Category: Fair and compliant hiring

Blind CV screening hides details such as name, photo, address and date of birth during the first review, so that reviewers judge applicants on skills and evidence. Public trials show mixed results: it can remove one route for bias, but it does not fix unclear criteria and it can remove useful context. Use it as one control among several, and measure the effect in your own process.

What blind recruitment is

Blind recruitment, also called anonymised or name-blind screening, removes some or all personal details from an application before the first reviewer sees it. The idea is simple: if a reviewer cannot see a name, a photo or an age, those details cannot trigger a conscious or unconscious judgement. The reviewer scores the work history, skills and evidence against the job criteria. Later in the process, after a shortlist is chosen, the details are revealed.

Blind screening is different from a structured process. A structured process asks the same questions and uses the same scoring for everyone. Blind screening hides some information. You can use both. See our guides on structured screening and how to reduce bias in resume screening.

Does it work? What public trials found

Evidence from public programmes is mixed. Two examples show why you should test the method before you rely on it.

Trial	What was tested	What was reported
Public Service Commission of Canada, name-blind pilot, 2017	27 recruitment processes, April to October 2017, comparing anonymised and non-anonymised screening	The overall rate of applicants screened in fell from 48.3 percent to 43.3 percent with anonymisation. For visible-minority applicants, the rates were 47.3 percent and 46.0 percent, not significantly different. The report notes limits, including that reviewers knew they were in a pilot. See the PSC report
Australian Public Service trial	More than 2,100 public servants shortlisted candidates for a hypothetical role, with some applications anonymised	The summary advises caution before assuming that blind review improves diversity outcomes. See the Australian government report summary

Do not read these results as proof that blind screening never helps. They show that effects depend on context, on who reviews and on what else changes. They also show that removing details does not remove all bias. A fair process needs several controls.

What you can hide, and what it does

Detail	Why consider hiding it	Limit
Name	May signal sex, ethnicity or origin	Sometimes needed to match records later
Photo	Shows face, age, sex, ethnicity, disability	Rare in US and UK CVs; common in some countries. Better not requested at all
Address or postcode	Can signal class, race or origin	Location may matter for a commute or legal reasons
Date of birth and graduation years	Signals age	Years of experience may still show age
Gender, marital status, nationality	Protected or sensitive traits	Should not be in an application at all
School and university names	Can signal class or background	Qualifications may be a real requirement
Hobbies, clubs, volunteer groups	May signal religion, politics or background	Can also show real skills
Employment gaps	May relate to caring duties, health or study	Hiding dates can hide useful chronology

Decide the list for each role. Hide only what you do not need for the first pass. Keep qualifications that are a legal or practical requirement. If a requirement uses a degree, state exactly which one and why.

How to run blind screening in six steps

Step 1: Write the criteria first

Blind review needs clear criteria. Without them, reviewers use their own guesses. Write three to five must-haves that can be checked on a CV. See must-haves vs nice-to-haves.

Step 2: Choose who removes the details

Use someone who is not on the review panel, or software that can hide fields. A person who redacts must work carefully and consistently. Give them a one-page rule list. If you use software, test it on five CVs to see what it misses.

Step 3: Create a clean review copy

Give each applicant a code instead of a name, for example A-014. Keep a private key that links the code to the applicant. Store the key separately and give access only to the person who needs it.

Step 4: Review with an evidence sheet

Reviewers mark each must-have as yes, no or unclear, and note the CV passage that supports it. They do not judge writing style beyond the clarity needed for the job.

Step 5: Reveal at a fixed point

Reveal identity only after the shortlist is chosen. Record the date. Do not go back and change scores after the reveal.

Step 6: Check the result

Compare pass rates by stage with and without blind review where the law allows monitoring. Ask reviewers whether the blind copy gave enough information. Adjust the list of hidden details after the first search.

Redaction checklist

Item	Done?
Name replaced by a code
Photo removed
Address reduced to a general area, or removed
Date of birth, age, graduation years removed (where not needed)
Gender, marital status, nationality fields removed
Names of clubs or groups that signal protected traits removed
Contact details removed
Links to social profiles removed
File name and document properties cleaned (they can contain names)
Key stored separately

Where hidden details leak back in

• Proxies. A school, a language, an interest or a postcode can still point to a person’s background.
• Writing style. Spelling variants, phrases and format can hint at origin or age.
• Work history dates. A long career shows age even without a birth date.
• Narrative details. “Returned after parental leave” or “managed my disability” tell the reviewer something personal.
• Reviewer familiarity. In a small field, the reviewer may recognise the person from the work.

