AI recruitment tools can speed up hiring, but they also create risks around bias, transparency and human oversight.
AI is now part of some of the biggest decisions a workplace makes.
Who gets hired? Who gets shortlisted. Who gets let go.
For small firms under pressure, the appeal makes sense. AI tools scan CVs, rank candidates, summarise interviews and review performance. What once took hours now takes minutes.
But lawyers are warning that most small businesses have no idea what they are legally responsible for when AI is involved in these decisions.
What’s happening in recruitment
According to LawDistrict, some UK employers are now using AI to decide who gets hired, shortlisted or dismissed.
These tools are not automatically unlawful. The problem is that most small businesses don’t know what data the systems use, or whether the results could be biased.
An AI tool can reject a CV before a human ever reads it. It can score candidates based on keywords or employment gaps. It can look fair on the surface while quietly repeating old patterns of bias.
If a business can’t explain why a candidate was rejected, it may not be able to defend that decision if challenged.
The law doesn’t move with the vendor
Ali Pinarbasi is a UK data protection solicitor working with LawDistrict.
“Outsourcing AI capabilities does not absolve businesses of their obligations under the UK GDPR,” he said.
In plain terms, using someone else’s tool does not make it their legal problem. The employer stays responsible for how personal data is handled.
That matters a lot in recruitment.
A CV contains personal data. So do interview notes and performance records. Some of that data can also reveal health conditions, disabilities, ethnicity or caring responsibilities.
When AI touches that data, employers need a legal basis for using it. They need to check that candidates have been told. And they need to know whether the tool puts people’s rights at risk.
How common is this?
The UK Government’s 2026 AI Adoption Research found that one in six UK businesses now uses at least one AI tool. More than half use it every day. Around 27 percent use it at least once a week, meaning eight in ten AI-using businesses rely on it weekly.
Marketing, administration and IT are the most common areas using AI. HR is used or planned in 26 percent of businesses.
As AI spreads into HR and hiring, the legal risk around people’s decisions keeps growing.
The same research found that ethical concerns were seen as the most significant barrier to AI adoption. Eight in ten businesses rated it a serious concern, ahead of cost and unclear regulation.
Yet many businesses using AI in recruitment are pushing ahead with no formal plan to address those concerns.
The check most businesses skip
LawDistrict says one of the biggest red flags is when businesses don’t carry out a Data Protection Impact Assessment before using AI in sensitive areas.
A DPIA finds problems before they happen. For AI hiring tools, those problems might include collecting too much data, unclear data flows, automated decisions with no human review, or bias in outcomes.
Pinarbasi said: “It’s essential to assess not just how the AI tool functions, but how data is collected, processed, and potentially reused.”
Most small businesses skip this entirely. Many don’t know it exists.
Candidates are often not told
Most people in the UK don’t know their data can be processed by AI, according to LawDistrict.
That’s a direct problem in recruitment. If candidates are not told AI is involved, employers may already be breaking transparency rules.
Lawyers say applicants should know when AI is assessing them, what data is being used and whether a human reviews the final decision.
It goes further than hiring
Hiring is just one area where AI is moving into workplace decisions.
Some firms also use it to monitor productivity, review internal messages and flag performance concerns. Staff who don’t know this is happening have no chance to respond or object.
Smaller firms face the biggest risk. AI tools get adopted quickly and with little review. A hiring manager tests a CV screener without legal sign-off. A founder pastes interview notes into a chatbot. HR uses AI to write rejection emails.
Each step seems small. Combined, they raise serious questions about privacy, fairness and accountability.
What good practice looks like
Businesses using AI in workplace decisions need to understand how those systems handle data. They should avoid sharing personal data that isn’t needed. And a human must stay part of every important decision.
In a hiring context, that final number should concern any employment lawyer.
AI helps businesses move faster. That is real and useful.
But it should not quietly shape decisions about people’s jobs without proper checks in place.
For small firms, the rule is simple. Let AI help. But don’t let it decide alone.
