Is AI Resume Screening Legal In The UK?

<cite index="9-1">Yes, employers can legally use AI to shortlist job candidates in the UK</cite> but with requirements attached. <cite index="5-1">The Data (Use and Access) Act 2025 came into force on 5 February 2026, changing the rules on automated decision-making in recruitment. UK agencies can now use AI screening tools under legitimate interests, but only with proper safeguards: transparency, meaningful human review, and the right for candidates to contest decisions.</cite>

The old Article 22 of UK GDPR was structured as a near-prohibition with narrow exceptions. The new framework flips that, AI screening is permitted, provided those safeguards exist. What hasn't changed: the Equality Act 2010 still applies. If an AI tool produces biased outcomes that disadvantage candidates with protected characteristics, the employer is liable regardless of whether the bias was intentional.

The Fuller Context

<cite index="7-1">The Data (Use and Access) Act 2025 rewrote the rules on automated decisions, and the Article 22A safeguards regime applies from 5 February 2026.</cite>

Three things that now matter in practice:

• Transparency. Candidates must be told that automated tools are used in their screening. A sentence in your application form or privacy notice covers this. It doesn't need to be technical or lengthy.

• Meaningful human review. <cite index="10-1">The ICO's report found that there was a general lack of information and clarity about the application of UK GDPR to specific processing activities, especially in multi-stage recruitment processes where automation might be applied to some stages, such as CV screening but not interviews.</cite> The word "meaningful" matters here. <cite index="4-1">When human review is cursory or inconsistent, the safeguards required by UK GDPR must apply.</cite> A reviewer who scrolls through a ranked list and clicks approve without engaging with the reasoning is not providing meaningful review.

• Right to challenge. Candidates can request human reconsideration of a decision significantly influenced by automated processing. We need a simple process to handle this request, even if it's rarely used.

<cite index="11-1">There is no UK AI Act. The ICO is acting as if there is. The Information Commissioner's Office is already enforcing AI hiring practices using powers it already has under existing data protection law.</cite> Recruitment is an active enforcement priority.

Related Questions

Q1. Do I have to tell candidates I'm using AI to screen CVs?

Yes. Under the updated UK GDPR framework, transparency about automated processing is required. A brief statement in your application form or candidate privacy notice is the standard approach. It doesn't need to name the specific tool.

Q2. What counts as "meaningful human review" of an AI shortlist?

The ICO is specific: the reviewer needs the authority to change the outcome, the relevant information to evaluate the candidates, and must engage with that information before any decision is communicated. Approving a ranked list without reading the reasoning behind it does not qualify. Your screening tool needs to show its reasoning, not just a score, so the reviewer has something to actually work with.

Q3. Does the Equality Act apply to AI screening?

Yes. The Equality Act 2010 prohibits discrimination on the basis of nine protected characteristics, age, disability, gender reassignment, marriage and civil partnership, pregnancy and maternity, race, religion or belief, sex, and sexual orientation. It applies to the outcome of hiring decisions regardless of whether those decisions involved automation. If an AI screening tool produces shortlists that systematically disadvantage candidates with a protected characteristic, the employer bears liability.

Q4. What is a DPIA and do I need one?

A Data Protection Impact Assessment is required when processing is likely to result in high risk to individuals. Whether AI screening triggers this threshold depends on scale and context. For a small agency running occasional hiring batches, it may not trigger automatically, but documenting your screening process, the tool used, and how human review is conducted is sensible practice in any case.

What This Means for Your Screening Process

Three practical steps that put a small agency on the right side of these rules without needing a legal team.

• Add a disclosure line to your application process. Something like: "We use AI tools to support initial CV screening. A member of our team reviews all shortlisting decisions before candidates are progressed or rejected." One sentence, added once.

• Use a tool that explains its rankings. If your AI screening tool only gives you a score, the reviewer has nothing to engage with. A tool that shows why each candidate ranked where they did gives the human reviewer something to read, agree with, or override. That distinction is what separates meaningful review from rubber-stamping.

• Keep a record of your process. Note what criteria were used, which tool ran the screening, and that a human reviewed the shortlist. If a candidate raises a challenge, this is what you'll need.

CVShelf produces a ranked list with a per-candidate explanation, what the AI found relevant, what it flagged, why the ranking landed where it did. That explanation is specifically what makes genuine human review possible. For agencies building a compliant, practical process around this, the broader picture of hiring software that fits a small agency is worth reading alongside the compliance requirements.

Try it complimentary at cvshelf.com.

AI resume screening is legal in the UK. The rules aren't complicated. Tell candidates, review the reasoning rather than rubber-stamping it, and keep basic records. That's the whole job.