You cannot remove all of these without removing useful information. Aim for a reasonable first pass and combine it with the other controls. Do not ask applicants to remove factual information about their careers. Do not penalise people who include details.

Legal and data protection notes

Blind review does not replace anti-discrimination law. You must still not decide on protected characteristics at any stage. In the UK, the Acas page on recruitment explains fair process. In the US, the EEOC describes prohibited practices on its page about prohibited employment policies and practices. In the EU, equal treatment is set by directives and national laws; see Directive 2000/78/EC and Directive 2000/43/EC. The key list that links codes to names is personal data. In the UK and EU, apply data protection rules: limit access, keep it secure and delete it on schedule. See the ICO employment guidance.

A worked example (fictional)

This example is invented. A company receives 160 applications for an analyst role. The recruiter writes four must-haves and a one-page redaction rule list. An assistant who is not on the panel replaces names with codes, removes photos and addresses, and deletes graduation years. Two reviewers use an evidence sheet. After the first pass they compare 15 CVs they both reviewed. They disagree on three. The disagreements are all about “uses data tools”, where the CV wording was unclear. They rewrite the criterion to say which tools count, and re-score. They shortlist 18 applicants, reveal the identities, and invite 12 to a screen. The recruiter records the pass rate at each stage. After the search she sees no pattern she cannot explain, but she also notes that two reviewers said they missed the context of university projects. She decides to keep university names visible in future rounds, because the role accepts graduates. The test taught her which details matter for this role.

When blind screening fits, and when it does not

Situation	Fit	Comment
High-volume roles with clear criteria	Good	Easier to redact and compare
Roles where a licence or degree is mandatory	Partly	Keep the legal requirement visible
Small teams where reviewers know the field well	Limited	Reviewers may recognise people
Roles that need a portfolio or public work	Limited	Work samples show identity; use work sample review instead
Internal moves	Limited	People are known; use structured evidence instead

Blind screening is easy to explain and cheap to try. Try it on one search and measure. If it removes a source of doubt for your team, keep it. If it adds work with no benefit, drop it and put the effort into criteria, evidence and checks.

Alternatives and additions to hiding details

If hiding details is hard in your setting, other controls address similar risks. They also work well alongside blind review.

Control	What it does	Effort
Evidence sheet with a CV passage for each yes	Directs attention to what the CV shows about each must-have	Low
Work sample, scored without names	Gives direct evidence of a skill; can be scored anonymously	Medium. See work sample tests
Structured interview with the same questions	Makes later stages comparable	Medium. See structured interviews
Two reviewers on a sample	Finds inconsistent marking	Low
Outcome monitoring where the law allows	Finds patterns you cannot see in single decisions	Medium
Clear, job-related criteria	Removes guesswork	Low. See checkable requirements

Tools that show each job requirement next to the exact CV passage that supports it follow the same logic: they draw the reviewer’s attention to evidence. FastHire is being built on that approach. It is coming soon, it does not rank, score or reject candidates, and people make every decision.

What to tell candidates

Be open about your process. In the job ad or the privacy notice, say whether you review applications without names at the first stage. Explain why you ask for the information you collect and when you will see it. If you collect diversity or monitoring data, say it is separate from the hiring decision and optional where the law allows. Candidates trust a process that is explained, and they can ask for adjustments if they need them.

Do not claim that your process removes bias. Say that you use several controls to reduce it. Overclaiming harms trust if a candidate later finds a gap.

Questions to ask before you start

1. What problem are we trying to solve: names, school, age, or something else?
2. Which details are not needed for the first pass?
3. Who will redact, and how will we check their work?
4. How will we reveal the details, and when?
5. How will we measure the effect, and what will we do if we see no change?
6. Who owns the key that links codes to names, and how long will we keep it?

Write the answers in one page. If you cannot answer them, delay the pilot until you can. A small, well-planned test teaches more than a large, loose one.

