AI for recruitment agencies: what to automate first in 2026

AI can sort and summarise CVs. Letting it reject candidates on its own is where UK law steps in, through UK GDPR's automated decision rules and the Equality Act 2010.

UK GDPR automated decisions from 5 February 2026

Section 80 of the Data (Use and Access) Act 2025 replaced Article 22 of UK GDPR with new Articles 22A to 22D. Bratby Law's commencement tracker dates the change to 5 February 2026 and describes the new default as "permission subject to safeguards".

• A decision is solely automated when there is "no meaningful human involvement". A consultant who clicks approve on every AI ranking without reading the CVs may not count.
• A significant decision is one with a legal or similarly significant effect. Treat an automatic rejection, which affects someone's chance of work, as significant.
• Article 22B bars solely automated significant decisions that rest on special category data, such as health or ethnic origin, unless the candidate gave explicit consent or another narrow exception applies.
• Article 22C requires safeguards for any solely automated significant decision. Candidates must get information about it, a way to make representations, human intervention and a way to contest it.

Equality Act bias risk

Section 56 of the Equality Act 2010 counts "a service for finding employment for persons" and "a service for supplying employers with persons to do work" as employment services. Section 55 bars employment service-providers from discriminating in how they select people for the service, and it carries a duty to make reasonable adjustments. A screening tool that marks down career gaps, certain postcodes or non-UK qualifications can disadvantage people with protected characteristics. The REC warns members that AI learns from historical data, so past bias can be learned and amplified, and it recommends regular bias audits.

What the ICO's audit of AI recruitment tools found

The ICO audited developers and providers of AI sourcing, screening and selection tools and published its outcomes on 6 November 2024. It made almost 300 recommendations, and the companies accepted or partly accepted all of them. The ICO found tools that:

• let recruiters filter out candidates with certain protected characteristics
• inferred gender and ethnicity from a candidate's name instead of asking
• collected far more personal information than they needed
• kept data indefinitely to build large candidate databases, often without candidates knowing

Questions to ask before you buy a screening tool

The ICO published six considerations for buyers on the same day. Turn them into questions for any vendor.

1. Have we completed a data protection impact assessment, ideally at procurement?
2. What is our lawful basis, and do we need an extra condition for special category data?
3. Does the contract say who is controller and who is processor?
4. How will we tell candidates the tool is used, explain its logic and let them challenge a decision?
5. What evidence does the vendor give that it has tested for bias, and how will we monitor results?
6. Does the tool collect only the data it needs, and does it stop reuse for other purposes?

APSCo UK publishes vetting checklists for AI tool users, AI tool providers and the tool itself, plus guidance on legitimate interests assessments and audit questions for providers.

These three jobs take consultant time every week and carry little legal risk, which makes them the best first builds. Most of the work is moving data between systems that already hold it.

Interview scheduling

A scheduling flow reads the client's calendar, offers the candidate open slots, books the interview, sends invites and reminders, and writes the booking to the ATS. Vincere says its automation runs "from scheduling to shortlisting". A standalone booking tool can do the same if your ATS lacks it.

Notes into Bullhorn, Vincere or JobAdder

Call and meeting notes are the most common gap. A transcription step records the call with consent, a model writes a structured summary (skills, salary, notice period, availability, next steps), and the system saves it to the candidate or contact record. Check that your ATS plan includes API access before you plan the build, because consultants search the ATS, not a separate notes app.

Client reports

A weekly report pulls each open role's pipeline from the ATS, counts candidates by stage and drafts a short commentary. The account manager reads it, edits it and sends it. Keep a person on the send button, because the report goes to a client.

No independent UK study gives hours saved per recruiter. Vincere claims its platform helps users "reclaim 300+ hours annually", which is a vendor claim. Measure your own baseline instead.

1. For two weeks, have each consultant log time spent on notes, scheduling, outreach drafting, CV formatting and client reports.
2. Count how often each task happens, for example calls a day or interviews a week.
3. Multiply minutes per task by tasks per week to get hours per week for each job.
4. Estimate the share of each task the system will do, and keep the review time in.
5. Multiply hours saved by the consultant's hourly cost, and compare the yearly total with the build and running costs.

Use the same sum to choose what to build first. The task with the most hours and the lowest legal risk goes first.