AI use cases for recruitment: strong on value, heavy on scrutiny

Recruitment is one of the most AI-heavy parts of UK business, and one of the most closely watched. Adoption is already wide: the Recruitment and Employment Confederation found that 41% of UK recruitment businesses already use AI, with another 30% planning to within the year. The tools are already in the building, doing real work.

The scrutiny has moved just as fast. In March 2026 the ICO reported that many employers running automated hiring were doing it outside data protection law, and wrote to 16 organisations about it. All 16 agreed to change. There's a difference between what AI can do in recruitment and what it's allowed to do. And that's the thread running through every use case below.

The tools are useful. Where they have to prove their worth is in getting past a regulator (and, if it comes to it, a tribunal).

Where recruitment teams are putting AI to work

Most recruitment use cases sit on a spectrum of risk. Lower-risk situations mean that regulators are more comfortable; higher-risk ones will certainly raise alarms.

At the lower-risk end, AI handles the drafting and the admin. It writes first drafts of job descriptions from a structured brief, and checks the wording for phrases that deter protected groups, like "young and dynamic" or "ninja". It runs interview scheduling across candidate and panel diaries, and it answers candidate questions through a chatbot on the careers site.

None of those makes a hiring decision, which is what keeps the risk low. The chatbot still logs personal data, though, and still has to work for candidates who can't use a text box.

In the middle sit the matching tools. AI ranks candidates against a role from job boards, internal databases, and passive talent pools. It re-contacts people already in your applicant tracking system (e.g. Workday, Bullhorn, Greenhouse) who fit a new vacancy. It scores skills assessments and psychometric tests, too. This is a use case that the Institute of Student Employers found roughly tripled among graduate employers, from about 9% in 2022 to around 28% two years later.

These tools touch the decision even when a human signs it off, so they carry more weight.

At the higher-risk end is CV screening and shortlisting. This is the use case most likely to count as an automated decision in law (we'll come back to this later). The riskiest of the lot is video interview analysis that infers traits from facial expression or tone of voice.

It's worth knowing it exists. Two things make it a hard sell for a governance-led firm, though: the EU AI Act bans emotion recognition in the workplace outright. And even on a UK-only process where that ban doesn't reach, the equality and data-protection exposure is steep. We'd probably point most clients away from it.

The HR tasks that transfer straight in

A lot of what AI does well in recruitment isn't recruitment-specific at all. It's general office work that happens to land in a recruiter's inbox.

Summarising long documents is the obvious one. Interview notes, assessment write-ups, and reference replies pile up, and a model can compress them into a structured summary in seconds. The summary is still personal data, and it's still a draft a human has to check, because a model that drops a material point can steer a decision the wrong way.

Drafting from approved templates is another. Offer letters, rejection emails, and onboarding packs all start from boilerplate, and AI fills in the specifics. The risk shows up when the model strays from the approved wording, though. For example, drafting an offer letter, it might rewrite the standard clause and invent a notice period or promise a bonus the contract doesn't actually offer. Once that's in writing and sent, the candidate can hold you to it. The fix is to lock the legally-reviewed wording so the model only fills the blanks, and to have a person check every letter before it goes out.

Then there's knowledge retrieval. A model grounded in your own policies, employment-law handbooks, and IR35 guidance can answer a recruiter's question consistently. That can be better than pulling a senior colleague away from their work. The catch is that it inherits whatever's in the source.

If you feed it an out-of-date handbook, it'll repeat the error at scale. So the knowledge library has to be version-controlled and the answers have to point back to the document they came from.

The unglamorous layer that pays for itself

Not all the value is in the clever screening. A good deal of it is in the back-office work that surrounds every placement.

Candidate data hygiene is a real prize. Agency databases fill up with duplicates and half-finished records, and AI can find and merge them, and flag stale entries for review or deletion. That matters for matching accuracy, and it matters for the law: UK GDPR's storage limitation principle means you can't sit on candidate data forever.

Placement billing, invoice chasing, email triage, and management reporting all fall into the same bucket. They're routine and high-volume, and they don't usually touch a hiring decision, which makes them some of the safest places to start. The point worth making to a sceptical board is that you don't have to automate the screening to get a great return on your AI investment. Often the admin is where the hours actually go.