Frequently asked questions

What is blind CV screening?

It is a method where identity details such as name, photo and address are hidden from the first reviewer, so that they judge skills and evidence.

Does blind recruitment increase diversity?

Public trials give mixed results. It may help in some settings and not in others. Test it in your own process and combine it with other controls.

Is blind screening legal?

Yes, as a process choice. You must still follow anti-discrimination and data protection laws. This is general information, not legal advice.

What should I hide?

Only what you do not need for the first pass: name, photo, address, date of birth, graduation years and similar details. Keep qualifications that are a real requirement.

Can software do blind screening?

Some tools can hide fields. Test what they miss, and keep people in charge of the decision.

Related guides

• Hiring guides for fair and compliant hiring
• How to reduce bias in resume screening: 15 practical steps
• Structured screening: how to compare every applicant on the same evidence
• Must-haves vs nice-to-haves
• All hiring guides for employers
• Adverse impact and the four-fifths rule explained
• Race, ethnicity and national origin in hiring: what the law says
• How to run an inclusive sourcing process

This is general information, not legal advice.

An applicant privacy notice is a short page that tells candidates who you are, what data you collect, why, who sees it, how long you keep it and what rights they have. This guide lists every item to include and gives a template you can adapt, with notes for the UK, the EU and the United States.

Who needs a notice

In the UK and EU, GDPR requires you to give people information about how you use their personal data. This is often called a privacy notice or fair processing notice. If you collect data directly from the applicant, you give the information when you collect it. If you get data from another source, such as a recruiter database or a public profile, you generally give the information within a reasonable time and at the latest within one month. See Articles 13 and 14 of the GDPR, and the Information Commissioner’s Office guidance on recruitment and selection.

In the United States there is no single federal privacy notice rule for applicants. Some states do have rules. For example, California privacy law gives job applicants certain rights and notice requirements. Rules change, so check the official sources for each state where you hire. Many US employers publish a notice anyway, because it builds trust and prepares them for new rules.

What to include

Item	What to write	Notes
1. Who we are	Company name, address and contact for privacy questions	Add the data protection officer if you have one
2. What data we collect	CV, contact details, work history, education, answers to questions, interview notes, test results	Say where it comes from: the candidate, referees, recruiters or public sources
3. Why we use it	To assess applications, run interviews, decide, make offers and meet legal duties	Separate the purposes. Mention monitoring and talent pools if used
4. Lawful basis (UK and EU)	Steps before a contract, legitimate interests, legal obligation, consent for talent pools	Match the basis to each purpose
5. Who sees it	Hiring team, HR, software providers, referees, background check providers with consent or legal basis	Name categories of recipients
6. Transfers abroad	Say if data goes outside the UK or EU and what protection applies	Ask your software providers where data is stored
7. How long we keep it	A specific period for each group of records	Do not write “as long as necessary” alone
8. Rights	Access, correction, deletion, restriction, objection and, where relevant, data portability	Say how to make a request and how fast you reply
9. Complaints	The right to complain to the data protection regulator	Name the regulator for your country
10. Automated tools	Say if software supports screening or decisions and how a person reviews the outcome	Be specific and honest
11. Is the data required?	Say what happens if the candidate does not give information	Example: without a CV we cannot assess the application

A template you can adapt

Copy the text below into your application page and replace the words in square brackets. This is a template. It is not legal advice, and your facts may differ.

How we use your information when you apply
[Company name] (“we”) is responsible for your information. You can contact us at [email] with any question about this notice.
What we collect: your name and contact details; your CV or resume; your work history, education and skills; your answers to our questions; notes and scores from interviews and tests; and information from referees, if you give us their details and we have told you before we contact them.
Why we use it: to read and assess your application for [role], to invite you to interviews, to decide who to offer the job to, to make an offer, and to meet legal duties. We rely on [steps before entering a contract and our legitimate interest in running a fair recruitment process].
Who sees it: the people involved in hiring for this role, our HR team, and the providers that supply our recruitment software. They may only use your information for our purposes. [We store data in the country or region of storage.]
How people make decisions: [People make all decisions about who to interview and hire. Our software may highlight text in your CV that matches the job requirements, but it does not reject or rank you. / Describe any other tools and how a person checks the result.]
How long we keep it: if we do not hire you, we delete your application [number] [months] after the process ends, unless you agree that we may keep it for future roles. If you agree, we keep it for [number] [months] and ask again before then.
Your rights: you can ask us for a copy of your information, ask us to correct it, ask us to delete it in some cases, and object to some uses. Write to [email]. We reply within [one month] [or the period required by law]. You can also complain to [name of regulator and website].
If you do not give us the information we ask for, we may be unable to consider your application.

