Using AI to screen CVs or interview candidates? The laws that apply

Does discrimination law apply when AI makes the call?

Yes. In the US, Title VII of the Civil Rights Act (race, colour, religion, sex, national origin), the Americans with Disabilities Act (ADA) and the Age Discrimination in Employment Act (ADEA) all apply to automated tools. They cover two kinds of unfairness. ‘Disparate treatment’ means treating someone worse because of a protected trait. ‘Disparate impact’ means a neutral-looking rule that hits one group much harder without good business reason.

The first federal case came in 2023. The EEOC, the US agency that enforces these laws, said iTutorGroup set its application software to reject women aged 55 or over and men aged 60 or over automatically. More than 200 applicants were turned away. The company paid $365,000 under a court-approved settlement.

Federal priorities have since shifted. In January 2025 the EEOC removed its AI guidance documents from its website, and an April 2025 executive order told agencies to deprioritise disparate impact enforcement. But the statutes are unchanged, private claimants can still sue, and states are filling the gap.

Elsewhere the position is similar. In the UK, the Equality Act 2010 bans direct and indirect discrimination and requires reasonable adjustments for disabled candidates. EU equality directives do the same across member states. In India, the Code on Wages, in force since November 2025, bans gender discrimination in recruitment, and disability law adds further duties.

Can the AI vendor be sued too?

Increasingly, yes. The leading case is Mobley v. Workday in the federal court in Northern California. Derek Mobley, a job seeker over 40, says Workday’s AI screening tools helped employers reject him and other applicants because of age, race and disability.

The court has allowed the claim to proceed on the theory that a vendor can act as the employer’s ‘agent’. In May 2025 it conditionally certified a nationwide ‘collective’, a US group action, of applicants aged 40 and over rejected through Workday’s platform since September 2020. Rulings in 2026 kept most claims alive, including some under California law. As of October 2026 the case is still in pre-trial stages and there has been no finding that Workday broke the law.

Other challenges are under way. In March 2025 the ACLU filed complaints against Intuit and HireVue on behalf of a deaf Indigenous employee rejected after an automated video interview. Both companies deny the allegations, and HireVue says its AI assessment was not used.

Which US laws specifically regulate AI in hiring?

There is no federal AI hiring law. Instead, a patchwork of city and state rules sits on top of discrimination law. New York City was first. Since July 2023, Local Law 144 has required an independent bias audit within a year before using an ‘automated employment decision tool’, a public summary of the results and notice to candidates at least ten business days before use.

Enforcement has been weak, and that is changing. A December 2025 audit by the New York State Comptroller called the city’s enforcement ineffective. The city regulator had received only two complaints and found one problem among 32 companies it reviewed, while auditors found at least 17 potential breaches in the same group. Penalties run from $500 to $1,500 per violation.

Illinois regulates in two ways. Its Artificial Intelligence Video Interview Act, in force since 2020, requires notice, an explanation and consent before AI analyses a recorded interview. Since 1 January 2026, amendments to the Illinois Human Rights Act also make it a civil rights violation to use AI that discriminates, including by using zip codes as a proxy, or to use AI in employment decisions without notice. Detailed notice rules were proposed in May 2026 and then withdrawn for further work.

California’s Civil Rights Council rules took effect on 1 October 2025. They confirm that automated-decision systems can break state anti-discrimination law, treat some AI assessments that reveal disability as unlawful medical inquiries and require relevant records to be kept for four years. California’s separate privacy rules on automated decision-making technology add notice, opt-out or appeal rights for employment decisions from 1 January 2027. Colorado’s rewritten law, due to start the same day, is under a legal cloud, and Texas’s TRAIGA, in force since January 2026, bans AI used with intent to discriminate.

What does the EU AI Act mean for recruiters?

The EU AI Act lists AI used to recruit or select people, filter applications, evaluate candidates, or make decisions about promotion, termination and task allocation as ‘high-risk’ in Annex III. After the 2026 Digital Omnibus amendments, those high-risk duties apply from 2 December 2027.

Most duties fall on the ‘provider’, the company that builds the tool. But the employer, as ‘deployer’, must use it according to its instructions, assign trained people to oversee it, monitor how it performs and keep its logs for at least six months. Employers must also inform workers’ representatives and affected staff before using high-risk AI at work, and tell people when a high-risk system is used to make decisions about them.

