A founder in Manchester called me last month. Her ATS had rejected 340 applicants in nine days, and she was thrilled with the speed. Then she asked, almost as a side note, whether we should look at who actually got through. So, we did.
Every shortlisted candidate had gone to one of six universities. Not because those were the six best in the pile, but because that is what her previous hires looked like, and the tool had quietly learned to want more of the same. Nobody had chosen this. The software simply found a pattern in the historical data and made it the future.
This is where AI CV screening in 2026 either becomes the best hiring decision a small business ever makes, or a quiet way to keep making the same hiring mistakes at faster speed.
A note on scope. This article discusses AI CV screening from a talent acquisition perspective. It references the UK regulatory environment as context for HR leaders and business owners, but it is not legal advice. Decisions about lawful basis, Data Protection Impact Assessments, Article 22 of UK GDPR, the Equality Act 2010 or any other compliance obligation should be taken with a qualified UK data protection or employment law specialist.
AI CV screening is software that reads, scores and ranks CVs against a role using machine learning, so a recruiter or hiring manager can shortlist faster. The system parses each CV into structured data (skills, titles, tenure, education, keywords), compares it against the job description, and ranks candidates from best to worst fit.
Some tools stop there. Others make the shortlisting decision on their own, quietly moving candidates out of the process before a human has looked at anything. That distinction, between a tool that suggests and a tool that decides, is where most of the real risk in UK hiring now sits.
The regulator has spent 2024 and 2025 tightening its expectations of AI in recruitment, and the direction of travel is clear: employers using these tools without genuine oversight are drawing increasing regulatory attention.
The ICO’s March 2026 Recruitment Rewired report reviewed how more than 30 UK employers used AI hiring tools between March 2025 and January 2026. Many organisations believed they were using AI as decision support, but their tools were making shortlisting decisions on their own, with little more than a scan-and-approve from a hiring manager. The ICO does not accept scan-and-approve as meaningful human involvement, and it has signalled this is now a regulatory focus.
The ICO’s earlier November 2024 audit of AI recruitment vendors uncovered two distinct problems. Some tools included features that let recruiters filter out candidates on protected characteristics such as gender or ethnicity. Others were inferring those characteristics from candidates’ names rather than asking directly, and treating that inferred data as fair game for scoring. Almost 300 recommendations followed.
There is a scale problem underneath it. CIPD Resourcing and Talent Planning 2024 data shows 31% of UK organisations now use AI in recruitment in some form, nearly double the 16% reported in 2022. The ICO has also observed that employers were often not completing a Data Protection Impact Assessment before switching AI recruitment tools on, or the assessments they had completed did not cover the minimum expected areas. That is exactly the kind of documentation a qualified data protection specialist can help you get right.
Because most SMEs buy AI screening tools the way they buy office software, then never treat them like the hiring decisions they actually make. CIPD data indicates around 80% of UK SMEs are not using AI in recruitment at all yet, so the risk is concentrated in the minority that has adopted it. That minority is quietly setting the standard the majority will be expected to meet.
A few patterns show up again and again.
Trust without inspection. A tool is bought, plugged into the ATS, and given control of the top of the funnel. Nobody audits the shortlist for demographic patterns. The output feels neutral because it comes from software, and neutral feelings are the wrong test.
The historical data trap. If your last ten hires came from the same three universities and you train a model on your successful hires, the model learns to prefer those three universities. Nobody meant to build a bias engine. Everyone did.
The job description problem, where all of this actually begins. If your JD is written around credentials that were never the point, the AI has nothing better to screen for. Rubbish in, ranked rubbish out. (I wrote about the JD problem here: why your job description is costing you the best candidates.)
The human oversight fiction. A recruiter glancing at a ranked list and clicking on the top ten is not real review, and the ICO has said as much. Meaningful oversight means the ability to challenge the ranking, understand the scoring, and correct the system when it gets it wrong.
Most SMEs do not have those muscles yet. Underneath it sits a wider capability gap I unpacked in AI literacy is the hardest skill to hire for in the UK. The tools are running ahead of the people who are supposed to govern them.
The employers who get this right treat AI screening as a hiring quality question, not a plug-in feature. They start with the job, not the tool. They audit their outcomes as seriously as they audit their finances. And they bring in a specialist for the compliance side rather than guessing at it.