Notes for each region

United Kingdom

Name the Information Commissioner’s Office as the regulator. UK law uses “UK GDPR”. The Data Protection Act 2018 adds rules, for example on criminal offence data and special category data. If you ask for criminal record checks, they are limited by law and by the role.

European Union

Name the national authority for the country of your main establishment, and mention that candidates can complain in their own member state. Local labour law may add rules on retention and on what you may ask in interviews. The European Data Protection Board publishes guidance.

United States

Include a short statement of what you collect and why, and whether you sell or share data. Check state laws if you hire in places with comprehensive privacy rules. Employers that use automated employment decision tools in some cities may also need to give notice, for example in New York City. See the city guidance on automated employment decision tools, and our guide to Local Law 144 when it is available.

Where and how to show it

• On the application page, with a clear link above the submit button. A link in a footer is not enough.
• In the confirmation email, with a link to the full notice.
• In job adverts on third-party boards, with a link to your notice where you can.
• In plain text, not only in a PDF. Many candidates apply from a phone.
• In the local language of the candidate where you hire in that country.

Writing tips

1. Use “we” and “you”. It is clearer than “the data controller” and “the data subject”.
2. Write short sentences. Aim for fewer than 20 words.
3. Use a table or short sections. People scan.
4. Avoid vague words. Replace “may” and “from time to time” with real examples.
5. Test with a colleague outside HR. Ask them what you do with their CV. If they cannot say, rewrite.
6. Keep a version history. Note the date and what changed, so you can show which notice a candidate saw.

Mistakes to avoid

Mistake	Why it is a problem	Fix
Copying a notice from another company	It describes their processes, not yours	Write from your own data map
Saying “we keep data as long as necessary”	Candidates and regulators expect a clear period	Give a specific time for each record type
Hiding the notice in the footer	Applicants cannot see it before they submit	Place it next to the form
Describing a feature that you do not use	The notice becomes untrue	Review with the recruiters who use the system
Promising never to share data, while using many providers	This is untrue and risky	Name categories of recipients

FastHire is being built to support a clear and open process. It shows each job requirement next to the exact CV passage that supports it. People make every decision. FastHire does not rank, score or reject candidates, and it is coming soon.

Layered notices: a short summary and a full text

Long notices go unread. A layered format helps. The first layer is a box of five or six lines next to the form. The second layer is the full notice, one click away. Both layers must agree with each other and with what you do.

Layer	Content	Length
Layer 1: summary box	Who we are, why we use your data, who sees it, how long we keep it, how to see or delete it, link to full notice	About 60 to 100 words
Layer 2: full notice	All items in the table above, with headings	One to two pages
Layer 3: just-in-time messages	A short line next to sensitive questions, such as “This question is optional and is used only for monitoring”	One sentence

Here is a fictional example of a layer 1 box: “We use your CV and answers to assess your application for this role. Our recruiting team and our software provider can see them. If we do not hire you, we delete your data after six months unless you ask us to keep it. You can ask to see, correct or delete your data at any time. Read the full notice.” The six months in this example is invented. Choose your own period on advice for your country.

Review checklist before you publish

1. Does every data type in the notice match a field in the form and a field in the system?
2. Does every tool that touches applicant data appear in the list of recipients?
3. Is each retention period real, and does the system enforce it?
4. Does the notice say what happens if a candidate refuses to give an optional item?
5. Has someone who does not work in HR read it, and could they explain it back?
6. Is there a named person who updates it when the process changes?

Put a calendar reminder to review the notice every six months. Also review it when you add a country, change a vendor or turn on a new automated feature. Keep the older versions with dates.

One last point on tone. A privacy notice is also a message to candidates about how you treat people. Plain, honest wording shows respect, and it is easier to defend than clever wording. If a sentence could be read two ways, choose the plainer way and cut the rest.

