AI Tools for UK Recruitment Agencies Zoho Recruit vs Bullhorn vs HubSpot and the ICO Rules You Cannot Ignore

Bottom line: Zoho Recruit is the best starting point for a small UK recruitment agency that wants AI resume parsing and candidate matching at a price that makes sense — £20 to £60 per user per month with compliance-friendly features out of the box. Bullhorn is the industry standard for larger staffing firms but costs more and locks you into quote-based pricing. HubSpot is a CRM, not a recruitment tool — it will not screen candidates or parse CVs. Whichever tool you pick, the ICO's rules are clear: any AI that filters, ranks or rejects candidates needs a Data Protection Impact Assessment, meaningful human review and a way for candidates to challenge the decision. The Data (Use and Access) Act 2025, effective 5 February 2026, lets you use legitimate interests as your legal basis for AI screening — but only if you build in those safeguards first.

The Rules Changed in February 2026

The Data (Use and Access) Act 2025 landed on 5 February 2026, and it rewrites the ground rules for automated decision-making in the UK. Under the old Article 22 of the UK GDPR, using AI to make decisions with legal or similarly significant effects — like screening out a job applicant — was restricted unless you had explicit consent, a contractual necessity or specific legal authority. That meant the bulk of recruitment agencies either avoided AI screening altogether or relied on awkward consent mechanisms that candidates had no real choice about.

The new rules are more permissive but not a free pass. Private sector employers can now rely on legitimate interests as a lawful basis for automated decisions, provided they put three safeguards in place: tell the candidate the AI is being used and explain the logic, give them the right to contest the decision and request human review, and make sure that human review is meaningful — not just someone rubber-stamping what the algorithm said.

The ICO has made clear it will enforce this. In November 2024, it published six key data protection requirements for AI in recruitment after auditing recruitment AI providers and issuing nearly 300 compliance recommendations. And in its 2025/26 strategy, the ICO committed to scrutinising major employers and recruitment platforms for transparency, discrimination and redress in automated hiring.

What the ICO Actually Requires

The ICO's six requirements are specific and non-negotiable:

1. Run a Data Protection Impact Assessment before you buy or switch on any AI screening tool — not after 2. Identify your lawful basis for processing candidate data (legitimate interests is now available, but you still need to document it) 3. Set clear contractual responsibilities between your agency and the AI vendor, including statistical accuracy targets and bias monitoring 4. Monitor for bias — the ICO expects you to seek documented assurances from your vendor that bias has been actively tested for and mitigated 5. Be transparent with candidates about how the AI processes their data, what predictions it makes and how they can challenge a decision 6. Collect only what you need — no building shadow databases of candidate profiles without their knowledge

Special category data — ethnicity, disability, health — still requires explicit consent for automated processing, even under the new rules. That matters for recruitment because CV screening tools can infer protected characteristics from names, postcodes and education history.

Zoho Recruit: The SMB-Friendly Option

Zoho Recruit is a dedicated applicant tracking system built for recruitment agencies and in-house HR teams. It offers four pricing tiers: a free plan for a single recruiter, Standard at roughly £20 per user per month, Professional at £40, and Enterprise at £60 (all billed annually, converted from USD at current rates).

The AI features that matter for compliance sit in the Professional and Enterprise plans. Zia, Zoho's AI assistant, handles resume parsing — extracting candidate details from uploaded CVs and matching them against open roles using skills, experience and location data. The system also offers AI-powered candidate matching that ranks applicants against job requirements, an AI job description generator built on ChatGPT, and AI Interview Insights that transcribe and summarise one-way video interviews.

From an Article 22 perspective, the resume parsing and candidate matching are the high-risk features. Both filter and rank candidates without human input unless you configure the workflow to require manual review before any candidate is rejected or progressed. Zoho does allow you to set up approval stages — but they are not switched on by default. You need to build that human review step into your pipeline yourself.

Zoho also supports CV-Library Source Booster, which lets you search millions of UK CVs directly from within the platform. That is useful for sourcing but adds another layer of data processing that needs to sit inside your DPIA.

