If an AI tool used in your recruitment process disadvantages candidates who share a protected characteristic, that is indirect discrimination under the Equality Act 2010, and the employer using the tool is liable. It makes no difference that the software was bought from a vendor, that nobody intended the outcome, or that no human saw the protected characteristic. Employers also have transparency and automated decision-making duties under UK GDPR. Using AI in hiring safely means understanding how bias arises, testing tools for adverse impact, keeping meaningful human review, and being able to explain a decision to a candidate who challenges it.
AI now sits at every stage of hiring: tools that decide who sees a job advert, screeners that rank CVs, chatbots that sift applicants, and platforms that score recorded video interviews. This guide explains the legal position for UK employers and what a defensible process looks like.
How recruitment AI discriminates
Most recruitment tools learn from historical data about who was hired and who performed well. If the historical workforce skewed towards one group, the tool learns that group’s characteristics as markers of a good candidate. The best known example is a large technology company’s CV screening tool, abandoned after it was found to downgrade CVs containing the word “women’s”, because the training data was dominated by male applicants.
The subtler problem is proxy discrimination. A tool that never sees age, sex, race or disability can still find stand-ins for them: gaps in employment history, postcode, the name of a school, the year of a qualification, or speech patterns in a video interview. The tool is not told to discriminate. It finds the pattern anyway.
The Equality Act position
Section 19 of the Equality Act 2010 makes it unlawful to apply a provision, criterion or practice that puts people sharing a protected characteristic at a particular disadvantage, unless it is a proportionate means of achieving a legitimate aim. An AI screening tool is a provision, criterion or practice. If it produces a disadvantage for, say, older applicants or applicants of a particular ethnicity, the employer must justify it or is liable.
The duty to make reasonable adjustments applies too. A video interview tool that scores candidates on eye contact and fluency may disadvantage autistic candidates, candidates with speech impairments, and candidates with certain visual impairments. An employer who cannot offer an alternative route has a problem.
“The software did it” is not a defence. The Equality and Human Rights Commission and employment tribunals treat the employer as responsible for the tools it chooses to use.
The data protection position
UK GDPR adds a second layer. Candidates must be told, in plain language, that AI is used in the process and how. Recruitment AI usually involves profiling and is likely to be high risk, which means a data protection impact assessment before deployment. Decisions made solely by automated means that significantly affect a candidate, such as automatic rejection, are subject to specific safeguards: the right to obtain human intervention, to express a point of view, and to contest the decision. The Information Commissioner’s Office audited AI recruitment tools in 2024 and found widespread problems with excessive data collection, unclear lawful bases, and tools inferring protected characteristics from candidate data.
What a defensible process looks like
- Ask vendors the hard questions before buying. What data was the tool trained on? Has it been tested for adverse impact across protected characteristics in the UK? Can it explain why it ranked a candidate as it did? Who owns the liability if it discriminates?
- Test for adverse impact yourself. Compare pass-through rates at each stage by protected characteristic. A tool that passes 30 per cent of one group and 15 per cent of another needs explaining, whatever the vendor says.
- Keep meaningful human review. A recruiter clicking “accept” on a ranked list is not meaningful review. The human must be able to override the tool, see why it made its recommendation, and actually do so in practice.
- Tell candidates. Say where AI is used and offer an alternative for candidates who need an adjustment.
- Record decisions. If a candidate challenges a rejection, you need to be able to show what the tool did and what the human decided.
- Review regularly. Tools update, vendors retrain models, and your applicant pool changes. Adverse impact testing is not a one-off.
This sits alongside the broader question of how AI is used across the business. Our guide to AI in the workplace covers policy and staff training, and our guide to neurodiversity and reasonable adjustments covers the adjustments side of hiring.
AI in Recruitment and HR: Equality Act Compliance
An online course for HR professionals and hiring managers covering algorithmic bias, the Equality Act and UK GDPR framework, vendor due diligence, adverse impact testing and meaningful human review. Three to four hours, NFAQ certified.
Frequently asked questions
Is it unlawful to use AI in recruitment?
No. It is unlawful to discriminate, and to process personal data without meeting UK GDPR requirements. AI tools can be used lawfully if they are tested, transparent and subject to real human oversight.
Can we rely on the vendor’s bias testing?
Ask for it and read it, but do not rely on it alone. Vendor testing is often done on a different population from your applicants, and the liability under the Equality Act is yours.
Do candidates have a right to know a machine rejected them?
Candidates have a right to be told that automated decision-making is used and to request human intervention where a decision is solely automated and significantly affects them. Being open from the start avoids most complaints.
What is the risk if we get it wrong?
Discrimination claims in the employment tribunal are uncapped, and a systemic issue in a screening tool can affect every candidate who applied. Add ICO enforcement for data protection failures and reputational damage from a published judgment.
This article was published in October 2026 by National Compliance Training. Regulations change, so always check the latest guidance from GOV.UK for the current position. This article does not constitute legal advice.