AI Compliance for HR Consultancies
Data Act 2026 Risk Assessment

1. All AI tools used in recruitment and screening identified in writing Every AI system involved in any stage of recruitment — from CV screening to interview scoring — is documented. This includes tools embedded inside ATS platforms and LinkedIn.

2. Candidates informed of AI use in their application process Your privacy notice and job application process clearly discloses when AI is used to process applications or assist in shortlisting decisions, before candidates submit their data.

3. Right to explanation offered for AI-assisted shortlisting decisions Unsuccessful candidates who were screened by AI can request an explanation of how the decision was reached. Your process for responding to such requests is documented and tested.

4. Meaningful human review in place for automated shortlisting A human reviewer examines AI-generated shortlists with genuine scrutiny — not rubber-stamping. The reviewer has sufficient information to challenge the AI's ranking. Documented evidence of this review exists.

5. DPIAs completed for high-risk AI processing (biometrics, monitoring) Data Protection Impact Assessments have been completed for any AI tools that process biometric data (face recognition in interviews), monitor employee performance, or make scoring decisions at scale.

6. Data Processing Agreements in place with all HR AI vendors Every third-party AI system processing employee or candidate data has a signed DPA under UK GDPR Article 28. This includes ATS vendors, interview platforms, and engagement survey tools.

7. Lawful basis documented for each type of AI-assisted HR processing Your data register records the lawful basis (contract, legitimate interests, legal obligation, or consent) for each instance of AI processing involving employee or candidate data.

8. AI model bias audit conducted for recruitment/screening tools You have obtained or conducted a bias assessment for any AI tool used in recruitment. You understand whether the model's training data or scoring criteria could disadvantage protected characteristic groups under the Equality Act 2010.

9. Retention schedule updated to cover AI-generated HR data Your data retention policy covers AI outputs — interview scores, shortlist rankings, sentiment analysis results — and specifies how long these are held, who can access them, and when they are deleted.

10. Staff trained on AI obligations in HR — including Data Act 2026 HR staff who use AI tools have received training on their obligations under UK GDPR, the Data (Use and Access) Act 2026, and the Equality Act 2010. Training is documented and repeated annually.

All High Risk Medium Risk Lower Risk

Tool	Risk Level	Key Concern	Minimum Requirement
HireVue (AI video interviews)	HIGH	Automated scoring of facial expressions and speech patterns. Article 22 applies. DPIA is mandatory. Biometric processing requires explicit consent under UK GDPR.	DPIA required before use. Explicit candidate consent. Genuine human review of every AI score. Disclose use in job adverts.
Generic AI CV screening tools	HIGH	Automated shortlisting engages Article 22. Models trained on historical hiring data may encode bias against protected characteristics — Equality Act 2010 liability risk.	Bias audit required before deployment. DPIA required. Disclose to candidates. Human review must be genuinely substantive.
LinkedIn Talent Hub / Recruiter AI	MEDIUM	AI ranking of candidates by "fit" may engage Article 22. LinkedIn DPA available. Candidates may not be aware their LinkedIn data is used in your AI-assisted hiring.	Disclose use in privacy notice. Document lawful basis. Do not rely solely on AI ranking for shortlisting decisions.
Workday AI (performance/comp)	MEDIUM	AI features in performance management and compensation planning involve significant decisions that affect employment terms — potentially engaging Article 22.	Workday DPA available. Audit which AI features are active. DPIA recommended for performance-scoring features. Document lawful basis.
ChatGPT for HR communications	MEDIUM	Using ChatGPT to draft offer letters, rejection emails, or disciplinary correspondence involving named employees or candidates is a GDPR data breach risk without a DPA.	Prohibit use with any named individual data. Enterprise tier with DPA if used for generic template drafting only.
Culture Amp (engagement surveys)	LOWER	Engagement data is sensitive but Culture Amp holds a DPA and GDPR-compliant data practices. AI analysis of survey results should not be used as sole basis for employment decisions.	Confirm DPA and data residency. Document in register. Ensure AI insights are advisory only — decisions require human judgement.
Microsoft Copilot for HR documents	LOWER	DPA via M365 agreement. Risk is lower for document drafting assistance than for scoring/ranking. Copilot's ability to access HR files across the tenant requires careful scope configuration.	Configure sensitivity labels. Confirm EU data residency. Audit which HR files Copilot can access. Update privacy notice.

[Organisation Name] AI Use Policy — HR & Recruitment — Effective [Date]

[Organisation Name] uses AI tools in certain HR and recruitment processes. This policy sets out how we use those tools, your rights, and our obligations under UK GDPR, the Data (Use and Access) Act 2026, and the Equality Act 2010.

AI IN RECRUITMENT: We use the following AI tools in our recruitment process: [list tools]. These tools assist with [describe function — e.g. initial CV review / interview scheduling]. No recruitment decision is made solely on the basis of automated processing. All AI-assisted outputs are reviewed by a qualified HR professional before a decision is communicated to any candidate.

YOUR RIGHTS: If your application was subject to AI-assisted processing, you have the right to: (a) request an explanation of how the AI assessment was reached; (b) request human review of any automated shortlisting decision; (c) object to the processing under Article 21 UK GDPR. To exercise these rights, contact [HR Contact / DPO email].

DATA PROTECTION: All AI tools used in HR and recruitment hold Data Processing Agreements with [Organisation Name]. Candidate and employee data is not entered into tools that do not hold a signed DPA. Our full data processing register is available from [DPO contact].

BIAS AND FAIRNESS: We conduct periodic bias audits on any AI tool used in recruitment decisions. If you believe an AI-assisted decision may have been affected by bias related to a protected characteristic, you may raise a complaint under our Equality and Diversity Policy.

Policy reviewed: [Date] | Next review: [Date + 12 months] | DPO: [Name/Contact]

Copy

Not sure where your organisation stands?

Get a free AI compliance assessment. We'll review your HR tool stack, identify your Article 22 exposures, and tell you exactly what to fix — at no cost.

Claim Your Free Assessment →

Thanks — we'll be in touch within one business day.

No spam. We'll contact you once. Unsubscribe any time.