Key Takeaways
- If a rejection was made with no meaningful human involvement, UK law lets you ask for information about it, make representations, get human intervention and contest it.
- The ICO found in March 2026 that many employers are making solely automated decisions while believing a human is involved.
- Ask in writing while the vacancy is still open, and say you are requesting human intervention.
A rejection that arrives forty minutes after you applied, at two in the morning, from a company that received nine hundred applications, was probably not read by anyone. That instinct is now backed by the regulator. In March 2026 the Information Commissioner's Office published Recruitment rewired, a report on how UK employers automate hiring, and its central finding is blunt: many employers running automated recruitment are relying on solely automated decisions without recognising that this is what they are doing.
That matters to you for one practical reason. A decision made with no meaningful human involvement carries a set of rights that a decision made by a person does not.
What the ICO found when it looked at automated hiring
The report is based on evidence from more than 30 employers who talked to the ICO voluntarily between March 2025 and January 2026. It is not an audit or an investigation, and the ICO says so plainly: these are findings and expectations, not enforcement.
The findings themselves are specific. Most employers told the ICO their tools were decision support rather than decision-making, on the basis that a hiring manager reviewed the scores. The evidence the ICO saw indicated otherwise. Hiring managers facing high volumes were unlikely to review the responses of lower-scoring candidates at all, so the score was effectively making the decision at the bottom of the pile while a human genuinely weighed up the top.
The ICO's own worked example is a tool that grades candidates red, amber or green. The manager is trained to review every score, but in practice prioritises the green ones, glances at the red ones and rejects them. The report's verdict on that glance: the manager has rubber-stamped the rejection, and it counts as a solely automated decision.
The uncomfortable implication is that two candidates in the same process can be treated differently. The one who scored well gets a human weighing up their answers. The one who scored badly gets a click.
How common is it? A survey of 1,000 UK HR and talent professionals by the background-checking platform Zinc, cited in the ICO's report, found 37% automated rejections entirely. Separately, the Institute of Student Employers' 2025 recruitment survey found 70% of employers expect to increase their use of automation in selection over the next five years.
When is a job rejection "solely automated"?
The test is now written into the law. The Data (Use and Access) Act 2025 replaced Article 22 of the UK GDPR with new Articles 22A to 22D, in force from 5 February 2026. Article 22A says a decision is based solely on automated processing "if there is no meaningful human involvement in the taking of the decision".
The ICO's reading of what makes involvement meaningful is the useful part. The question is whether a human can exercise real influence over the decision before it is applied, and has the authority, discretion and competence to alter it. If they are simply applying whatever the system produced, that is not involvement. A person clicking "reject" on a screen full of red scores has not made the decision. The system did.
Two things follow:
- Automated screening is legal. The DUAA made it more permissive, not less. Nobody is doing anything wrong by using a tool to rank applications.
- The rights attach to the decision, not to the technology. It does not matter whether the employer calls it AI, an algorithm, or a scoring dashboard. What matters is whether a person meaningfully made the call.
What you can ask for after an automated rejection
Where a significant decision is based solely on automated processing, Article 22C requires the employer to have safeguards in place. The safeguards must include measures that:
- Provide you with information about the decision taken about you.
- Enable you to make representations about it - to put your side.
- Enable you to obtain human intervention from the employer, often called human review.
- Enable you to contest the decision.
The ICO's guidance for employers adds detail on the transparency half. Candidates should be told how the tool is used to make decisions, how accurate it is, and what safeguards are in place. Employers must provide that information at three points: when they first collect your data, when you make a subject access request, and when the automated decision is actually taken.
On its own findings, most are not doing the last part well. The ICO saw privacy notices that were not specific or visible enough to tell candidates that automated decisions were happening, employers pointing candidates at the tool vendor's privacy information rather than their own, and no substantial evidence that employers were explaining the logic involved or how accurate their tools are.
