Candidate Notices, Consent and the Right to a Human Review
Candidates have legal rights to know when automated systems are making decisions about them and to challenge those decisions through human review. These rights exist under employment law, data protection law, and increasingly under AI-specific regulation. Organisations that fail to provide notices or review processes face legal liability and reputational damage.
The Duty to Inform
Under UK employment law, candidates have the right to receive information about automated decision-making. This means if an automated system is making or significantly influencing a decision about the candidate (such as screening them out, inviting them to an interview, or assessing their suitability), the candidate has the right to know this and to understand the basis of the decision.
This is not a technical obligation to hand over the model parameters. It is an obligation to explain the decision in plain language. An organisation might tell a candidate: “Your application was screened by a CV analysis tool that looks for relevant experience in data science and machine learning. Your CV did not contain sufficient evidence of these skills based on the job titles and keywords analysed. You have the right to request a human review of this decision.”
The duty to inform exists at the point of decision. If the candidate is rejected, the organisation must inform them promptly that a decision was made about them and provide basic information about the decision. The candidate does not have to ask for this information; the organisation must provide it.
Consent and Fairness
Data protection law (UK GDPR) requires that personal data processing (including processing through AI) has a lawful basis. One lawful basis is consent. However, consent to hiring decisions cannot be a condition of applying for a job. If a candidate is told “you can only apply if you consent to AI screening,” that is not genuine consent; it is coercion.
Consent must be freely given. This means the candidate must have a real choice and must understand what they are consenting to. A checkbox that says “I consent to AI processing” with no explanation of what AI processing involves does not meet the consent standard.
Many organisations avoid the consent problem by grounding hiring decisions on the “legitimate interest” lawful basis rather than consent. They process candidates’ data because hiring is a legitimate business interest, and the processing is fair and transparent. They still must provide information about AI decision-making, but they do not need explicit consent.
The Right to Human Review
Candidates have the right to request a human review of an automated decision. This is different from asking the AI system to reconsider. This is asking a person to review the file and make a decision about the candidate without relying on the automated system’s output.
An employer cannot make this a costly or burdensome process. If a candidate requests human review, the employer must provide it at no cost. The employer cannot impose an unreasonable delay. The human reviewer should have sufficient seniority and knowledge to make an independent assessment; it cannot simply be a junior person who rubberstamps the AI system’s decision.
If the human review reaches a different conclusion from the AI system, that tells you something important about the system’s reliability. If human reviewers regularly overturn the system’s decisions, the system is not performing its intended function and should be removed or redesigned.
Documentation and Process Design
Organisations must document their notice and consent practices. This means keeping records of what information was provided to candidates and when. It means documenting the process for human review requests (who can request, how to request, what information the reviewer has access to, how quickly a decision will be made).
A well-designed process might look like this: a candidate receives a rejection email that explains the AI screening tool was used, what it was looking for, and that they can request human review by replying to the email within 10 working days. A senior HR person receives the request, pulls the original CV, reviews it against the job criteria (not against the AI system’s decision), and provides a written response to the candidate explaining the human review decision.
Regulatory Requirement
Under the EU AI Act, transparency to affected individuals is a mandatory requirement for high-risk hiring systems. Article 50 of the EU AI Act, in force since 2 August 2026, requires that users of high-risk systems be provided with information about AI use in decision-making. Organisations that trade in the EU, or that hire EU-based candidates, must comply with this requirement.