AI CV screening in the UK after the Data (Use and Access) Act: what applies in 2026
Short answer: Since 5 Feb 2026, UK GDPR generally allows significant solely-automated decisions (like auto-rejecting a candidate), with safeguards: tell people, let them make representations, offer human intervention, and let them contest the decision. Special-category data stays restricted. The ICO's updated ADM guidance is still in draft. If EU roles or clients use your output, EU Annex III high-risk duties for recruitment apply from 2 Dec 2027.
Safeguard checklist
- Candidates told an automated decision is made
- Route to a human review, with a named owner
- Way to contest, with a response time
- No special-category data in solely automated decisions without a lawful condition
- DPIA for high-risk processing
- Complaints process (DUAA duty since 19 Jun 2026)
Next step: record your AI systems in the EURO AI Register free edition. It runs in your browser, with no account and no upload. Paid plan from $19/month if you need more.
Official sources
- https://www.cliffordchance.com/insights/resources/blogs/talking-tech/en/articles/2026/02/key-aspects-of-the-data--use-and-access--act-take-effect.html
- https://cy.ico.org.uk/about-the-ico/ico-and-stakeholder-consultations/2026/03/ico-consultation-on-the-draft-guidance-about-automated-decision-making-including-profiling/
- https://www.legislation.gov.uk/uksi/2026/82/made
- https://ai-act-service-desk.ec.europa.eu/en/ai-act/timeline/timeline-implementation-eu-ai-act
General information, not legal advice. Unadhi is not affiliated with the UK Government, the ICO/Information Commission or any EU authority.
Why Unadhi exists: small teams deserve plain-English compliance tools at a fair price. Spotted an error? Write to mininglife7@gmail.com and we will fix it.