AI CV Screening: What UK Recruitment Agencies Need to Know in 2026

AI CV Screening: What UK Recruitment Agencies Need to Know in 2026

Most UK recruitment agencies assume AI CV screening sits clearly on one side of the compliance line or the other. Either the tool is fine because a human makes the final hiring decision, or the whole category is legally difficult and not worth the risk. The ICO's March 2026 report on automated decision-making in recruitment said something more precise, and more useful, than either position.

AI CV screening is legal in the UK. But three things must be in place before you go live: candidates must be told the AI is being used and given a plain-language explanation of how it works; a meaningful human review must sit between the AI ranking and any decision that affects the candidate; and candidates must have a genuine route to challenge the outcome. Get one of those wrong and you have an Article 22A UK GDPR problem, regardless of whether a recruiter clicks the button at the end.

What the ICO's March 2026 report actually said

On 31 March 2026, the ICO published a draft guidance update on automated decision-making alongside a report drawing on evidence from more than 30 UK employers. The ICO also sent letters to 16 named organisations.

Many employers told the ICO their AI tools were used only for "decision support," with humans making the final call. The ICO did not accept that framing uncritically. It found that in practice, candidates whose AI score fell below a threshold were rarely reviewed by a human at all. The filtering was effectively automated whether or not a recruiter clicked approve at the end.

The rubber stamp problem is the sharpest finding. If a recruiter's role is to approve a ranked shortlist without reading any of the CVs the AI filtered out, the ICO does not consider that meaningful review. The human must be capable of overriding the AI ranking, and the workflow must make that genuinely possible rather than procedurally awkward. "The recruiter approved it" is not a compliance defence when the recruiter only ever saw the candidates the AI had already chosen to surface.

Timing matters too. Telling candidates the AI was used only when they complain about a rejection does not meet the information duty. The ICO expects disclosure at the point candidates first learn about the role, not tucked into a rejection email.

The consultation ran until 29 May 2026. Final guidance was expected in summer 2026.

Is AI CV screening legal under UK data protection law?

Yes, with conditions.

The Data (Use and Access) Act 2025 came into force on 5 February 2026 and updated the UK GDPR rules on automated decision-making. Recruitment agencies can rely on legitimate interests as their lawful basis for AI-assisted CV screening, but that creates a compliance checklist rather than a free pass.

Under Article 22A UK GDPR, a candidate who has been subject to automated processing that materially affects their application has the right to request human review of that decision, to challenge it, and to understand how it was reached in plain language. A technical description of the algorithm alone does not satisfy this.

For any AI tool that filters, ranks, or rejects candidates, a Data Protection Impact Assessment is required before deployment. The DPIA must document the data categories processed, the potential for bias, how human oversight works in practice, and how outcomes are monitored over time.

How bias works in AI screening tools, and who carries the liability

The liability point most agencies misunderstand: the Equality Act 2010 does not have an AI exception. Bias in a screening tool is the agency's problem, not the vendor's and not the algorithm's.

AI screening tools train on historical hiring data. If that data reflects past decisions that disadvantaged candidates based on age, gender, race, or disability, the model learns to replicate those patterns. Individual outputs may look reasonable. Aggregate outcomes can show a clear skew, and the pattern can run for months before anyone notices.

"The algorithm did it" has not worked as a legal defence before UK employment tribunals. What has worked in investigations is evidence of active monitoring: tracking rejection rates across protected characteristics, auditing at regular intervals, and being able to show what changed when the numbers looked wrong.

What the EU AI Act means right now

Recruitment AI, including CV screening and candidate ranking, sits in Annex III of the EU AI Act and is classified as high-risk. The original compliance deadline of 2 August 2026 was moved to 2 December 2027 by the EU Digital Omnibus amendment. For UK agencies placing candidates only within Great Britain, the EU Act does not apply directly. For agencies handling EU-based roles or candidates taking up employment inside the EU, it does.

One part of the deferral is consistently misread. The transparency requirements, the AI literacy obligation, and the emotion-recognition ban were not deferred. They came from separate articles with their own timelines. Only the full high-risk system obligations (Articles 9 to 15) were pushed back to December 2027.

Treating the deferral as a break is a mistake. UK GDPR Article 22A, the Equality Act, and the ICO's own guidance apply now.

