What the duties actually say #
Two separate regimes apply at the same time, and they are often confused with each other.
Equality law. Section 55 of the Equality Act 2010 covers employment service-providers. A service-provider must not discriminate against a person:
in the arrangements the service-provider makes for selecting persons to whom to provide, or to whom to offer to provide, the service
The word that matters is arrangements. A ranking process is an arrangement. Buying it from somebody else does not make it not yours.
Data protection. The ICO describes automated decision-making as decisions based solely on automated processing, with no meaningful human involvement, that have a legal or similarly significant effect on someone. Its draft guidance was updated on 31 March 2026 to reflect the Data (Use and Access) Act 2025, and sets out safeguards.
- Giving people information about decisions
- Letting them make representations
- Ensuring human intervention
- Allowing them to contest a decision
Not being shortlisted for a job is the kind of effect people care about, and the ICO publishes a separate set of AI resources including a risk toolkit.
The four failure modes #
-
It misreads the document
Every screening tool starts by parsing, and parsing is unreliable on exactly the CVs that were designed rather than typed: two column layouts, tables, graphics, dates in inconsistent formats. The same problem shows up in reformatting CVs to your own template, but there a person usually notices. In screening, a dropped qualification silently becomes a lower rank.
-
It finds proxies
A model does not need a protected characteristic to act on one. Postcode, school, university, career gaps, part time patterns, the name of a former employer and the phrasing of a sentence all carry information about who somebody is. A system that never sees an age or an ethnicity can still sort on them.
-
It learns from your history
Tools trained or tuned on past shortlisting decisions reproduce the pattern of those decisions, including the parts of the pattern nobody would defend out loud. A tool that agrees with your last three years is not accurate, it is loyal.
-
It optimises for the wrong thing
The measurable outcome in most recruitment data is what the recruiter did next, not whether the placement worked. A system that predicts who gets shortlisted is not predicting who should be.
What it does not remove #
Regulation 19 of the Conduct of Employment Agencies and Employment Businesses Regulations 2003 still requires an employment business to obtain confirmation of a work-seeker's identity and that they have the experience, training, qualifications and any authorisation the role needs, before supplying them.
And the candidate-facing consequence does not move either. If somebody asks why they were rejected, "the system ranked you 41st" is not an answer anybody wants to give, and under the safeguards described above it may not be an adequate one.
Which parts of screening genuinely run on rules #
Runs on rules
- Deduplicating applicants already in your database, and it is low risk
- Checking hard, stated requirements such as a licence or a right to work in a location, as a flag for a person rather than a rejection
- Acknowledging every application, covered in candidate and client updates
- Extracting structured data from a CV, in principle, with the parsing caveat above
Needs a person
- Ranking candidates on fit. This is a judgement with duties attached
- Rejecting anybody
- Deciding what a gap or an unusual career shape means
The last one is exactly where the harm happens.
The question worth asking first #
Most agencies arrive at screening tools because the review load is unmanageable, and the review load is usually a symptom.
Vague adverts, the wrong boards, a brief that never pinned down the requirement, and no filter earlier in the process all produce piles of applications that were never going to work. That is a cheaper problem to fix and it carries none of these duties. It starts with what a job advert actually has to say.
If you do want to understand what this technology can and cannot do before anyone sells you any, the plain answers are in AI automation, explained. We will not publish a recipe for building a screening process, because the honest version of that work starts with your data, your obligations and a conversation about where a person has to stay in the loop.