Outlook
Part of Employer branding planning framework for England in 2027
What the ICO's AI guidance means for employer branding teams
A practical readiness check for employer branding AI tools: the ICO rules that apply, who signs off, and the triggers that force a review of the plan.
What to take away
- The ICO's guidance on automated decision-making and profiling, and its joint guidance with the Alan Turing Institute on explaining AI decisions, applies to tools handling candidate data to produce content or shortlisting outcomes.
- Fund a named reviewer before buying software. One day a week, about 0.2 FTE (illustrative), covers the sign-off role.
- The guidance requires a lawful basis, transparency and human review. It does not require publishing models or appointing a data protection officer for a copywriting tool.
- Justify sector spend with ONS employment data and your own applicant numbers.
The ICO rules that bind brand teams
The ICO's guidance on automated decision-making and profiling sits inside its Guide to the General Data Protection Regulation, and its AI and data protection guidance adds a risk toolkit for assessing a new tool.
Explaining decisions made with AI, published with the Alan Turing Institute in May 2020, covers how to explain automated outcomes to the people affected.
Generative AI: eight questions that developers and users need to ask is the ICO's guidance for the AI-assisted copy and content tools a brand team is most likely to adopt.
None of them names employer branding. Each bites when a tool sorts, scores or drafts content about identifiable people.
| Requirement | What it means for a brand team |
|---|---|
| Lawful basis | Record why each tool may process candidate or employee data |
| Transparency | Tell candidates when AI assists screening or content about them |
| Human review | A person considers an automated outcome before it takes effect |
| DPIA | Assess high-risk processing such as profiling at scale |
Article 22 of UK GDPR restricts decisions made solely by automated means that significantly affect a person. A rejected application qualifies. A drafted careers page usually does not.
Ask three questions before approving a tool: what data goes in, how long it is kept and what the candidate is told.
Is your AI tool budget-ready?
What data goes in?
How long is it kept?
What is the candidate told?
Before a supplier demonstration, put those questions in writing and ask for the answers as a document: which fields are processed, how long each one is kept, whether the data trains any model, and the exact notice wording shown to candidates.
What the guidance does not require
- It does not require a data protection officer because you use an AI writing assistant.
- It does not require you to publish prompts, model names or vendor details.
- It does not ban AI-assisted job adverts, provided every claim is accurate.
- It does not replace the Equality Act 2010 or the CAP Code, which still govern what you publish.
Fund the owner, then the tool
Illustrative budget line: 0.2 FTE for a recruitment marketing manager, about one day a week, split across AI-assisted adverts, careers page copy and social posts. Benchmark the pay against the ONS Annual Survey of Hours and Earnings before fixing the number. A second reviewer covers pay ranges, location claims and legal entitlements.
Without that line, review work lands unpaid on one person or stops altogether.
Before approving claims about flexibility or progression, check that the business can evidence each one, because an unevidenced promise becomes a reputational problem.
Evidence that justifies the spend
The ONS employment by industry data lets you size a talent pool before writing a brief. Rank the two or three sectors where your roles sit, then compare that ranking with your own applicant numbers. Where the two disagree, investigate before committing spend.
The five-step budget sequence
Five-step budget sequence
- List every AI application in use
- Assign owner and reviewer
- Cost review time honestly
- Match spend to evidence
- Set review dates and triggers
- Record the lawful basis and retention period for every tool touching personal data.
- Name the owner and the second reviewer, each with funded hours.
- Put the three data questions to every supplier before any demonstration.
- Rank sectors from ONS data and applicant figures, and cut any you cannot justify.
- Write the review triggers and diary the first review date.
Example: the AI review line
AI content review. Owner: recruitment marketing lead, 0.2 FTE (illustrative). Salary benchmarked to ONS earnings data. Second reviewer: HR business partner. Refreshed quarterly and after any published guidance change.
Triggers that force a review inside the year
- A regulator publishes guidance touching recruitment contentthe owner reviews the tool list within 30 days.
- Headcount plans for a targeted role family move beyond the agreed threshold.
- A target sector stops growing in the ONS data you used to justify it.
- A supplier changes retention terms or starts training models on customer data.
Platform policy changes and pay transparency rules sit behind several of these triggers.
Common questions
These are the questions that come up most often when teams put this plan together.
Do we need a separate budget line for AI review work?
Yes. Review time is the hidden cost. Without funded hours the checking stops or lands unpaid on one person.
Does UK GDPR apply to AI in employer branding content?
It can. If personal data is processed to produce content or decisions about candidates, the usual principles apply, including a lawful basis and transparency. Check each tool against the ICO guidance.
What is the smallest compliant setup for a small team?
A written lawful basis, a named reviewer with funded hours, and documented supplier answers on data use and retention. That does not require a data protection officer.
How often should the plan be updated?
At least annually, plus event-driven reviews within 30 days of a relevant regulator or platform change.