What to check before signing a contract with a screening tool vendor

Many agencies use third-party platforms rather than building their own screening systems. The compliance responsibilities above stay with the agency as data controller. They do not transfer to the vendor.

Before signing, check four things.

Data processing agreement. The vendor must process candidate data only on your documented instructions, not their own model training. This needs to be in writing before you go live. Verbal assurances do not count.

Log retention. Audit logs need to be retained long enough to reconstruct any screening decision if a candidate or regulator challenges it. Check the default retention period and whether it can be extended.

Bias auditing documentation. You should be able to request the vendor's testing results for model performance across protected characteristics. A vendor who responds with "trust us, we're compliant" without documentation is giving you a marketing claim. That is not a data processing agreement.

Your own audit rights. The contract should give you the right to run independent audits, not just rely on vendor-produced reports.

If you want to understand how compliant custom AI systems compare to off-the-shelf tools in professional services, our notes on AI intake workflows for law firms cover the same architecture questions under SRA and GDPR requirements.

A five-point checklist before you go live

1. Candidate notification in place. At the application stage, does the candidate know an AI will process their CV? Is the logic explained in plain English in the application itself, not buried in a privacy notice?

2. DPIA completed. Is there a completed Data Protection Impact Assessment on file for this specific tool in this specific workflow? A vendor's compliance certification is not a DPIA.

3. Human review genuinely designed in. Is there a process for a recruiter to read CVs the AI screened out, or does your workflow make that practically impossible at the volumes you hire at?

4. Bias monitoring active. Are rejection rates being tracked across protected characteristics? Is there a review interval on your calendar, not "we will look at it if someone complains"?

5. Candidate challenge route communicated. Is there a named process for candidates to request human review? Is it communicated during the application process, not referenced only in a 12-page privacy policy?

Agencies that can honestly check all five are in a defensible position with the ICO and with employment tribunals. Agencies that cannot check two or more have gaps that the ICO's summer 2026 final guidance will not make easier to explain.

Fracas builds AI agent systems for recruitment agencies with human-in-the-loop workflows and audit logging built in from the start. If you want to understand what that looks like in practice before booking anything, our guide to what an AI automation agency does covers the build-versus-buy question in plain terms.

If you are ready to talk through your specific screening setup, a call takes 30 minutes and we will tell you whether your current workflow is defensible before recommending anything else.

Frequently asked questions

Is AI CV screening legal in the UK?

Yes, with conditions. The Data (Use and Access) Act 2025 allows recruitment agencies to use AI screening tools on a legitimate interests basis. Candidates must be told the AI is being used, a meaningful human review must be in place, and candidates must have a genuine route to challenge the outcome. These conditions are not optional; the ICO's March 2026 report found many employers were not meeting all three.

Do I need a DPIA for AI CV screening?

Yes. Any AI system that filters, ranks, or rejects candidates at scale triggers the Data Protection Impact Assessment requirement under UK GDPR. The DPIA documents the data processed, the bias risk, how human oversight works, and how outcomes are monitored. A vendor's compliance badge does not substitute for a DPIA completed by your organisation for your specific use of the tool.

What does meaningful human review mean?

The ICO's March 2026 draft guidance is direct: meaningful review cannot be a rubber stamp of the AI output. A reviewer must be capable of overriding the AI ranking and the workflow must make doing so realistic. If a recruiter is approving a shortlist without seeing the CVs the AI filtered out, that review does not meet ICO guidance.

Does the EU AI Act apply to AI CV screening in the UK?

Not directly for UK-only operations. Recruitment AI sits in Annex III of the EU AI Act as a high-risk system, but the full compliance obligations for UK-based agencies placing candidates within Great Britain are outside the Act's direct scope. UK GDPR and the Equality Act apply regardless. For agencies handling EU-based roles, the December 2027 deadline matters directly, but transparency and literacy obligations were not deferred and apply now.

Can an AI screening tool be held liable if it discriminates?

No. The liability rests with the employer or recruitment agency. The Equality Act 2010 has no AI exception, and claiming "the algorithm did it" has not succeeded before UK employment tribunals. This is why outcome monitoring, bias auditing, and the ability to reconstruct individual decisions matter more than a vendor's compliance claim.