By Russell Lawson, ISO consultant, lead auditor and founder of The Compliance Companion - the practical platform that helps businesses build ISO 9001, ISO 14001, ISO 45001 and ISO 27001 systems using real-world templates, AI-powered tools and guided support. Over the years, Russell has worked with organisations across multiple sectors and has seen how quickly new technology can outpace the policies, controls and management systems businesses rely on.
AI is now moving from a future topic to a day-to-day business tool.
One of the clearest examples of that is recruitment. Businesses are increasingly using AI and automation to screen CVs, score applications, prioritise candidates and streamline parts of the hiring process.
The Information Commissioner’s Office said in March 2026 that more employers than ever are turning to automation and AI in recruitment, and highlighted survey evidence suggesting 70% of employers expect to increase their use of AI and automation in recruitment over the next five years.
That makes this a genuinely useful topic for businesses right now, especially those trying to improve efficiency without creating new compliance problems.
Because that is the real issue here.
Most organisations are not using AI in recruitment because they want to be reckless. They are using it because recruitment is time-consuming, inconsistent and expensive. AI promises to help with all of that. It can sort applications faster, identify patterns, reduce some manual administration and help teams process larger volumes of candidates. The ICO itself has acknowledged that automated decisions can streamline recruitment, provided the right safeguards are in place.
But this is exactly the sort of area where businesses can move faster than their systems.
In my experience, that is where management systems either prove their value or expose their weakness. A business may adopt a new tool because it seems helpful, but unless someone stops to ask how it fits with existing governance, data protection, information security, competence and internal review, the organisation can end up creating a new risk while trying to solve an old problem.
That is why AI in recruitment is such a useful topic through an ISO lens.
The issue is not just whether the tool works. It is whether the organisation can explain how it is being used, what risks it creates, what controls are in place, and who is responsible for checking it remains appropriate.
The ICO’s March 2026 statement was quite clear on this point. It called on businesses to review their use of automated decisions in recruitment to ensure the right protections are in place, and it has opened a consultation on updated guidance around automated decision-making, including profiling, with the consultation running from 31 March 2026 to 29 May 2026. That draft guidance update reflects changes made by the Data (Use and Access) Act 2025.
So this is not a vague future warning. It is a current compliance issue.
From a practical point of view, the first question businesses should be asking is very simple: where is AI already influencing our hiring decisions?
Sometimes the answer is obvious. A dedicated platform may be ranking or filtering candidates automatically. But sometimes it is much less obvious. Recruiters may be using AI to summarise CVs, score written answers, draft interview questions or produce recommendations on suitability. The business may think a human is still making the final decision, but if that human is heavily influenced by automated scoring or profiling, the governance questions do not disappear.
That matters because a lot of organisations still treat tools like this as if they are just another software subscription. They are not. They are decision-influencing systems. And once they start affecting who gets shortlisted, who gets rejected or how people are assessed, they move into a much more sensitive space.
This is where I think ISO 27001 and ISO 9001 are particularly relevant.
ISO 27001 matters because recruitment tools often process large volumes of personal data, sometimes including CVs, work history, references, salary expectations, assessments and interview notes. If that information is being stored, analysed or passed through third-party AI tools, the organisation should understand the information security risks, supplier risks and access control implications. It should also know what the lawful basis is for processing, what data is being shared, who can see it, how long it is retained, and what protections apply. The ICO’s AI and data protection guidance is built around exactly these kinds of questions.
ISO 9001 matters because recruitment is also a process quality issue. If hiring decisions become inconsistent, opaque or poorly controlled, that affects competence, operational performance and customer outcomes. A badly governed recruitment process does not just create legal or ethical risk. It can create a basic quality problem by putting the wrong people into the wrong roles, without a reliable or reviewable decision-making process behind it.
That is why I would not frame this topic as “AI regulation” in isolation. I would frame it as process control.
If a business is going to use AI in recruitment, it should be able to answer some fairly basic questions.
What exactly is the tool doing?
What data is it using?
What decisions or recommendations is it making?
How much human oversight is there really?
How do we know it is fair, suitable and secure?
How do we review it when something changes?
That is not bureaucracy. That is sensible management.
The strongest organisations I have worked with are not the ones that ban every new tool. They are the ones that adopt new tools in a controlled way. They define the purpose, review the risks, set boundaries, and build checks into the process. In other words, they do not just implement technology. They manage it.
That is especially important in recruitment because this is one of the areas where poor use of AI can damage trust quickly. If applicants feel they are being filtered unfairly, assessed inaccurately or rejected without transparency, the issue is not just internal. It becomes reputational as well.
There is also a supplier control dimension that many businesses overlook.
A lot of AI-enabled recruitment capability will sit inside third-party platforms. That means you are depending on a supplier not just for service delivery, but for data handling, security, explainability and process integrity. This is exactly the kind of issue that should trigger supplier review and risk assessment. If you are relying on a platform to influence recruitment outcomes, that is not a low-risk supplier relationship. It deserves more scrutiny than many organisations currently give it.
This is one reason I often recommend that businesses revisit their internal audit approach whenever they introduce AI into an important business process. Internal audit is where you should be testing whether the process on paper matches what is really happening in practice. It is also where you can ask awkward but useful questions before an external auditor, regulator, client or candidate asks them instead. If that would help the reader, this is a very natural place to link internally to your article on the ISO internal audit template, because AI-enabled recruitment is exactly the kind of change that should feed into a smarter internal audit programme.
Another useful control is competence.
One of the biggest mistakes businesses make with new software is assuming that because a platform looks easy to use, the people using it are automatically competent to use it well. That is rarely true. If recruitment staff are relying on AI summaries, automated scoring or suggested rankings, they need to understand what the tool can and cannot do, when to challenge it, and when human judgement must take priority. Otherwise the organisation risks creating a false sense of confidence around a process that has not really been understood.
The ICO’s current activity in this area is a reminder that none of this sits outside mainstream business governance anymore. Automated decision-making, profiling, data protection and explainability are not niche legal issues for specialists only. They are becoming practical management issues for ordinary businesses using ordinary software in ordinary business processes.
So what should businesses actually do now?
They do not need to panic. But they do need to review.
If you are using AI in recruitment, or considering it, start by mapping where it is used and what influence it has. Review the data protection position. Review the supplier. Review the information security controls. Review how much human oversight really exists. Review whether the process is documented well enough that you could explain it to an auditor, a regulator, a manager or a candidate.
Most importantly, review whether your management system has kept pace with the tool.
That, to me, is the real issue here.
AI in recruitment is not just a technology story. It is a governance story. And the organisations that handle it best will not necessarily be the ones with the most advanced tools. They will be the ones with the clearest controls.
A Final Thought
ISO doesn’t have to be expensive.
It becomes expensive when it’s overcomplicated, rushed, or treated as something separate from the business.
Done properly, it should fit around how you already operate – adding structure without adding unnecessary weight.
If you’re exploring certification and want a clearer, more cost-effective route, you can see how The Compliance Companion works here:
https://the-compliance-companion.co.uk/harness-the-future-of-iso