Yes. A UK recruiter can use AI to answer candidate calls, but UK GDPR applies to the personal data it collects, and the Equality Act 2010 to how candidates are treated. Tell candidates how the AI uses their information, collect only what you need, check for bias, and either keep a person meaningfully involved in each decision about a candidate or put the legal safeguards for automated decisions in place.Note 1: general information and sources
Our own product, Prime Assist, is described in a separate section at the end, in wording from our facts page.
What did the ICO find about AI recruitment tools?
In November 2024 the ICO published its AI tools in recruitment audit outcomes report, on audits of developers and providers of AI sourcing, screening and selection tools. It found search features that allowed recruiters to filter out candidates with certain protected characteristics, and tools that inferred gender and ethnicity from a candidate’s name instead of asking. Some tools “collected far more personal information than was needed”, and some providers wrongly described themselves as processors rather than controllers. The ICO made 296 recommendations, and none were rejected.
The audits did not cover generative AI such as chatbots, but the ICO calls its seven key recommendations, from fairness and transparency to DPIAs and data minimisation, “crucial to all organisations when designing and using AI recruitment tools”.
In March 2026 its follow-up, Recruitment rewired, found that most of the employers it spoke to thought their tools only supported decisions, while the evidence indicated they were making solely automated ones.
What must you tell candidates?
When you collect personal data from a candidate, Article 13 of UK GDPR says you must tell them at that time who you are, why you are processing it and on what legal basis, how long it will be kept and what their rights are. If you use automated decision-making that needs the Article 22C safeguards, you must say so and give “meaningful information about the logic involved”.
The ICO’s 2024 report says recruiters must tell candidates how the AI will process their information, including the logic behind its outputs and any use for training or testing. Your contract must say whether you or the supplier provides this. In 2026 the ICO called it poor practice to send candidates to the supplier’s privacy information instead of your own, because “accountability lies with the employer using the tool”, and called just-in-time notices at the point of collection a good approach. On a phone call, that point is the start of the call.
Why should a person make the decision about a candidate?
Since 5 February 2026, Articles 22A to 22D of UK GDPR have replaced the old Article 22, under the Data (Use and Access) Act 2025. Article 22A says a decision is based solely on automated processing “if there is no meaningful human involvement in the taking of the decision”, and is significant if it has a legal or similarly significant effect. A solely automated significant decision needs safeguards under Article 22C that let the candidate get information about it, make representations, obtain human intervention and contest it. Article 22B restricts them where they rely on special category data, such as data concerning health.
The ICO says human involvement must be “active and not just a token gesture or ‘rubber stamp’”, and must apply to every candidate, not only those who score highly. In its use cases, automatically rejecting candidates below a pass mark on a fit score is an automated decision. Automatically rejecting those who fail mandatory screening questions, with questions and answers preset by a person, such as eligibility to work in the UK, is not, because the tool “is limited to taking an action predetermined by a human in response to a binary outcome”.
On the phone, a clear position is an AI that asks your questions, records the answers and books the next step, while a consultant decides who goes forward.
How does the Equality Act 2010 apply?
Under section 39, an employer must not discriminate “in the arrangements A makes for deciding to whom to offer employment”. Section 55 gives an employment service-provider a similar duty, and section 56 says that includes a service for finding employment for persons or supplying employers with persons to do work. Under section 19, applying a provision, criterion or practice that puts people who share a protected characteristic at a particular disadvantage is indirect discrimination, unless it is shown to be “a proportionate means of achieving a legitimate aim”. Test your screening questions, and how the tool copes with different voices and accents, with that in mind. Both also have a duty to make reasonable adjustments for disabled people (sections 39(5), 55(6) and 55(7)), so plan another route for a candidate who cannot use an automated line. The Act applies in England, Wales and Scotland (section 217).
What should you ask any AI supplier?
Article 35 requires a DPIA before processing that is likely to result in a high risk to people’s rights and freedoms, and the ICO’s questions for recruiters buying AI say it should be carried out “prior to using an AI tool, ideally at the procurement stage”. Then ask in writing:
- What fairness, accuracy and bias testing have you done, including across accents and ways of speaking, and can we see the results?
- What does each call record: audio, transcript, which answers? Can we limit it to what the role needs, as data minimisation requires?
- How long is each category of data kept, why, and what happens at the end?
- Is our candidates’ data used to train or develop your models, or anyone else’s?
- Are you our processor, and are that role and our written instructions in the contract?
- Does the tool score, rank, reject or infer anything about candidates, or does it only record answers?
- How does a candidate reach a person during the call?
- Does it tell candidates at the start of the call that it is an AI?