One part already applies. Since 2 February 2025, AI systems that infer the emotions of people in the workplace have been banned, except for medical or safety reasons. The European Commission’s guidelines on prohibited practices indicate this covers candidates during recruitment, not just existing staff. A video interview tool that scores enthusiasm or nervousness from facial expressions or voice is likely to fall within it.

GDPR, UK GDPR and the ICO’s view of recruitment AI

Data protection law applies to every CV you process. Under Article 22 of the GDPR, people have the right not to be subject to a decision based solely on automated processing that has legal or similarly significant effects, such as an automatic rejection, unless an exception applies. The EU’s top court held in its 2023 SCHUFA judgment that a score can count as such a decision when it plays a decisive role in the outcome.

Recruitment AI usually needs a data protection impact assessment, or DPIA: a written risk review done before you start. You must also be transparent, collect only what you need and delete it when no longer needed.

The UK regulator, the ICO, audited AI recruitment tool providers between 2023 and 2024 and published its findings in November 2024. It found tools that let recruiters filter out people by protected characteristics, tools inferring gender or ethnicity from names, and candidate databases built by scraping. It made almost 300 recommendations, all accepted or partly accepted. Since February 2026, the UK’s Data (Use and Access) Act 2025 permits significant automated decisions more widely, but safeguards such as human intervention and the right to contest remain.

Are AI video interviews, notetakers and personality tests legal?

Usually, if set up carefully. A tool that transcribes an interview is very different from one that scores a candidate’s face or voice.

AI notetakers record people, so recording and consent laws apply. Several US states, including California, require everyone on a call to agree to recording, and the GDPR requires clear notice. Tell candidates before the interview, offer a way to opt out and do not let the summary replace the interviewer’s own assessment.

Personality and game-based assessments raise disability questions. A timed game may disadvantage someone with a motor or visual impairment, and California treats some assessments that reveal disability as medical inquiries. Offer reasonable adjustments or an alternative route, and say how to ask for one.

Can you use AI to monitor employees?

Yes, within limits, and the limits are tighter than many managers assume. In the EU, emotion recognition at work is banned, and AI used to monitor performance or allocate tasks will be high-risk from December 2027. The GDPR requires a lawful basis, transparency and proportionality, which usually means a DPIA first. The ICO’s 2023 guidance on monitoring workers sets out similar expectations in the UK.

Businesses that manage workers through apps face extra rules. The EU Platform Work Directive must be transposed into national law by 2 December 2026. It limits what personal data digital labour platforms may process through automated systems, requires them to explain how algorithmic management works and gives workers a right to human review of significant decisions, such as suspending an account.

In the US, New York requires employers to give written notice of electronic monitoring, and California’s privacy law covers employee data. India’s DPDP Act allows employers to process personal data for employment purposes without consent in many cases, but its core duties only bite from 13 May 2027.

What is happening in the market right now?

Adoption is high and rising. SHRM, the US HR professional body, reported that AI use in HR tasks rose from 26% of respondents in 2024 to 43% in 2025. Its 2026 report found recruiting was the HR area where AI was most commonly used.

Litigation and enforcement are catching up. Mobley v. Workday has shown that vendors can be pulled into class-style claims. In the US, state agencies and private claimants are leading as federal enforcement steps back. The New York audit is likely to push the city towards more active enforcement.

Regulation is spreading beyond the US and EU. Ontario has required employers with 25 or more staff to disclose AI screening in public job postings since 1 January 2026. South Korea’s AI Basic Act, in force since January 2026, treats AI used in hiring decisions as ‘high-impact’. Singapore’s Workplace Fairness Act, passed in 2025, is expected to take effect around the end of 2027.

The direction is consistent. Regulators want proof of bias testing, notice to people and a human who can step in.

How do you use AI in hiring safely?

Start with an inventory. Many employers do not know which of their tools use AI, because features arrive in software updates. Ask your ATS, assessment and interview vendors directly, and record what each feature does.

Then build a short, repeatable process: check outcomes by group, tell candidates, keep humans responsible for decisions and keep records. If you hire across several jurisdictions, check with a lawyer for your situation, because notice periods and audit rules differ.

• Use AI to assist, not replace, the person making the hiring decision
• Give the model job-related criteria and remove obvious proxies such as photos, dates of birth and graduation years
• Compare pass rates by sex, age band, ethnicity and disability where you lawfully hold that data
• Keep prompts, outputs and decisions for at least four years if you hire in California