Should I let AI screen CVs or rank job applicants in a small business?

27 October 2026

The short answer: use AI to organise, not reject

For most small businesses, the safest starting point is AI-assisted administration, not automated selection. Let a tool extract stated qualifications, group applications against published requirements and flag missing information. Have a named hiring manager read every application before rejection or invitation. Do not ask a chatbot to decide who is the best person from a pile of CVs. Its neat ranking can conceal weak criteria, factual errors and discrimination.

There is a real efficiency case. If 80 people apply for one vacancy and a person spends five minutes opening and logging each CV, that is nearly seven hours before any assessment. A controlled extraction step can reduce that clerical work. But saving seven hours is not worth excluding a strong candidate because the model treated a career break, non-standard qualification or unfamiliar job title as a weakness. These numbers are a worked example, not a promised saving.

The UK Information Commissioner’s Office (ICO) says it engaged with more than 30 employers about automated decision-making in recruitment and wrote to 16 organisations likely to be using it to make candidate decisions. Those organisations committed to improvements. This is not an obscure hypothetical: the regulator is actively looking at the practice. Read the ICO’s March 2026 statement before buying a ranking tool.

Why a ranking can look objective while being unfair

A score of 82 out of 100 feels precise. Unless the supplier can show what was measured, how it relates to the actual job and how errors are checked, it is just a number. A model may favour familiar employers, uninterrupted careers or particular wording because those patterns appear in past hiring data. It may miss equivalent experience gained through volunteering, caring responsibilities, apprenticeships or a different sector.

The Office for Equality and Opportunity’s March 2026 guidance cites a UK study in which 53% of STEM returners reported negative bias when applying for work because of a lack of recent experience. That does not measure AI bias specifically. It shows why a screening rule that treats gaps as a negative signal can cause harm. The same guidance says employers remain responsible for non-discriminatory recruitment under the Equality Act 2010 and must review AI outputs.

In its earlier audits of recruitment-tool providers, the ICO made almost 300 recommendations. It found examples of tools that allowed filtering by protected characteristics, inferred gender and ethnicity from names, or retained excessive candidate data. These were findings about audited providers, not proof that every product behaves this way. They are a reason to demand evidence instead of accepting a vendor’s fairness claim. See the ICO audit summary.

What can AI safely do in a small hiring process?

Start with a published role description and a short, job-related assessment rubric. For example, if a bookkeeper must reconcile accounts, use evidence of reconciliation experience and an accessible practical exercise. Do not invent a vague “culture fit” score. The software can then extract answers to factual questions, identify missing documents, suggest interview scheduling and summarise application evidence against the rubric. Treat each summary as a pointer back to the original CV, never as the source of truth.

Use a two-column review sheet: requirement and evidence found in the candidate’s own words. Add a third column for “not established”, which is different from “does not have”. A human reviewer should be able to open the original application in one click. For uncertain or contradictory cases, contact the applicant or assess them through a structured interview. An AI system should not fill gaps with guesses about age, background, disability, nationality or personality.

Run a small pilot before using the tool in live decisions. Take 20 to 30 previously assessed applications, remove names where practical, and compare the AI-assisted notes with your human rubric. Record missed evidence, invented claims and inconsistent treatment. If the tool cannot quote the source passage for each factual claim, do not use its output for shortlisting. The sample size is a practical trial suggestion, not a statistical certification of fairness. If you only hire once or twice a year, a structured human review may be cheaper and more reliable than any subscription.

What are the UK legal and privacy checks?

The Equality Act 2010 applies to hiring decisions. UK GDPR and the Data Protection Act 2018 apply when you process applicant information, including CVs, interview notes and assessment scores. A supplier contract does not transfer the employer’s responsibility for fair recruitment. Ask what lawful basis you rely on, what data the tool receives, where it is stored, how long it is kept and whether it is used to train models. Update your candidate privacy notice so the use is clear.

Be especially careful if a system makes a decision with no meaningful human involvement that has a legal or similarly significant effect. The Data (Use and Access) Act 2025 changed the UK framework for automated decision-making, but it did not remove the need for safeguards. The ICO says organisations should monitor bias, tell jobseekers about automated decisions, explain how to challenge them and offer a route to human review. A manager rubber-stamping a score is not meaningful involvement. The manager needs the authority, time and evidence to change the outcome.

