Is It Legal To Use AI To Screen Job Applicants?

AI screening tools can be genuinely useful when you're hiring. They can help you sort high volumes of CVs, identify relevant skills and keep your recruitment process moving when your team is already stretched.

But once an AI tool is helping decide who gets shortlisted, rejected or interviewed, you're dealing with employment law, data protection and discrimination risk. The good news is that AI recruitment isn't automatically off limits in the UK. You just need the right checks around it before you roll it out.

If you're looking at AI recruitment legal UK rules, the key question isn't just whether the tool works. It's whether your business can explain it, manage bias, protect candidate data and keep a real human involved where it matters.

Can You Legally Use AI To Screen Job Applicants?

Yes, you can legally use AI to screen job applicants in the UK, but only if your process complies with UK GDPR, the Data Protection Act 2018 and equality laws.

For most employers, the safest way to think about AI is this: it can support recruitment decisions, but it shouldn't quietly take over the whole decision making process. If a tool ranks applicants, filters CVs or recommends who should move forward, you need to know how that affects candidates and what checks your team will apply.

The main legal areas to watch are:

• Data protection: CVs, application forms, interview notes and assessment scores are personal data under UK GDPR.
• Automated decision making: If a candidate is rejected by a system with no meaningful human involvement, the current automated decision making rules in Articles 22A to 22D UK GDPR may apply.
• Discrimination: Under the Equality Act 2010, your hiring process must not directly or indirectly discriminate against candidates with protected characteristics.
• Transparency: Candidates should be told, in clear language, if AI is used in the recruitment process and what that means for them.
• Vendor control: If a third party supplies the AI tool, your contract needs to deal with data use, security, model training, subprocessors and support with candidate rights.

The Data (Use and Access) Act 2025 amendments to automated decision making came into force on 5 February 2026. The rules now sit in Articles 22A to 22D of the UK GDPR.

The practical message is this: don't rely on a black box. Keep safeguards, human review and clear notices in place, and check current ICO guidance before launch.

What Does UK GDPR Require Before You Roll Out An AI Hiring Tool?

UK GDPR requires you to have a lawful, fair and transparent basis for using candidate data in an AI hiring tool before you start using it.

In practice, that means you should map what data the tool uses, why you need it, where it goes and how long you'll keep it. This doesn't have to be over engineered, but it does need to be written down.

Your checks before launch should cover:

• Lawful basis: Legitimate interests is often considered for recruitment screening, but you need to balance your business interests against candidates' rights. Consent is often weaker in recruitment because candidates may not feel they can freely say no.
• Data minimisation: Only feed the tool information it actually needs. Avoid uploading unnecessary special category data, such as health information, ethnicity or union membership, unless you have a clear legal basis and condition for using it.
• Accuracy: AI scores and summaries can be wrong. Your team should check outputs against the actual application before acting on them.
• Security: Candidate data should be stored and transferred securely, with access limited to people involved in hiring.
• Retention: Don't keep unsuccessful applications inside an AI platform indefinitely. Pick a retention period, or a simple data retention policy, you can justify, taking into account recruitment needs and possible claims. For example, most Employment Tribunal discrimination claims must usually be started within 3 months less one day, although ACAS early conciliation can affect timing.

You should also update your recruitment privacy notice before candidates apply, not after the tool has already processed their details.

When Do You Need A DPIA For AI Recruitment?

You'll usually need a Data Protection Impact Assessment, often called a DPIA or privacy impact assessment, if an AI tool is used to score, rank or filter job applicants.

A DPIA is a written risk assessment under UK GDPR. It helps you identify how the tool affects candidate privacy and what safeguards you need. The ICO expects DPIAs for high risk processing, and AI based recruitment will often fall into that category because it can involve profiling and decisions that affect someone's job prospects.

Your DPIA should answer questions like:

• What decision does the tool help make?
• What personal data is used?
• Does the tool infer anything sensitive, such as disability, age, race or health?
• Could the tool unfairly exclude certain groups?
• Is there meaningful human review before rejection?
• How can candidates ask questions, challenge an outcome or request access to their data through an access request form or another clear route?
• What happens if the vendor suffers a data breach?

A Worked Example

Say Aisha runs a cleaning business in Leeds and receives 240 applications for 8 supervisor roles. Her AI tool scores CVs from 1 to 100 and suggests interviewing anyone scoring 70 or above.

During the DPIA, Aisha notices the tool gives lower scores to applicants with career gaps. That could disadvantage disabled applicants, carers or parents returning to work. She changes the process so the AI score is only one factor, trains managers to review gap explanations and manually checks 30 rejected applications before finalising the shortlist.

That doesn't remove every risk, but it gives Aisha a clearer, fairer process and a record of the steps she took.

How Do You Manage Bias And Discrimination Risk?

You manage bias risk by testing the AI tool, checking its outputs and making sure your recruitment criteria are genuinely linked to the role.

Under the Equality Act 2010, candidates are protected from discrimination based on age, disability, gender reassignment, marriage and civil partnership, pregnancy and maternity, race, religion or belief, sex and sexual orientation. AI can create risk if it learns from past hiring patterns, uses proxy data or rewards traits that don't actually matter for the job.