Bullhorn: The Agency Standard

Bullhorn is the dominant platform for UK staffing agencies, particularly firms running 10 or more desks. Its pricing is quote-based and not published, but industry estimates put it at £80 to £150 per user per month depending on the edition and add-ons. You will not get a price without speaking to their sales team.

Bullhorn's AI suite is called Amplify. It automates sourcing, screening and candidate submissions — scanning resumes, job posts and profiles to update your CRM and match candidates to roles. Bullhorn claims a 49% improvement in candidate fit using its AI-powered matching. The platform also includes AI Search and Match, which uses intent recognition and keyword expansion to find candidates across internal and external databases.

For compliance, Bullhorn's strength is that it is built for agencies that already operate under recruitment industry regulations. Its workflow tools support configurable approval gates, meaning you can require a consultant to review and approve every AI-generated shortlist before it reaches the client. The weakness is that Amplify's automation can bypass human review if you do not configure it properly — and at quote-based pricing, smaller agencies may not get the same onboarding support that larger clients receive.

Bullhorn has a dedicated UK presence and its data processing agreements are structured for UK GDPR compliance. But you still need your own DPIA — the vendor's compliance documentation does not replace your obligation as the data controller.

Where HubSpot Fits (and Where It Doesn't)

HubSpot is a CRM and marketing platform, not a recruitment tool. It appears in conversations about recruitment agencies because a handful of firms use it to manage client relationships, track business development and run marketing campaigns. Its AI suite, Breeze, includes a Prospecting Agent that researches leads and sends personalised outreach — useful for winning new clients, not for screening candidates.

HubSpot does not offer resume parsing, candidate matching, applicant tracking or any of the AI features that trigger Article 22 in a recruitment context. If your agency uses HubSpot for client-side CRM and Zoho Recruit or Bullhorn for candidate-side ATS, that is a perfectly normal setup. Just do not expect HubSpot to do both jobs.

HubSpot's Marketing Hub Professional starts at $800 per month (roughly £640), which is a platform fee rather than a per-user cost. For a 5-person recruitment agency, that is a steep CRM bill — but it is not competing in the same space as an ATS.

Head-to-Head Feature and Compliance Comparison

Monthly Cost for a 5-Recruiter Agency

What 90% of Large UK Employers Already Do

Ernst and Young research found that 90% of large private sector businesses in the UK already use AI in their recruitment process. But the picture for smaller firms is the opposite: 48% of UK SMEs have no plans to adopt AI for hiring at all.

That gap matters because the ICO is watching far more than the large employers. Its 2025/26 strategy commits to scrutinising recruitment platforms — the very tools that small agencies buy off the shelf. If Zoho Recruit or Bullhorn ships an AI feature that does not meet the ICO's transparency or bias requirements, the agency using it is still on the hook as the data controller.

The practical takeaway: you cannot outsource compliance to your vendor. The ICO's audit of recruitment AI providers produced nearly 300 recommendations, which tells you how far even the established platforms had to move.

Quick Checklist Before You Switch On Any AI Screening Tool

1. Complete a Data Protection Impact Assessment covering every AI feature you plan to use — not just the ones you switch on today 2. Document your lawful basis (legitimate interests under the new rules, but write down the balancing test) 3. Configure human review gates so no candidate is rejected or shortlisted by AI alone without a recruiter checking the decision 4. Make sure the human review is meaningful — the reviewer must have the authority and context to override the AI 5. Update your candidate privacy notice to explain which AI tools you use, what they do with candidate data and how candidates can challenge a decision 6. Ask your vendor for written evidence of bias testing — if they cannot provide it, that is a red flag 7. Check where candidate data is stored — Zoho offers EU data centres, Bullhorn has UK-compliant DPAs, HubSpot is US-hosted 8. Do not build a candidate database from scraped profiles without explicit knowledge and consent 9. Review your setup every six months — the ICO is publishing updated ADM guidance in Spring 2026 10. If you process special category data (health, ethnicity, disability), you still need explicit consent even under the new rules