Is it legal to use AI for CV screening in the UK?

It can be, with safeguards. AI must not be the sole basis for a rejection (UK GDPR Article 22), must not produce discriminatory outcomes under the Equality Act 2010, and should be subject to a DPIA. The ICO has indicated that recruitment AI is a high-priority area for enforcement.

Do we need to tell candidates we're using AI?

Yes. Candidates have a right to be informed when their personal data is processed using AI for selection decisions. This is typically handled through the privacy notice on the application page or recruitment microsite.

Can AI be used to make redundancy selection decisions?

Direct use is very high risk. Redundancy decisions affect existing employees with contractual rights, and discrimination claims are common. If AI is used at all, it should be limited to producing data summaries that a human decision-maker reviews — not generating selection rankings.

What's the role of trade unions in AI adoption?

Most major UK trade unions expect early consultation on AI in HR processes. Trying to introduce AI in unionised workplaces without consultation risks breaching collective agreements and creating disputes. Engage with recognised unions before deployment, not after.

AI in HR and Recruitment | Public Skills Hub

Where AI Genuinely Helps in HR Work

HR is one of the workplace functions where AI adoption has been both rapid and controversial. AI tools can save HR teams significant time on routine tasks — but they can also introduce legal and ethical risks that are particularly serious in employment contexts. The right approach is to be selective about where you adopt AI, not to refuse it altogether or roll it out indiscriminately.

The strongest AI use cases in HR are typically in drafting and summarisation rather than decision-making. Examples include: drafting job adverts (which a recruiter then reviews); summarising employee survey comments into themes; drafting first versions of policy documents for HR to refine; generating interview question banks for the recruiter to select from; and producing first drafts of onboarding materials, training content, or internal communications.

Higher-risk use cases — and the ones where governance most matters — involve AI in decisions about people: CV screening, candidate scoring, performance assessment, redundancy selection, promotion decisions. UK Equality Act and UK GDPR obligations apply in full to these uses, and the consequences of getting them wrong can be severe. Our AI risks every office team should understand guide covers the underlying issues, and our AI and UK GDPR guide covers the data protection rules in detail.

AI in Recruitment and CV Screening

AI-assisted CV screening is one of the most common HR AI use cases — and one of the most legally exposed. Several high-profile cases have established that an AI tool that systematically disadvantages candidates with protected characteristics (under the Equality Act 2010) creates legal liability for the employer, even if there was no discriminatory intent.

The most cited example internationally is Amazon's CV-screening AI, which was discovered to systematically downrank CVs from women because the historical hiring data it was trained on reflected male-dominated hiring patterns. Amazon abandoned the tool. UK employment tribunals have not yet decided a major AI-discrimination case, but the legal framework is clear: an AI tool that reflects historical bias and is used to make hiring decisions creates risk under sections 19 (indirect discrimination) and (potentially) 13 (direct discrimination) of the Equality Act 2010.

Practical safeguards for AI-assisted recruitment:

Never use AI as the sole basis for a recruitment decision. AI should produce a shortlist or ranking that a human recruiter reviews — not an automated rejection. UK GDPR Article 22 also requires this for "solely automated" decisions with legal or significant effects.
Audit the AI tool for bias before deployment. Ask the vendor for their bias-testing methodology and results. If they can't provide one, do not deploy. The AI Vendor Due Diligence Questionnaire includes the right questions.
Document the rationale for every adverse decision. "The AI tool ranked this candidate low" is not a defensible rationale. The human reviewer needs to articulate the candidate-specific reasons for not progressing.
Conduct a DPIA before deploying AI in recruitment. Personal data processing for selection decisions is high-risk under UK GDPR and an ICO-recommended trigger for a Data Protection Impact Assessment.

AI in Performance Management and L&D

AI in performance management runs into similar legal and ethical issues to recruitment, with one key difference: performance decisions usually affect existing employees with contractual rights, not external candidates. The consequences of getting it wrong include unfair dismissal claims, discrimination claims, and (for public sector employers) breaches of the Public Sector Equality Duty.

The strongest performance-management AI use cases are again in support of human decision-making rather than automation. Examples: AI summarising 360-degree feedback into themes; AI generating draft performance review questions tailored to a role; AI drafting development plans from a manager's notes for the manager to refine. AI generating "performance scores" that drive consequential decisions is much higher-risk and rarely defensible without substantial human review.

L&D is a lower-risk area where AI can add genuine value. AI-generated training content, personalised learning paths, summary content for refresher training, and adaptive assessments all have established use cases. The main considerations are accuracy (AI-generated training content needs human verification — see AI hallucinations explained) and copyright (AI-generated images and text may have unclear copyright status).

Our AI Risk Assessment Starter template gives HR a structured way to evaluate any specific AI use case before adopting it.

Governance, Trade Union Engagement, and Transparency

The ICO has been clear that staff have a right to know when AI is being used to make decisions affecting them. This includes recruitment screening, performance assessment, promotion decisions, redundancy scoring, and any other employment decision that uses AI. Transparency is both a legal requirement (under UK GDPR's right to be informed) and a practical necessity for maintaining trust.

For unionised workforces, AI in HR is typically a matter for collective consultation. Major UK trade unions (Unison, GMB, Unite, USDAW, and others) have produced policy positions on AI in the workplace, and most expect early consultation on AI in HR processes. Trying to introduce AI-driven HR decisions without consultation is likely to be challenged and may breach existing collective agreements.

Three governance artefacts should be in place before AI rolls out in HR:

An AI policy section specifically covering HR use cases, with clear rules on what AI can and cannot be used for. The Workplace AI Policy template is a starting point; HR-specific clauses should address recruitment, performance, and L&D separately.
A DPIA for any AI use involving employee or candidate personal data. This is not optional for higher-risk uses.
Documented audit trail. Use the AI Tool Approval Log to record which AI tools have been approved for which HR processes, who approved them, and on what evidence.

HR teams that adopt AI thoughtfully — with clear scope, good governance, and meaningful human oversight — typically see strong value with manageable risk. Teams that adopt AI without governance often discover the risks only after a tribunal claim, ICO investigation, or trade union dispute makes them visible.