FCA authorised · FRN 724952 0117 325 0027Quote & buy →
Aipedia: HR consultants
AI CV screening is lawful only if rejections have meaningful human involvement or carry the Article 22C safeguards, and the tool does not discriminate. HR consultants who configure or run the sift share responsibility for getting that right.
Part of: AI in HR consultants
In short
Rejecting a candidate is a significant decision under UK GDPR. If an AI sift rejects people with no meaningful human involvement, Article 22C safeguards apply from 5 February 2026: inform candidates, let them make representations and allow human review and challenge. The ICO found many employers fall short. Sifts can also discriminate through proxies such as career gaps or postcodes. The candidate claims against the employer, which may then pursue the consultant who designed the process, so PI wording on discrimination-related losses matters.
Consultants are often asked to help a client cope with high application volumes. That can mean recommending an applicant tracking system with AI ranking, configuring the screening questions and knockout criteria, or running the sift on the client's behalf. Some tools parse CVs and score them against a job description; others rank candidates by predicted fit or flag who should be rejected automatically.
The consultant's role matters. Choosing the tool, setting the criteria and deciding how humans review the output are all professional services the client relies on.
Rejecting a candidate is a significant decision under UK GDPR Article 22A. If the rejection happens with no meaningful human involvement, it is solely automated and the Article 22C safeguards apply: tell the candidate, let them make representations, and allow them to obtain human intervention and contest the decision. These rules have applied since 5 February 2026.
The ICO's Recruitment rewired report found many employers using automated recruitment were likely making solely automated significant decisions with weaker safeguards than the law requires. Its draft ADM guidance warns that "decision-support" tools often turn out to make significant decisions, and that where it is unclear who is significantly affected, the safeguards should apply to all candidates. An AI that ranks 500 applicants and a recruiter who only reads the top 20 may mean the other 480 were rejected by the tool.
A sift can discriminate indirectly even when no protected characteristic is used. Gaps in employment history, particular universities, postcodes or wording styles can act as proxies for sex, race, age or disability. The ICO's 2024 audit found tools that let recruiters filter by protected characteristic or inferred gender and ethnicity from names. The DSIT Responsible AI in Recruitment guide recommends bias audits and performance testing before and after a tool goes live. The CIPD Code requires equal opportunity (positive and active impact, cl.2) and judgement free from bias (good character, cl.5).
Illustrative: a consultant configures an AI screening tool for a client and sets automatic rejection for candidates scoring below a threshold. Nobody reviews those rejections. Months later, an unsuccessful applicant obtains their data through a subject access request, learns they were rejected by the tool and brings a disability discrimination claim, also complaining to the ICO. The client settles and then looks to the consultant, arguing it was advised the setup was lawful.
The candidate's claim is against the employer, so the client's employment practices liability policy, if it has one, is usually the first port of call. The consultant's PI usually comes in when the client, or its insurer, alleges the consultant's advice or configuration was negligent. Whether PI responds depends on the wording, including any exclusions for discrimination-related losses or data protection, and on contract terms such as a limit of liability. Data protection complaints add another layer: an ICO investigation of the client may generate costs and findings that the client later attributes to your advice, and some PI wordings restrict cover for data protection matters. Our page on AI bias and discrimination claims and PI versus client EPL explain the interaction.
Apex arranges PI for HR consultants, including those who configure or run recruitment technology for clients. A broker can check how your policy treats discrimination-related recovery claims. See also AI video interviews, the ICO and DUAA rules explained and AI in HR consulting.
Yes, it can be. But if candidates are rejected with no meaningful human involvement, the Article 22C safeguards apply, and the tool must not discriminate. A DPIA and bias testing are expected before and during use.
Not necessarily. If the tool effectively rejects everyone outside the shortlist without review, those rejections may be solely automated. The ICO says human review should be active and applied consistently to all candidates.
The claim is normally against the employer. The consultant may face a recovery claim from the client or its insurer if the advice or setup was negligent, which is where PI usually becomes relevant, subject to the policy terms.
Start with the ICO's key questions for buyers and the DSIT assurance steps: how the tool reaches its scores, what bias testing has been done and on what data, whether it infers characteristics, how long it keeps data, and how a human can review and override a rejection.
Tell us about your firm and the work you do. A broker will review how your current PI treats AI-assisted work, or arrange new cover. No fee for a quote. Or call 0117 325 0027.
Start a PI quote Request a callbackApex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information about how AI is used in the profession and how insurance may respond. It is not legal, regulatory or insurance advice on your circumstances, and it does not guarantee that cover will be available or on what terms.
