A single advert for a receptionist or a site labourer can bring in hundreds of applications in a week. For a small business with no HR department, reading every CV properly is a real cost, and AI screening tools promise to cut that pile down to a shortlist in minutes. They can. But UK employers who switch one on without thinking it through are walking into an area the regulator is actively watching.
This guide covers what UK law expects from AI CV screening, where small employers usually go wrong, and a practical setup that keeps you fair, legal and still faster than reading every CV unaided.
Is AI CV screening legal for UK employers?
The ICO's position is clearer now than it was a year ago. In a news release on 31 March 2026, the regulator explained that the Data (Use and Access) Act 2025 updated data protection law to permit automated decision-making without human involvement, provided the right safeguards are in place. It said employers using these tools should monitor for bias, be open with candidates, and give people a way to challenge decisions. Tighter limits still apply where special category data, such as health or ethnicity, is involved.
None of that bans a tool. It makes you responsible for how it behaves.
What did the ICO find when it looked at real employers?
The ICO's Recruitment rewired report says "many employers engaging in automated recruitment are likely relying on solely automated decisions" and that "a greater range of safeguards will need to apply than our evidence suggests are currently in place." The ICO stresses this came from voluntary engagement, not an investigation, but the direction is clear.
According to the ICO's March 2026 news release, the regulator then wrote to 16 organisations likely to be using automated decisions about candidates, and all of them committed to acting on its recommendations. That followed its 2024 audits of AI recruitment providers, which produced almost 300 recommendations.
When does AI screening become a solely automated decision?
In a small business, it usually looks like one of these:
- Knockout questions that auto-reject. "Do you hold a full UK driving licence?" with a "no" answer sending an instant rejection email. That is a solely automated decision.
- Score thresholds. The tool ranks CVs and anyone below 60 out of 100 is declined automatically. That is also solely automated for everyone below the line.
- Shortlist only. The tool ranks CVs, but the hiring manager reads every application, uses the score as one input, and makes the call. This is decision support, not a solely automated decision.
The trap is the middle ground. The ICO's report says human involvement must be "applied consistently to all candidates within a hiring stage." If you read the top 20 and never open the rest, the people the tool rejected got no human involvement at all.
Can an AI screening tool discriminate?
The government's Responsible AI in Recruitment guide, published by the Department for Science, Innovation and Technology in March 2024, warns that these technologies "pose novel risks, including perpetuating existing biases," along with digital exclusion and discriminatory job advertising.
Two common examples. A tool that penalises career gaps can disadvantage women returning from maternity leave and people who have been ill or disabled. A tool that weights "years of experience" heavily can screen out younger applicants for roles where experience barely matters. Neither needs a protected characteristic to be named for the outcome to be discriminatory.
Disability deserves its own mention. If your process is fully online and timed, some candidates will need a reasonable adjustment. Your advert should say how to ask for one, and a person should handle those requests.
What do I have to tell candidates?
A plain paragraph in the advert works better than a link to a long privacy policy. For example:
We use software to sort applications against the essential criteria in this advert. A member of our team reviews every application before any decision is made. If you think your application was assessed unfairly, email hiring@yourcompany.co.uk and a person will review it again.
If you do use auto-rejection, the message has to say so, and the review route has to be real. The ICO's news release lists telling candidates how to contest a decision and ask for human review as one of the core safeguards.
How should a small employer check for bias?
You do not need a data science team. A spreadsheet and some voluntary diversity monitoring on your application form are enough to start. Each round:
- Count applicants, shortlisted candidates and rejections.
- Where you have monitoring data, compare rates across groups such as age band and sex.
- Read ten rejected CVs at random and ask whether you would have rejected them.
- Note what you found and what you changed, with the date.
That written record matters. If a candidate complains, a log showing you checked and acted is far stronger than an assurance from the vendor.
What should I ask before buying AI recruitment software?
The ICO's 2024 audits of recruitment AI providers, covered in its November 2024 overview report, looked at sourcing, screening and selection tools. The almost 300 recommendations that came out of them show how often suppliers had gaps. A supplier that cannot answer basic questions about retention or testing has not done the work.