Which is why asking is not rude. The ICO's own advice to jobseekers, published the same day, is that if you believe an automated decision is wrong you can ask how it was reached, contest it, explain your point of view and request that a real person take a second look.
How to ask for a human review of an automated rejection
Keep it short and factual. A long complaint gets forwarded; a specific request gets answered.
Reply to the rejection email, or write to the careers or HR address, while the vacancy is still open. Say four things: the role and reference, that you believe the decision was made without meaningful human involvement, that you are requesting human intervention and contesting the decision under Article 22C of the UK GDPR, and one or two sentences of representation - the thing the scoring missed. If you want the underlying detail, add a subject access request for the personal data held about your application, including any score or profile generated.
I applied for [role, reference] on [date] and was rejected on [date]. Given the timing, I believe the decision may have been taken without meaningful human involvement. Under Article 22C of the UK GDPR I am requesting human intervention and contesting the decision, and I would like information about how it was reached. For context: [one or two lines the score would have missed]. I would also like to make a subject access request for the personal data held about my application, including any score or profile generated about me.
Two realistic expectations. A human review does not mean you get the job, and an employer that genuinely had a person weigh up your application will simply say so. If you get no meaningful response, the escalation is a complaint to the ICO, which is free.
The ICO has also updated its guidance on automated decision-making and profiling, now out for consultation, and says it will update its recruitment and selection guidance during 2026.
What none of this changes about your CV
Rights are a backstop, not a strategy. Three limits are worth stating.
The first is scale. You cannot contest fifty rejections, and most will not have been solely automated anyway.
The second is that the loudest number in this debate is still made up. The claim that 75% of CVs are auto-rejected before a human sees them traces back to the marketing of a company that closed in 2013 and never published a method, which we set out in full in our look at the ATS myths that hurt your job search. The ICO's findings do not rescue that figure. They say something narrower and better evidenced: solely automated rejection is real, more common than employers themselves believe, and concentrated at the bottom of the score distribution.
The third is the failure mode that no right can fix. A CV that parses badly is not rejected by anything - it is never surfaced in the recruiter's search at all, so there is no decision to contest and no rejection email to reply to. Understanding what the software extracts and scores is still the part that changes outcomes, because it decides whether you are in the pile that a human argues over.
FAQ
Can a company legally reject my job application using AI?
Yes. Automated screening is lawful in the UK, and the Data (Use and Access) Act 2025 widened the circumstances in which solely automated decisions can be made. What the law requires is safeguards: you must be told, and you must be able to get information, make representations, obtain human intervention and contest the decision.
How do I know if my rejection was automated?
You often cannot know for certain, which is why asking is the mechanism. Speed and volume are hints rather than proof. The employer's privacy notice should say whether automated decision-making is used, and a subject access request will reveal any score or profile held about your application.
What is "meaningful human involvement"?
Under Article 22A of the UK GDPR, a decision is solely automated if there is no meaningful human involvement in taking it. The ICO's test is whether the person can exercise real influence before the decision is applied and has the authority and competence to change it. A manager clicking through low scores without reading the applications is rubber-stamping, not deciding.
Will asking for a human review annoy the employer?
A short, factual request is a normal exercise of a data protection right, and the ICO tells jobseekers they can make it. It is not a complaint about the outcome. Keep it to the role, the request and one or two lines of context, and send it while the vacancy is still open.
What if the employer ignores my request?
You can complain to the ICO, which is free and does not need a solicitor. Be realistic about the outcome: the ICO's March 2026 work with employers was voluntary engagement rather than enforcement, and its immediate result was 16 organisations agreeing to change their practices, not compensation for individual candidates.
Most rejections you will never be told about, and the ones you can contest are the small end of the problem. The bigger one is a CV the software reads badly enough that no human ever argues about it. Run yours through Shadow CV's free scan to see the fields the parser actually extracted and where the score leaks. If it comes back thin, the £5 rewrite fixes the structure and the keyword coverage so your application lands in the pile that gets read, once, with no subscription.