They fix the job description first. Every screening decision the AI makes reflects the criteria in that document. If the criteria are proxies for what a good candidate really needs, the shortlist will be full of proxies.
They involve a qualified data protection or employment law specialist before switching a new tool on, not after somebody complains. A specialist can guide them through the DPIA and the wider compliance picture in a way a talent leader alone realistically cannot.
They keep humans genuinely in the loop. That means someone reviewing not just the shortlist but the rejections, with the authority to overrule the tool and the time to do it.
They audit hiring outcomes on a schedule. Every quarter, at minimum. Selection rates by demographic group. False negative sampling, which means looking at rejected candidates to estimate how many good ones were missed. And a periodic check on which features the tool is weighting most heavily, so nothing is quietly acting as a proxy for something it shouldn’t.
They are transparent with candidates. Not just because there are legal reasons to be, but because candidate trust is the foundation of any employer brand worth having. People remember how they were treated when they didn’t get the job.
Regulatory attention is intensifying, and the SMEs that build good habits now will find the coming years easier than the SMEs that don’t. The EU AI Act, which classifies recruitment screening as a high-risk system, comes into full effect in August 2026, and UK employers hiring EU-based candidates fall within its reach. The ICO in the UK is signalling closer scrutiny of automated decision-making in recruitment through the Recruitment Rewired findings and its consultation on updated guidance.
The direction of travel is obvious. AI in hiring is here to stay. The question every SME leader should be asking is whether their organisation can defend how it is using these tools if anyone ever comes to ask.
If your business already uses AI CV screening, or is about to, a few moves are worth making before the month is out. None of them cost anything except time and honesty.
Ask your vendor for their fairness testing evidence and their most recent bias audit reports. If they cannot produce either, that is a bigger problem than a slow shortlist.
Look at the last fifty candidates the tool rejected. Not the shortlist. The rejections. Read them the way an outside auditor would. Universities. Names. Employment gaps. Job title conventions. The rejection pile is where bias hides quietly.
And go back to the job description. Everything the AI does downstream is built on the criteria you set there. Fixing the JD is still the highest-leverage move any UK SME can make this year.
FREQUENTLY ASKED QUESTIONS
The essentials are practical first. Look at what data the tool uses, how it was trained, what evidence the vendor can produce on fairness and bias testing, whether a human can meaningfully override its shortlisting, and how you would explain the process to a candidate who asked. The ICO also has clear expectations around DPIAs, transparency and human involvement, and a qualified specialist can help you translate those into your specific setup.
Yes, and it often is. Bias usually comes from the data the model was trained on. If historical hires reflect any imbalance, the model can learn and amplify it. This is why outcome audits and human oversight matter more than vendor claims about ‘neutral’ algorithms.
Pricing varies widely by vendor, feature set and application volume, and the software cost is rarely an interesting number. The bigger cost is the governance work around it. A cheap tool used without proper oversight, without bias auditing and without transparency to candidates is not saving money. It is deferring a problem.
A tool that suggests presents a hiring manager with a ranked list, and the manager makes a real decision, with the ability to overrule the ranking. A tool that decides moves candidates through or out of the process on its own, and any human review is essentially a rubber stamp. The second kind is where the hiring quality problems and the regulatory concerns both live.
Yes, and treating this as a candidate experience question rather than a purely legal one usually leads to better outcomes. People remember how they were treated in a process they didn’t win, and they tell others. Transparency about automated processing also sits within UK data protection expectations, so the wording of your privacy notice and how candidates can request a human review are worth getting right with a specialist.
ABOUT THE AUTHOR
Sabiha is a Talent Acquisition Director, speaker and author with more than 16 years of hiring experience across the UK, Dubai, South Africa and Malaysia. She helps UK organisations move past reactive hiring and build workforce strategies that hold up for the long run, using AI alongside human judgement. Shortlisted as Best Career Coach UK by the CDI, she has helped businesses improve how they hire and retain talent
Her upcoming book, How to Use AI to Win Talent and Retain People (Trotman, 2026), is CIPD-aligned and built for HR leaders navigating exactly the challenges covered in this article.
Global Talent. Ethical AI. Strategic Hiring. Sustainable Retention.
