--- title: "Is Automated Hiring Assessment Legal in the UK in 2026?" description: "Yes, and the rule most UK guidance still quotes was replaced on 5 February 2026. UK GDPR Article 22 is now Articles 22A-22D: the general ban on solely automated significant decisions is gone for ordinary data and survives for special category data. What that, the Equality Act's section 60 and section 19, and the ICO's two recruitment reports mean for a hiring test. Verified 8 September 2026." canonical: https://www.assessall.com/solutions/fair-hiring-compliance-uk source: AssessAll --- # The rules a hiring assessment has to survive in the United Kingdom. Pre-employment assessment is lawful in the UK, there is no UK AI Act, and there is no British equivalent of a New York-style bias-audit mandate. What has changed is the rule everyone quotes. On 5 February 2026 the Data (Use and Access) Act 2025 replaced UK GDPR Article 22 with Articles 22A to 22D, and the general prohibition on solely automated decisions with legal or similarly significant effects no longer applies to ordinary personal data — it survives only where special category data is involved. That single carve-out is where an assessment vendor's bias monitoring can quietly move your screen back into the restricted regime. This page states each instrument, what it does to the instrument you are about to run, and what AssessAll does not do about it. ## Is it legal to reject a UK job applicant automatically on a test score? Since 5 February 2026, generally yes, with safeguards. New UK GDPR Article 22B permits a solely automated significant decision on any lawful basis provided the candidate is told, can make representations, can obtain human intervention and can contest the outcome. Where special category data is involved the older restriction still applies, and the Equality Act 2010 applies either way. ## What goes wrong today - **Almost every UK page still quotes an Article that no longer exists** — "Article 22 of the UK GDPR gives candidates the right not to be subject to a decision based solely on automated processing" is the sentence the lane repeats, and it stopped being the law for decisions taken on or after 5 February 2026. Article 22 was replaced by Articles 22A-22D. For a screen that does not touch special category data, the question is no longer whether you are permitted to automate the decision; it is whether you can evidence the four safeguards. Buying a tool on the strength of a compliance page written to the old rule means you have bought against the wrong test. - **The bias monitoring is what pulls you back under the strict rule** — The relaxed regime is only for ordinary personal data. Ethnicity, religion, health and sexual orientation are special category data, and the ICO's recruitment audit found providers inferring gender and ethnicity from candidate names in order to run adverse-impact checks. Information intentionally inferred that way is still special category data. So a vendor that quietly infers ethnicity to produce a fairness dashboard has, without telling you, moved your automated sift out of Article 22B and into the restricted regime — and the audit also found the inferred data too crude to detect bias reliably, so you get the heavier obligation and a monitoring signal you cannot trust. - **A vendor's "80% rule passed" badge means nothing in a UK tribunal** — The four-fifths rule is an American enforcement convention, and even in the United States its own text says smaller differences may constitute adverse impact where they are significant in statistical and practical terms, and greater differences may not where the numbers are small. Section 19 of the Equality Act 2010 has no threshold at all. A selection ratio of 0.85 clears the American rule of thumb and can still be indirect discrimination here if the practice puts a group at a particular disadvantage and you cannot show it is a proportionate means of achieving a legitimate aim. This criticism applies to AssessAll's own adverse-impact monitor, and it is stated below rather than buried. - **The pre-offer health question is the routine configuration that trips section 60** — A wellbeing question inside a personality inventory, a stamina item in a shift-work screen, or a generic "do you have any medical conditions" field copied from an onboarding form is a pre-offer enquiry about health. Only the EHRC can enforce section 60 directly — but if you ask a prohibited question and then reject the applicant, the burden of proof shifts to you in any disability discrimination claim they bring. The narrow thing you are allowed to ask before the offer is whether the candidate needs an adjustment in order to take the assessment, which is precisely the question most screens forget to ask. - **"No AI law" is being read as "no rules", and the regulator has already said otherwise** — The UK has no AI statute and there was no AI bill in the 2026 King's Speech, which several vendor pages present as a compliance holiday. The ICO's March 2026 Recruitment rewired report reached the opposite conclusion from voluntary engagement with over 30 employers: many employers running automated recruitment are likely relying on solely automated decisions without the safeguards in place. The absence of an AI act removed nothing. Data protection law, the Equality Act and the tribunal system all reached automated hiring before any AI bill would have. ## What AssessAll does - **Adjustment-friendly delivery** — Time limits, proctoring tier and section structure are set per assessment rather than globally, so a candidate who needs extra time or an unproctored sitting can be given one without rebuilding the screen or moving them to a different instrument. - **Self-declared demographics, never inferred** — The platform infers no protected characteristic from a name, a photograph or a voice sample. The only demographic data it can hold is a self-declared, optional gender and a four-way age band, used for aggregate monitoring only and never displayed per candidate. - **A monitor that refuses to flag on thin data** — Adverse-impact groups smaller than five are shown but excluded from flagging, and a flag is written in the product as a prompt to investigate rather than a verdict. Both are behaviours in the scoring code, not policy language. - **Explainable scores for the human-intervention route** — Every candidate report carries a "How this level was decided" block naming which responses moved the band. That is what a reviewer needs in order to exercise real authority over an automated outcome rather than confirm it. - **Per-assessment proctoring tiers** — Proctoring is set across three tiers per assessment, so a screen can run unproctored where the evidence does not justify capturing a candidate's image and camera, which is a proportionality argument you may have to make. - **No participant accounts** — Cohort delivery runs on a share link or QR code with no account creation, so the personal data a screening drive collects is the assessment data and nothing else — a data-minimisation position that is easier to defend than one built on deletion promises. - **A public API and signed webhooks** — Assessment API v1 with a published OpenAPI 3.1 spec, and webhook deliveries signed with an HMAC-SHA256 signature over the exact raw body, so decision events can be recorded with their dates in your own system of record. - **Credit pricing, published** — US$0.50 a credit, published rather than quoted, so the cost of adding a second stage or a re-sit under an adjustment is arithmetic you can do before you commit. ## Use cases - A UK employer replacing a CV sift with a scored screen and needing to evidence the Article 22B safeguards around it - A staffing or RPO agency answering a client's data protection due-diligence questionnaire about the assessment step - An in-house talent team auditing an inherited screen for pre-offer health questions and unjustified timed sections - A training provider or L&D consultancy running assessments on a client's people and needing to say who controls what - A US or APAC employer hiring into the UK and discovering their bias-audit certificate is a fact about another jurisdiction - A DPIA author collecting the vendor-side inputs for an automated recruitment tool --- Source: https://www.assessall.com/solutions/fair-hiring-compliance-uk