AI CV screening: where sorting becomes a decision

This is a guide, not legal advice; check anything that matters to your business with your adviser.

The line is not about the software, it is about who decided

An agency owner asked us recently whether the screening tool bolted onto their CRM was ‘allowed’. Right question, wrong subject. Nothing in UK law stops software reading a CV, scoring it against a brief and handing back a ranked list. That is sorting, and machines are good at it.

The moment that matters comes later, when somebody is removed from consideration. If a person made that call, you have a decision with a human in it. If the software did, and nobody looked, you have what the Information Commissioner’s Office calls a solely automated decision, and stricter rules apply.

The ICO’s wording is blunt. For a decision to count as solely automated, it says, ‘there must be no human involvement in the decision-making process’. The same guidance names ‘e-recruiting practices without human intervention’ as an example of a decision carrying a legal or similarly significant effect. Recruitment is not an edge case the regulator was dragged towards. It is the worked example.

Can software reject a candidate on its own?

It can, and that is not automatically unlawful, but it moves you into the strictest part of the regime. A solely automated rejection means telling candidates it happens, being able to explain it, and giving them a route to contest it and ask for a person to look again. Most small agencies have none of that in place.

The cheaper path, and the one nearly every agency assumes it is already on, is to keep a person in the decision. That is the difference between a screening step you can defend in a phone call and one you have to document, justify and staff.

Does a quick look at the list count?

Not by itself. The ICO’s position is that human review must come after the automated decision and, in its words, ‘must relate to the actual outcome’. A consultant who supplies the brief the system scores against has reviewed nothing. Review means someone saw what the system concluded about a named candidate and could have answered differently.

If the AI only ranks, and I pick from the top, am I in the clear?

This is the question that catches good agencies out. Ranking is sorting, so the ranking itself is fine. What matters is the rest of the list. If your consultant reads the top ten and nobody opens the other ninety, those ninety were removed by software with no human involvement at all.

The ICO is explicit that where human involvement exists, it must be ‘applied consistently to all candidates within a hiring stage’. Reading the top of the pile is not consistency. It is a human decision about ten people and an automated one about ninety, sitting inside a process everyone describes as human.

What the regulator has already found

The ICO reported on 31 March 2026 on evidence from more than 30 employers, gathered between March 2025 and January 2026. Many, it found, are ‘likely relying on solely automated decisions’ without meaningful human involvement. It wrote to 16 organisations it believed were deciding about candidates automatically, and all committed to change. The ICO called this voluntary engagement rather than an audit, which is fair, and also the sort of thing a regulator says once.

An earlier audit of the tools themselves, published on 6 November 2024, is where the detail gets uncomfortable. The ICO found products with a search function that ‘allowed recruiters to filter out candidates with certain protected characteristics’, and others that ‘estimated or inferred people’s gender, ethnicity, and other characteristics from their job application or even just their name’. It made almost 300 recommendations, all accepted.

Does it matter that we are the agency and not the employer?

Not to the duty. The ICO looked at employers and at the vendors selling the tools, so nobody has yet audited a desk like yours. But a solely automated decision is defined by how it was made, not by who made it, and on a screening step it is your agency holding the CV.

Who carries the risk, you or the vendor?

You do, in the part that hurts. Under section 19 of the Equality Act 2010, indirect discrimination turns on whether a provision, criterion or practice puts people sharing a protected characteristic at a particular disadvantage, and whether you can show it was proportionate. A scoring model that penalises career gaps is a criterion you applied.

The vendor built it; you used it on real people.

Agencies carry this differently from employers. You screen for several clients at once, with one system sorting for all of them. A bias that would be one bad hire inside an employer runs across your whole desk.

Be fair to the software

None of this is an argument for reading 400 CVs by hand. Consistency is what automated sifting is good at, and the alternative is not neutral: a tired consultant at 6pm on a Friday is a less consistent screen than any model, and leaves no record of why people were dropped. The ICO’s complaint is not that agencies use these tools. It is that nobody can say afterwards who decided what.

The sifting is fine. The deciding needs a person and a log. That is the same rule we build every agent to, and it is why an agent should never do certain things without asking.

What to do next

Take one role you filled last month and pull the candidates the system screened out. Pick three at random and answer, for each: who read this CV, when, and did they see it after the score or before? If you cannot name a person for all three, your screening step is more automated than you thought. The fix is usually a rule about where the list stops being advisory, not a new product.

Then check the boring half: whether your candidate privacy notice mentions automated screening. Most do not, and that is a morning’s work rather than a project.

Our work with recruitment agencies and the case study on getting consultants back on the phone show where the approvals sit. Working out which job to automate first is what an AI roadmap is for.