The UK’s Data Regulator Just Said ‘Rubber Stamp’ Reviews Don’t Count as Human Oversight

On March 31, 2026, the UK’s Information Commissioner’s Office published a report on automated decision-making in recruitment, built on evidence from more than 30 UK employers plus input from graduates, civil society groups, trade unions, and industry bodies. The finding that should worry anyone running high-volume screening for a UK client: employers kept telling the ICO their AI tools were “decision support,” with a human making the final call. The evidence told a different story. In practice, the human step was often a person scanning an AI-generated shortlist and clicking approve — which the ICO now says, in writing, does not count as human oversight.

The exact bar the ICO set

The ICO’s own language is unusually direct for a regulator: meaningful human involvement “cannot be a token gesture or a rubber stamp of an automated outcome.” The test isn’t whether a human technically touched the decision before it went out. It’s whether that human had “the authority, discretion and competence to alter it” — real capacity to overturn the AI’s recommendation, not just visibility into it. A reviewer who’s never actually reversed an AI-generated reject, who has no time built into their day to interrogate a borderline call, or who doesn’t have the standing to challenge the system’s output, is not providing the safeguard the law assumes exists. On paper, “human-in-the-loop” and “human rubber-stamping the loop” look identical. The ICO just drew the line between them, and most of the 30+ employers it studied were on the wrong side of it without realizing it.

Why this lands on GCC screening teams specifically

A large share of India’s global capability centers screen for UK-headquartered banks, insurers, and professional services firms — the exact sector mix the ICO’s report draws from. Final guidance is expected this summer, which means the compliance clock on this standard is running now, not on some future date circled on a calendar. If your delivery center runs graduate or campus screening on behalf of a UK entity and your current process is “AI shortlists, a recruiter approves the shortlist,” the ICO has told you in advance that this specific pattern is the one it considers inadequate. Redesigning that workflow after final guidance lands is slower and more expensive than building it correctly now, while the standard is still in consultation form and the direction is already public.

We wrote about a similar test in the EU AI Act’s human-override requirement: can a human actually reverse an AI-generated reject before a candidate is notified, not just review it after the fact. The ICO’s “rubber stamp” language is the UK regulator naming the exact failure mode that checklist was built to catch — a human step that exists on an org chart but not in practice.

Three questions worth asking before summer

Does the reviewer have time to actually reverse a decision, or just time to click approve? If a recruiter’s per-candidate review time drops sharply the moment AI shortlisting is switched on, without any change in how carefully they’re expected to check each call, the review has become procedural, not substantive — the ICO’s own findings suggest this is the most common way “human oversight” quietly becomes a formality.

Can you show a rate of actual overrides, not just a review step in the workflow? A screening process where AI recommendations are never reversed isn’t necessarily broken, but it’s the first thing worth interrogating — either the AI is unusually well-calibrated, or the review isn’t a real check.

Does the person reviewing have the standing to disagree with the tool? A junior recruiter told to “trust the system unless something looks really wrong” doesn’t have the discretion the ICO’s standard requires, even if they’re technically the human in the loop.

The honest complication

None of this means automated screening is the problem the ICO is targeting — the report is explicit that automated decisions can legitimately streamline hiring “with the right safeguards in place.” The problem is specifically the gap between what employers told the ICO their process was and what the evidence showed it actually was. That gap is closeable, but only if someone audits the review step honestly instead of assuming that because a human’s name is attached to a sign-off, the sign-off was real.

If you’re running screening for UK-facing roles out of India and want to pressure-test whether your human review step would survive this standard, talk to us about what an audit-ready review record actually looks like.

Sources: Automated decisions can streamline the hiring process – with the right safeguards in place — ICO, UK: ICO Report on Automated Decision-Making in Recruitment — DLA Piper Privacy Matters