Frequently asked questions

Is a privacy notice the same as a cookie banner?

No. A cookie banner is about cookies on your website. An applicant privacy notice is about how you use the data of people who apply for jobs. You may need both.

Do I need candidate consent to process their application?

Often no. In the UK and EU, other lawful bases can apply. Consent is common for talent pools and for optional questions. See our guide to GDPR for job applicants.

How long should a notice be?

As short as possible while covering the required items. A layered format works well: a short summary with a link to the full text.

Do I need to update the notice when I change software?

Yes, if the change affects what data you collect, who receives it, where it is stored or how decisions are supported.

Does a US employer need this notice?

There is no single federal rule, but state laws may require a notice. Check the states where you hire, and consider a notice as good practice.

Related guides

• Hiring guides for fair and compliant hiring
• GDPR for job applicants: what employers must do
• Applicant tracking system compliance checklist: GDPR and US records
• EU AI Act and hiring tools
• All hiring guides for employers
• How long to keep rejected applicant data
• How to handle candidate data requests under GDPR

This is general information, not legal advice.

Under the UK and EU GDPR, you may collect and use applicant data only for clear, fair purposes, you must tell applicants what you do with it, you may keep it only as long as needed, and applicants have rights to see, correct and in some cases delete it. This guide explains the main duties in plain language and gives a working checklist.

What counts as applicant data

Personal data is any information about an identifiable person. In hiring it includes the CV, cover letter, contact details, answers to screening questions, test and assignment results, interview notes, scorecards, emails, references, and any score or flag attached to a record. Notes written by your hiring managers about a candidate are personal data about that candidate.

GDPR applies when you are established in the EU or UK, and in some cases when you recruit people located there. The UK has its own version, the UK GDPR, with the Data Protection Act 2018. The two are similar in structure but are separate laws, so UK and EU rules can differ over time. Read the official texts: the EU General Data Protection Regulation, the guidance of the European Data Protection Board, and the UK Information Commissioner’s Office pages on recruitment and selection.

The seven principles, applied to hiring

Principle	What it means	Hiring example
Lawfulness, fairness and transparency	Have a lawful basis, treat people fairly, and be open about what you do	Publish an applicant privacy notice on the application page
Purpose limitation	Use data only for the purpose you stated	Do not add applicants to a marketing list without a lawful basis
Data minimisation	Collect only what you need	Do not ask for date of birth or a photograph by default
Accuracy	Keep data correct and up to date	Let candidates correct their details and fix errors quickly
Storage limitation	Keep data no longer than necessary	Delete declined applications on a set date
Integrity and confidentiality	Keep data secure	Use access by role, strong sign-in and secure sharing
Accountability	Be able to show how you comply	Keep a record of your decisions, notices and retention schedule

Step 1: Choose a lawful basis

GDPR gives six lawful bases. Three are common in hiring.

• Steps before entering a contract. Processing is needed to consider the application, for example to read the CV and invite the person to interview.
• Legitimate interests. You have a real business interest, such as running a fair recruitment process, and the use of data is balanced against the rights of the applicant. Write a short assessment to show the balance.
• Consent. The person freely agrees to a specific use, for example to be kept on a talent list. Consent must be easy to withdraw. Because applicants may feel pressure to agree, avoid relying on consent for the main process.

Legal obligation can also apply, for example when you must check the right to work. Choose the basis for each purpose and write it down. Different purposes can have different bases. This is general information, and a data protection adviser can confirm the best fit for your case.

Step 2: Tell applicants what you do

Give applicants a privacy notice at or before the time you collect data. It should be short and clear. It should list who you are and how to contact you (and your data protection officer, if you have one), what data you collect and from where, why you use it and the lawful basis, who receives it (for example your applicant system provider), whether data goes outside the UK or EU, how long you keep it, the rights people have, and how to complain to the regulator. If you use automated tools, say so. Our applicant privacy notice template gives wording you can adapt.

Step 3: Collect less

Review your application form field by field. Ask of each field: do we need this to decide who to interview? If the answer is no, remove it, or move it to a later stage and ask only the finalists. For example, you do not need a home address to read a CV, and you do not need bank details until you make an offer. Collecting less lowers risk and reduces the work of protecting and deleting data later.

