AI CV screening and the ICO's rules: what a recruitment agency has to do before a model reads a candidate's CV

"CV screening AI" and "AI tools for recruiting" are typed as often as "recruitment CRM" now, and nearly every agency uses something. The survey evidence says adoption is wide and shallow: most agencies use AI, few have embedded it, and almost none have a documented policy for it. The regulator has written one for them. In November 2024 the ICO published the outcomes of its audit of AI recruitment tool providers, with almost 300 recommendations, and in April 2026 it followed up on automated decision-making in recruitment. This guide turns those findings into what an agency does.

What the ICO found

Tools that inferred gender or ethnicity from a candidate's name and used it in scoring. Tools that let a recruiter filter candidates by a protected characteristic. Tools with no testing of whether their scores were accurate or whether they were biased. Tools collecting far more personal data than the job needed, and keeping it indefinitely. And providers describing themselves as processors, acting on the agency's instructions, when in fact they decided what data was used and how, which makes them controllers. The agency that bought the tool had, in most cases, not asked.

The six things an agency does

1. A DPIA before the first CV goes in. A data protection impact assessment is required where processing is likely to be high risk, and the ICO treats AI scoring of job applicants as that. It is a document: what the tool does, what data it uses, what could go wrong for a candidate, what you have done about it. A small agency's DPIA is four pages, written once and updated when the tool changes.

2. Decide who is the controller. If you choose the tool, the candidates and what "good" looks like, you are a controller and the vendor is your processor, with a contract that says so and limits what the vendor may do with the data. If the vendor decides those things, it is a controller too, and your contract has to reflect that. "The vendor said they're a processor" is not a finding.

3. No protected characteristics, inferred or filtered. The model does not see name, age, gender, nationality, photographs, address beyond travel distance, or anything from which those can be inferred, and nobody can filter on them. Ask the vendor to show, not say, how names are handled.

4. Accuracy and bias testing, with results you have seen. Before use and at intervals: does the score track performance in the role, and does it differ by group? If the vendor cannot show you the testing, the testing has not been done.

5. A human makes the decision, and can explain it. The ICO's phrase is meaningful human review. A consultant who clicks through a ranked list has not reviewed it. The design that satisfies the rule is a tool that gives reasons against the brief, and a consultant who reads the reasons for every shortlisted and every rejected candidate and can say why each went where they did. The April 2026 report's concern was exactly the gap between tools described as decision support and processes in which no human in fact decided.

6. Tell the candidate. The privacy notice says that AI is used to assist screening, what it does, that a person decides, and how to object or ask for a human-only review. A line in the application form, not a paragraph on page nine of the website.

How an AI Resourcer set up by Overlyft is built to this

The Resourcer reads applications against the written brief and produces, for each candidate, a short note of where they meet it and where they do not, citing the CV. It never sees the fields in rule three; the CRM strips them before the model reads. It ranks nothing by a hidden score: the consultant reads the notes and shortlists, and the shortlist records the consultant's reasons. The DPIA template and the privacy notice line are part of the install, and the testing in rule four is the agency's own: the Resourcer's notes against the consultant's decisions, checked quarterly.

Why this is the agency's problem, not the vendor's

Because the candidate's complaint goes to the agency that processed their application, and the ICO's enforcement follows the controller. A vendor's assurance is a contract term you may be able to rely on later; it is not a defence on the day. The same logic runs through the terms of business, where the data protection clause should say who is controller of what, and through the right to work file, where the retention period has an end.

The question candidates and clients will ask next is not whether you use AI but whether you can show how. This is general information about the regulator's published position, not legal advice.