Regulator guidance · procurement considerations

A regulator’s procurement warning remains useful

The ICO’s November 2024 recruitment-AI audit work identified improvements needed in fairness, data minimisation and explanations to candidates. Its procurement considerations ask employers to examine how a tool uses personal information and how people can exercise their rights. This is earlier regulatory guidance revisited in October 2026, not a newly issued October finding. [1]

Use the current legal framework

The UK’s general-processing rules for solely automated significant decisions changed in February 2026. The Data (Use and Access) Act framework distinguishes special-category data and retains safeguards, including a route to human intervention and challenge. Do not assume that an older reference to Article 22, or a supplier’s claim that someone checks the output, settles the current legal analysis. [2] [3]

ADM perspective

Build an invented applicant journey before signing. Ask the supplier to show the input fields, rejected-candidate explanation, correction route and actual human review. Require evidence for any claim that a score predicts job performance. Compare the result with a simpler structured process and record who can stop use if errors appear. Separate data needed to assess a person from data collected merely because it is available. Include the cost of review and correction in the business case, alongside any proposed time saving. This is a suggested procurement exercise, not a regulatory certification.

Read the original sources

The original publications provide the full detail, evidence and limitations.

  1. Information Commissioner’s Office · Regulator procurement considerations · November 2024Thinking of using AI to assist recruitment? Key data protection considerations
  2. Information Commissioner’s Office · Current regulator explanationDUAA: summary of data protection changes
  3. UK Government · Commencement regulations · PDFDUAA Commencement No. 6 Regulations 2026

An AI-assisted, source-led summary. “ADM perspective” is editorial interpretation, separate from the source’s findings. Our editorial approach.