreements and privacy terms, £795
• Employment contracts and handbooks, £595
• Privacy notice for a recruitment platform
• Privacy notice for a recruitment agency

This page is general guidance for businesses in England and Wales, not advice on your own circumstances. Last reviewed: October 2026. Email geoffrey@caesar.co.uk.