Also weigh whether you need a specialist product at all. For a business hiring a handful of people a year, a general AI assistant used to summarise each CV against your criteria, with you reading every one, can save most of the time with far less legal exposure. The trade-offs are covered in this guide to building versus buying AI tools.
Do I need a data protection impact assessment?
The ICO's recruitment report covers DPIAs and lawful basis for exactly this reason. Your DPIA does not need to be long. It should describe what the tool does, what data it uses, the risks to candidates, and the safeguards above: human review, transparency, a contest route and bias checks. This AI data protection checklist for UK businesses walks through the sections in plain English.
The ICO's updated guidance on automated decision-making was not yet final at the time of writing, so revisit your DPIA when the final version is published.
What does a fair, practical setup look like?
In practice:
- Write the criteria first. Essential and desirable, tied to the job, not to "culture fit".
- Use AI for summaries and ranking, not rejection. Have it show how each CV meets each criterion, with quotes from the CV, so you can check its reasoning quickly.
- Read every application. With good summaries this takes a fraction of the time and keeps you outside solely automated decision-making.
- Publish the process in the advert, with a real email address for review requests.
- Log each round. Numbers, sample checks, changes.
If you want to see how a general assistant such as Claude handles summarising work like this, the Claude for business hub covers practical setups. For a comparison with handing admin to a person, see AI admin assistant versus virtual assistant.
AI CV screening is not risky in itself. Hiring decisions nobody actually made are the risk. Keep a person in every decision, be open with candidates, check your results, and the time savings come without the legal exposure.
AI CV Screening for UK Employers — FAQ
Is AI CV screening legal in the UK?
Yes. The ICO has said plainly that it is not banning automated recruitment tools or the use of AI in hiring. It also sees real benefits, such as handling high volumes of applications consistently and quickly. What the law cares about is how you use the tool. If software rejects candidates with no meaningful human involvement, that is a solely automated decision under UK GDPR, and extra safeguards apply. You need to tell candidates automation is involved, give them a way to contest the outcome and ask for human review, and check the results for bias. The Equality Act 2010 still applies whether a person or a piece of software made the decision.
What counts as meaningful human involvement in CV screening?
A person has to actually weigh the candidate's information and be able to change the outcome. Someone who clicks approve on a list the software has already sorted does not count. In its 2026 recruitment report, the ICO said that where employers use human involvement, it must be applied consistently to all candidates within a hiring stage. So a recruiter who glances at the top ten and never sees the rejected pile is not providing meaningful involvement for the people who were rejected. The simplest test is to ask whether a reviewer could, and sometimes does, move a rejected candidate forward.
How often should a small employer check an AI screening tool for bias?
The ICO expects employers to monitor automated recruitment tools for bias on an ongoing basis, not just once at the point of purchase. It also recommends asking the software provider what bias testing it has done before you buy. For a small business hiring a few times a year, a practical version is to review each hiring round. Compare who applied, who the tool shortlisted and who it rejected, using whatever voluntary diversity monitoring data you collect. Write down what you checked and anything you changed. If one group is consistently screened out at a higher rate, stop relying on the tool until you understand why.
Do I need to tell candidates I use AI to screen CVs?
Yes. Transparency is one of the core safeguards the ICO highlighted in its 2026 recruitment work, and it found that employers need to improve how they tell candidates about automated decision-making. Put a short, plain statement in the job advert or application form. It should say which stage uses automation, what the tool looks at, whether a person reviews the results, and how a candidate can ask for a human to look at their application again. Burying this in a generic privacy policy will not meet the standard the ICO is describing.
What questions should I ask an AI recruitment software supplier?
Ask what personal data the tool collects and whether all of it is necessary, how long data is kept, and whether the supplier sees itself as a processor or a controller. Then ask what bias testing it has done, on which groups, and how recently. Ask whether it infers anything from names, photos or postcodes. The ICO's 2024 audits of recruitment AI providers produced almost 300 recommendations, many on exactly these points, so a vague answer is a warning sign. Get the answers in writing and keep them with your data protection impact assessment.