For example, a tool might favour applicants who use certain university names, live in particular postcodes or have uninterrupted full time work history. Those factors may look neutral, but they can still lead to indirect discrimination if they disadvantage protected groups and you can't justify them.

Practical bias checks include:

• Remove criteria that aren't essential to the role.
• Ask the vendor what data the model was trained on and how it was tested for bias.
• Compare AI recommendations against a sample of applications reviewed by people.
• Check whether certain groups are being screened out at higher rates.
• Keep a record of changes you make after testing.
• Make reasonable adjustments for disabled candidates, such as an alternative application process where needed.

ACAS guidance encourages employers to use AI carefully, involve people in the process and think about equality impacts. That's sensible from a legal and commercial point of view. A fairer process helps you find stronger candidates and reduces the chance of a dispute later.

Do Candidates Need Human Review Of AI Decisions?

Yes, if the AI tool could significantly affect a candidate, you should build in meaningful human review before a final rejection or hiring decision.

Under the current Articles 22A to 22D UK GDPR, a decision is based solely on automated processing where there's no meaningful human involvement. It can be a significant decision if it has a legal or similarly significant effect on the person. A decision not to shortlist someone for a job can be significant, especially where the AI system effectively closes the door on that opportunity.

Human review needs to be real. It isn't enough for a manager to click approve on every AI recommendation without looking at the application. The person reviewing should have authority to change the outcome and enough information to understand why the tool made its recommendation.

Where the Article 22C safeguards apply, your process should give candidates information about the automated decision, enable them to make representations, enable human intervention and enable them to contest the decision. If special category data is involved, you should be especially careful to make sure you have the right UK GDPR condition and that the use is necessary and proportionate.

A good human review process usually includes:

• A clear point where a person reviews AI outputs before rejection.
• Guidance for managers on what to check, such as missing context, career breaks or unusual qualifications.
• A way for candidates to ask for reconsideration or explain relevant information.
• Records of why the final decision was made.
• Training so your team doesn't treat the AI score as the only answer.

You don't need to remove AI from every step. For example, using AI to organise applications or flag missing information may be lower risk than using it to automatically reject candidates. The more the tool affects the outcome, the stronger your human oversight should be.

What Should Your Vendor Terms And Candidate Notice Say?

Your vendor terms and candidate privacy notice should clearly explain how the AI tool uses data, who is responsible for it and what safeguards apply.

If a supplier processes candidate data for you, you'll usually need a data processing agreement that meets UK GDPR requirements. If the supplier decides how data is used for its own purposes, the arrangement may be more complex, so don't assume every vendor is just a processor.

Your vendor contract should cover:

• Whether the vendor is a processor, controller or joint controller.
• Exactly what candidate data the vendor can process and for what purpose.
• Whether candidate data can be used to train or improve the vendor's AI models.
• Security standards, access controls and any information security policy the vendor must follow.
• Subprocessors and overseas transfers.
• Support with DPIAs, candidate rights requests and deletion requests.
• Data breach notification, including enough time for you to assess whether you need to notify the ICO within 72 hours.
• What happens to candidate data when the contract ends.

AI Recruitment Notice Outline

A lawyer should tailor this before you use it, but a useful candidate notice outline would usually include:

1. Who You Are: Name your business and explain that you're the organisation responsible for candidate data.
2. Where Data Comes From: List sources such as CVs, application forms, assessment answers and recruiter notes.
3. How AI Is Used: Explain whether AI helps rank, summarise, score or filter applications.
4. Lawful Basis: Set out the UK GDPR basis you rely on, such as legitimate interests, and summarise your balancing approach.
5. Human Review: Explain where a person reviews AI outputs before decisions are finalised.
6. Automated Decision Safeguards: If Articles 22A to 22D UK GDPR apply, explain how candidates can get information, make representations, ask for human intervention and contest a decision.
7. Who Receives Data: Name categories of recipients, including recruitment platforms and AI vendors.
8. Retention: State how long you keep candidate data and why.
9. Candidate Rights: Explain rights to access, correct, object, restrict processing and raise concerns.
10. Contact Details: Give a contact point for privacy questions or review requests.

Templates can miss the details that matter, especially around AI model training and automated decision making. The document works best when it's tailored to your actual recruitment process.

Key Takeaways

• AI recruitment tools are legal in the UK, but they need data protection, discrimination and human review safeguards.
• You'll usually need a DPIA before using AI to score, rank or filter job applicants.
• The current automated decision making rules sit in Articles 22A to 22D UK GDPR, with Article 22C safeguards for significant solely automated decisions.
• Candidates should receive a clear privacy notice that explains how AI is used in your hiring process.
• Check your vendor terms carefully, especially model training, security, subprocessors, overseas transfers and breach support.
• Bias testing isn't just a legal step. It helps you build a better shortlist and avoid costly disputes down the track.

If you'd like help with your AI recruitment privacy notice, DPIA, vendor terms or human review process, you can reach us at 08081347754 or team@sprintlaw.co.uk for a free, no-obligations chat.