AI CV Screening for Small Employers: What Works, What Is Risky, What Is Illegal

Automated CV screening can save a hiring manager several days per round. It can also produce a discrimination claim, and the two outcomes come from very similar-looking software.

This article sets out where the line sits under UK law, what the tools genuinely do well, and what a defensible setup looks like for an employer without an HR department.

Practical summary, not legal advice. For a contested decision, take proper counsel.

What these tools actually do

Three different things, frequently sold as one.

Parsing. Extracting structured information from a CV: education, employers, dates, skills. Not a judgement, just data entry done by machine. Low risk and genuinely time-saving.

Matching. Scoring a CV against a job description for relevance. This is a judgement, made by a system, about a person.

Ranking or filtering. Ordering candidates, or removing some from consideration. This is a decision about a person, and it is where the legal exposure concentrates.

The distinction matters because the risk is almost entirely in the third, and plenty of businesses buy all three while thinking about the first.

Where the legal line sits

Discrimination law applies in full. The Equality Act does not care that a model produced the outcome. If a process puts people with a protected characteristic at a particular disadvantage and you cannot objectively justify it, that is indirect discrimination. "The software did it" is not a defence in any forum.

The specific risk with these tools is that a model trained on your previous hires reproduces your previous patterns. If your past hiring skewed, the tool will learn the skew and apply it consistently and at scale, which is worse than a human doing it occasionally.

UK GDPR applies to the processing. You need a lawful basis, the candidate needs to be told, and where a decision producing legal or similarly significant effects is made solely by automated means, individuals have specific rights including to obtain human intervention and to contest the outcome. Rejection from a job is generally treated as significant.

A DPIA is expected for this kind of processing. See AI regulation in the UK.

The EU AI Act treats it as high risk, if you are in scope. Recruitment and worker management is Annex III. Deployer duties apply from 2 December 2027 following the deferral. UK employers are in scope if the output is used in the EU, for instance when recruiting for an EU-based employer. See does the EU AI Act apply to my UK business.

What a defensible setup looks like

Five things. None of them are expensive and together they address most of the exposure.

A human reviews every rejection. Not a sample. Every one, by a named person who can and sometimes does overturn the system. This single control addresses both the automated-decision rights under GDPR and the bulk of the discrimination risk.

Documented criteria. Write down what the tool is scoring on and why each criterion is job-relevant. If you cannot justify a criterion in a sentence, remove it.

No proxies. Scoring on university attended, postcode, employment gaps, or name-derived anything. Each of these correlates with protected characteristics and none are reliably job-relevant. Employment gaps in particular disadvantage people with caring responsibilities and disabilities.

Outcome monitoring. Quarterly, compare pass rates at each stage against protected characteristics where you hold the data. If a gap appears, you need to know before a candidate tells you.

Tell candidates. Your privacy notice and your job adverts should say that automated tools assist in screening and that a human reviews outcomes. This costs nothing and it is required.

What works well

Being fair to the technology, because parts of it are genuinely useful.

Parsing and structuring saves real time and carries little risk.

Surfacing rather than filtering. Using the tool to bring forward candidates a human might miss, while still showing the full pool, gets most of the benefit with a fraction of the exposure. This is the setup we would recommend to almost every small employer.

Consistency checks. Flagging where a candidate meets a stated essential requirement that a reviewer appears to have missed.

Scheduling and correspondence. Unglamorous, unrelated to judgement, and frequently the largest actual time saving in a hiring round.

What we would not do

Automatic rejection without human review. The saving is small and the exposure is large.

Video interview analysis scoring confidence, enthusiasm or engagement. Beyond the accuracy questions, emotion recognition in employment contexts is prohibited under the EU AI Act, and it disadvantages neurodivergent candidates and non-native speakers in ways that are difficult to justify.

Buying a tool that cannot explain its scores. If the supplier cannot tell you why a candidate scored what they did, you cannot answer a candidate who asks, and they are entitled to ask.

The question to ask a supplier

"If a rejected candidate asks why, what exactly can we tell them?"

A supplier with a good answer has thought about this. One who says it is proprietary has handed you a liability they are not carrying.

Key Takeaways

• Parsing is low risk. Matching is a judgement. Filtering is a decision about a person, and that is where the exposure sits.
• A model trained on your past hires reproduces your past patterns, consistently and at scale. That is worse than a human doing it occasionally.
• Human review of every rejection is the single most effective control, addressing both GDPR automated-decision rights and most of the discrimination risk.
• Surface rather than filter. Bring candidates forward without removing anyone, and you get most of the benefit with a fraction of the risk.
• Ask the supplier what you can tell a rejected candidate who asks why. "Proprietary" means the liability is yours.

Frequently Asked Questions

Is AI CV screening legal in the UK?

Yes, with conditions. It is lawful to use automated tools in recruitment provided you have a lawful basis, you are transparent, you respect rights around solely automated decisions, and the process does not discriminate. The tool is not the problem; how it is configured and overseen is.

Do we have to tell candidates we use it?

Yes. Transparency is a core obligation, and it belongs in your privacy notice and ideally in the advert. It is also good practice commercially. Candidates who discover it afterwards react considerably worse than candidates who were told.

We are a 20-person company. Is this proportionate?

Automated screening generally is not, at that size. If you receive 40 applications for a role, a person can read them, and the time saving does not justify the setup or the exposure. Automate the scheduling and correspondence instead, which is where most of the administrative time actually goes.

What if our applicant tracking system added AI features we did not ask for?

Very common, and worth checking. Find out what is switched on, what it influences, whether it can be disabled, and what the supplier will tell you about how it scores. You are the deployer and you carry the duties regardless of whether you chose the feature.

---

Using or considering AI in hiring and want to know whether your setup is defensible? Talk to Halo Technology Lab. Our strategy and scoping service covers the controls, and our AI recruitment and CV screening use case shows what we build and what we decline to.