What an AI agent for recruitment actually looks like

Most of what we've covered so far is generative AI doing one task at a time: drafting a job description, or summarising a pile of interview notes. That's the well-understood bit, and it's where most teams start. An agent is the step beyond. It strings those tasks together and runs them end to end, with a person in the loop at the points that matter.

Picture an agent that takes a vacancy from brief to shortlist.

It parses incoming CVs in whatever format they arrive, pulls out the structured detail, and matches them against the role. It drafts a ranked shortlist with its reasoning attached. Then it stops, and hands that shortlist to a named recruiter who can change it, before a single candidate hears anything.

Built on Microsoft Azure, the pieces map onto specific services, though the exact mix depends on the job. Document parsing might run on Azure AI Document Intelligence. Retrieval over your policies and role data might use Azure AI Search. The orchestration that coordinates the steps might sit in Azure AI Foundry, with Azure Monitor keeping a timestamped log of why each candidate was ranked where they were. Meanwhile, Microsoft Entra ID controls who's allowed to override a decision. Run in the UK South region, candidate data stays in the country.

The ‘human in the loop’ is essential. The ICO has been explicit that human involvement has to be meaningful and active: a person with the authority and the competence to change the decision, exercising real influence before it takes effect. Rubber-stamping an AI shortlist doesn't count. An agent built for a governance-led firm has to route the decision to that person by design, not bolt the review on afterwards.

Discover More

The governance that decides which use cases survive

This is the part that separates a demo from something you can actually run. Recruitment AI sits on top of four bodies of law and regulation at once, and they don't always pull in the same direction.

Start with discrimination. The Equality Act 2010 covers nine protected characteristics, and an AI tool that produces worse outcomes for any of them can amount to indirect discrimination. That's unless you can show the practice is a proportionate means to a legitimate end. The trap is historical data. If you train a matching model on your past hires, it learns the shape of your past hires—demographics included.

Amazon scrapped an internal CV-screening tool for exactly this reason, after it taught itself to mark down applications that mentioned women. The example is American and a few years old, but it's still the cleanest illustration of the risk. It shows that the liability sits with the employer even when the tool came from a third party. The government's Responsible AI in Recruitment guidance was written with this sort of exposure in mind.

The ICO is the second pillar, and the most active right now. Its Recruitment Rewired report found a pattern: employers describing their tools as "decision support" when the tool was, in practice, making the decision. The regulator rejected that framing, and it rejected rubber-stamping as a substitute for human judgement. If your screening tool is effectively choosing the shortlist, the ICO treats that as an automated decision, with everything that follows.

What follows is the third pillar: the Data (Use and Access) Act 2025. It replaced the old Article 22 of UK GDPR with a new set of rules, Articles 22A to 22D, and changed the starting point. Solely automated decisions used to be banned unless an exception applied. Now they're broadly allowed on most lawful bases, as long as the safeguards are there: candidates have to be told a decision was automated, given a route to human review, and able to contest the outcome.

One exception stands out. Where the decision involves special category data, like health or biometric information, the stricter old regime still applies.

The fourth pillar reaches in from outside. The EU AI Act classifies recruitment AI as high-risk, and like GDPR it applies extraterritorially: a UK firm hiring into an EU office can be caught as a deployer. The high-risk obligations are currently due to bite on 2 August 2026, though a proposed Digital Omnibus package might push the standalone deadline back toward the end of 2027. The Act also bans emotion recognition in the workplace, which is the rule that takes video-sentiment analysis off the table.

Two more signals are worth noting. UK tribunals are starting to hear these arguments: the first UK case alleging AI recruitment discrimination was brought in 2025 and dismissed for lack of evidence, but its arrival tells you where the wind is blowing. And across England, Wales, Scotland, and Northern Ireland the data protection rules are the same, while equality enforcement runs through the EHRC in Britain and the ECNI in Northern Ireland.

Where this leaves a governance-led employer

The use cases are real, and so is the return, especially in the admin and matching layers where the legal exposure is lowest. You know that AI can do the work. It's just a question of whether the way you've built it would survive an ICO query or a tribunal claim.

That's the bet that Agents of Output is built around. We design and run AI agents for recruitment that do brilliant work and satisfy the rules at the same time. The human review, the audit trail, and the data controls are built in from the start, not bolted on once something goes wrong. The standards are still evolving. An agent worth running is one designed to be ready for them.