https://www.noxia.co.uk/field-notes/thirty-employers-sixteen-letters · printed from noxia.co.uk · sources checked 24 September 2026
Field note · Employment
Thirty employers, sixteen letters, and three things they were told.
Regulators publish guidance constantly and it is easy to stop reading it. What they do is a better signal, and in March the ICO published the numbers: how many employers it engaged, how many it wrote to, and what it asked for.
- Employment
- Recruitment
- AI and the law
- Data protection
- Compliance
The short answer
On 31 March 2026 the ICO reported engaging with more than 30 employers over the previous year on automated decision-making in recruitment, and writing to 16 organisations with recommendations. Its 2024 audits of AI tool providers and developers produced nearly 300 recommendations. It set out three expectations: proactively monitor for bias, be transparent with jobseekers about whether and how automated decision-making is used, and explain rights to recourse, including how to get a human review.
On this page · 5 sections
The sequence is the finding. It narrows, and each narrowing is a decision a regulator took about somebody.
The three expectations, and what each one actually requires
- Proactively monitor for bias. That is the expectation. The ICO lists monthly bias reviews, and asking developers about their own bias testing before you buy, as good practice rather than as requirements. "Proactively" is the operative word: a tool that has never been tested against its own outcomes is not compliant because nobody has complained.
- Be transparent with jobseekers. Explain if and how automated decision-making is used. Not in a privacy notice nobody opens — in the process, where the candidate is.
- Explain rights to recourse. Tell candidates how to challenge a decision and how to request human review. A right nobody is told about is not a safeguard.
Of those three, the first is the one that requires a system and the other two mostly require writing. A bias review, monthly or otherwise, means holding the outcome data, comparing it across groups, and keeping the comparison — which does not happen by intention, only by design.
What the numbers tell you about the stage this is at
Thirty-plus engaged, sixteen written to. That is a regulator working through a sector methodically rather than making an example of anyone, and roughly half of those it engaged received recommendations — a high enough proportion to suggest the problems were not hard to find.
Nearly 300 recommendations to tool providers in the 2024 audits is the other half of the picture, and it is the half a buyer should care about: the shortcomings were substantially in the tools, and a firm that bought one inherited them. Asking a provider what came out of an ICO audit is a fair procurement question.
What this does not tell you
It does not say which employers, which tools, or what the recommendations were, and we are not going to guess. It does not indicate enforcement, and treating engagement figures as a prediction of fines would be reading them for something they do not contain.
It is also a snapshot from March. The underlying duty is the thing to work from; this is evidence about how it is being supervised. The stack check asks the procurement version of the same question.
Questions people actually ask
What has the ICO done about AI in recruitment?
It reported on 31 March 2026 that it had engaged with more than 30 employers over the previous year on automated decision-making in recruitment and written to 16 organisations with recommendations. Its 2024 audits of AI tool providers and developers produced nearly 300 recommendations.
What does the ICO expect from employers using automated hiring tools?
Three things: proactively monitor for bias — the ICO lists monthly bias reviews as good practice rather than a requirement; be transparent with jobseekers by explaining if and how automated decision-making is used; and explain rights to recourse, telling candidates how to challenge a decision and request human review.
Does an employer need to test a hiring tool it bought?
The ICO’s expectation of proactive bias monitoring sits with the organisation using the tool, not only with the provider. Regular testing against your own outcome data is the practical form of it, and the absence of complaints is not evidence that a tool is working fairly.
Should buyers ask providers about ICO audits?
It is a reasonable procurement question. Nearly 300 recommendations went to AI tool providers and developers in the 2024 audits, which indicates the shortcomings were substantially in the tools — and an organisation that bought one inherited them along with the duty to monitor.
Sources
- Information Commissioner’s Office, “Automated decisions can streamline the hiring process — with the right safeguards in place”, ico.org.uk, published 31 March 2026: engagement with more than 30 employers over the last year; 16 organisations written to with recommendations; nearly 300 recommendations made to AI tool providers and developers in 2024 audits. Expectations named: proactively monitor for bias — “Good practice also includes asking developers about their own bias testing when procuring tools and considering monthly bias reviews”; be transparent with jobseekers by explaining if and how automated decision-making is used; and explain rights to recourse, including how to challenge a decision and request human review. Quoted: “Being transparent about how you are using AI and automation in your recruitment processes gives people confidence.” ico.org.uk ↗ — primary; the regulator reporting its own activity re-checked yearly
- The release does not name the employers, the tools or the recommendations, and it reports engagement rather than enforcement. We have not inferred enforcement risk from it. Figures are as at 31 March 2026. — a stated limit on the coverage above
- The reading of “roughly half received letters” as evidence the problems were not hard to find, and the suggestion that ICO audit findings are a fair procurement question, are ours. — our own argument, labelled as such
Checked 24 September 2026. Next scheduled check 24 September 2027. Numbers that move — leaderboards, live indices — are re-checked every 30 days; annual datasets and rules in force every six months; dated research once a year. If something here has gone stale before we got to it, tell us and we will correct it and say what changed.
Cite this note
Noxia, “Thirty employers, sixteen letters, and three things they were told”, Field notes, 23 September 2026; sources checked 24 September 2026. https://www.noxia.co.uk/field-notes/thirty-employers-sixteen-letters
A bias review is a system, not an intention.
Holding the outcome data, comparing it across groups every month, and keeping the comparison is not something a busy team does by remembering to. We build it as a scheduled job that produces a dated artefact — the thing that exists when somebody asks what you have been monitoring.
Talk to us about thisRead next
What we found
Ranking job applicants is on the EU’s high-risk list. Most firms do it.
Employment and worker management is a named Annex III high-risk use. The deadline moved to 2 December 2027, but UK automated-decision duties arrived on 5 February 2026 and did not move.
Employment
Two employment changes already landed. The big one is January 2027.
Sick pay from the first day of illness and day-one paternity leave started on 6 April 2026. The unfair dismissal qualifying period falls to six months on 1 January 2027.
Advice & compliance
The UK’s AI rulebook has an author now, and it is the ICO.
The Data Protection Act 2018 (Code of Practice on Artificial Intelligence and Automated Decision-Making) Regulations 2026 came into force on 12 May 2026. The ICO must now write it.