Before processing live applications, assess whether a data protection impact assessment is needed. A novel ranking system that profiles applicants is a strong reason to seek advice from your data protection lead or solicitor. Ask the vendor about access controls, deletion, sub-processors and security testing. Do not paste CVs into a personal chatbot account. Candidate applications contain personal data, sometimes including sensitive information volunteered by the applicant. Limit access to staff who actually need it and set a retention period.

How should you test and govern a supplier?

Ask the vendor to demonstrate the tool with your actual job criteria and synthetic or appropriately permissioned sample CVs. Request documentation of how scores are produced, what data trained the system, whether candidates can be filtered by protected characteristics and how adverse outcomes are monitored. Ask for a clear deletion process, an export route and a way to turn off automated rejection. If the seller cannot answer, do not let the product determine who gets an interview.

Compare the shortlist with a human-reviewed baseline. Check whether people with career breaks, alternative qualifications or non-linear experience are disproportionately excluded. Be cautious with equality monitoring data: it may be special category data, so get appropriate privacy advice before collecting or analysing it. The government guidance recommends tracking the breakdown of applicants shortlisted, interviewed and offered a role, where lawful and practical. Review the tool after each campaign rather than assuming an initial pilot remains valid after a model update.

Keep a short decision record: role criteria, tool version, people who reviewed applications, any overridden scores, candidate challenges and the reason for final decisions. Build a manual fallback. If the system fails on interview day or produces an obviously false summary, staff must be able to continue without losing applications. A basic applicant tracking system such as Workable or Teamtailor may be useful for organising applications, but its AI features still need the same scrutiny. A spreadsheet and structured rubric can be the better option for an occasional vacancy.

When this is not right for you

Do not use AI ranking if you have only a handful of applicants, no written assessment criteria or nobody available to audit decisions. Do not use it to infer personality, health, disability, age or likely family plans from CV wording, video or social media. Avoid automatic rejection for roles where unconventional backgrounds may be an advantage. A system that speeds up a poor process simply scales the poor process.

If the team is under pressure to hire quickly, first simplify the application form, publish a clear salary range and use structured interview questions. These are often higher-value changes than buying screening software. Anonymised forms and experience expressed in years rather than dates may help in some settings, but the government warns that anonymisation is not a universal fix. It can conflict with some targeted diversity initiatives. Decide what problem you are solving and test the effect.

The honest recommendation for a small employer is narrow: use AI to help organise evidence, keep a person genuinely responsible for every shortlist and rejection, and review outcomes. If you cannot explain the process to an unsuccessful applicant in plain English, the process is not ready. If you want a second pair of eyes on a proposed workflow, ask for a practical review before giving the tool live candidate data.

Is This Right For You?

AI-assisted organisation may suit a business hiring regularly, with written job criteria, a secure approved tool and a named human reviewer. It is not a good fit if you hire rarely, cannot explain the score, lack time for review or have not assessed candidate data protection. A structured manual process is a sound alternative.

Frequently Asked Questions

Is it legal to use AI to screen CVs in the UK?

It can be, but employers must comply with equality and data protection law, explain the processing, put appropriate safeguards in place and test outcomes. Solely automated significant decisions trigger particular UK GDPR safeguards.

Can AI automatically reject applicants who lack a required qualification?

Avoid automatic rejection until a person checks the underlying evidence and whether an equivalent qualification or experience meets the genuine requirement. A missing mention is not proof of absence.

Do I need to tell applicants that AI is used?

Yes, explain the use clearly in your candidate privacy information. If a decision is solely automated and significant, explain the available challenge and human-review route.

Can I paste CVs into ChatGPT to save time?

Do not use a personal or unapproved account for identifiable CVs. Check supplier terms, retention, training settings, lawful basis and access controls before using any service.

How do I check whether screening is biased?

Use a job-related rubric, compare tool outputs with human review, inspect errors and monitor shortlisting outcomes over time. Seek privacy advice before collecting or analysing protected-characteristic data.

What should I do if an applicant challenges a decision?

Pause the outcome, retrieve the original application and criteria, arrange a genuine human review and explain the result. Keep a record of what changed and what the process needs to fix.