Special category data

Some data has extra protection: health, ethnicity, religion, sexual orientation, trade union membership, political opinions, and genetic and biometric data. You need both a lawful basis and a special condition to process it. In hiring, the most common case is equal opportunities monitoring, where you ask applicants to share data on a voluntary basis. Keep it separate from the people who make hiring decisions, explain the purpose, and make it clear that answers are optional. Criminal offence data has its own rules too, and checks are limited by national law.

Step 4: Set retention periods

Decide how long you keep each type of record, and why. For declined applicants, many employers choose a short period linked to the time in which a claim could be made, but the right figure depends on the country and your risk. Write the figure in your notice and apply it. If you want to keep CVs for future roles, ask for consent and renew it after a fixed time. Our guide to applicant data retention goes deeper.

Step 5: Respect applicant rights

Right	What applicants can ask	Practical step
Access	A copy of the personal data you hold and information about its use	Know where data lives. Reply within the legal time limit, which is generally one month, with possible extension. Check the official text.
Rectification	Correct inaccurate data	Allow edits, and fix mistakes in notes and records
Erasure	Delete data in certain cases	Be able to delete a candidate from the system and from other places
Restriction and objection	Limit or object to some uses	Have a route to review the request
Not to be subject to solely automated decisions	A person should be involved where decisions have legal or similarly significant effects	Keep a person in charge of each hiring decision. See our guide to GDPR Article 22 in hiring.

Create a one-page procedure: who receives the request, who checks identity, who gathers the data, who reviews it for other people’s information, and who replies. Practice with a dummy request. Interview notes are included in an access request in many cases, so write them as if the candidate may read them.

Step 6: Be careful with automation

If you use software that sorts, scores or filters applications, GDPR adds duties: transparency, a lawful basis, fairness, and in some cases a data protection impact assessment. See our guide on data protection impact assessments for hiring tools. The EU AI Act also treats some hiring systems as high risk. We do not give dates here. Check the official text, and read our overview of the EU AI Act and hiring tools.

FastHire is being built around a simple idea: show each job requirement next to the exact CV passage that supports it, so a person can check the evidence. FastHire is coming soon. It does not rank, score or reject candidates. People make every decision.

A GDPR applicant checklist

Check	Done?
Lawful basis chosen and recorded for each purpose
Applicant privacy notice shown on the application page
Application form reviewed, extra fields removed
Special category data collected only where needed, separated and optional
Retention period set for each record type
Process for access, correction and deletion requests tested
Data processing agreement signed with each software vendor
Access limited by role, strong sign-in turned on
Automated tools identified, with a person deciding in each case
Impact assessment considered for high-risk tools

Mistakes to avoid

• Treating the CV as public because the candidate sent it. You are still responsible for how you use it.
• Using one global notice for every country. Review rules for the UK and each EU country where you hire.
• Keeping CVs “for future roles” without asking. Ask, and set a time limit.
• Searching social media profiles without a clear reason. Public information is still personal data, and it can reveal protected details.
• Emailing CVs to managers. Share through the system, and remove attachments from inboxes on a schedule.

Which lawful basis for which task: a worked example

This fictional example shows how one hiring process can use different bases for different tasks. A small company in Ireland hires a project coordinator. It is invented for illustration. It is not advice for any real case.

Task	Possible basis	Reason to write down
Read the CV and invite people to interview	Steps before entering a contract, or legitimate interests	Needed to consider the application
Run a short skills exercise	Legitimate interests	Fair way to compare applicants on the same task
Ask all applicants to complete an optional equal opportunities form	Consent for voluntary special category data, with a lawful basis for monitoring	Optional, separate from decision makers
Keep the CV of a declined applicant for six more months for future roles	Consent	The applicant said yes and can withdraw
Check the right to work of the person who gets the offer	Legal obligation	National law requires the check
Contact referees	Legitimate interests, after telling the candidate	Tell the candidate and ask before you call

Notice what the table does not say. It does not say that the company can use any data for any purpose because the applicant sent a CV. Each purpose has its own reason, and each reason is recorded where the team can find it. When a regulator, a candidate or a manager asks why you hold a piece of data, the answer comes from the table, not from memory.

A short note on international teams

If your recruiters sit in one country and the candidates in another, ask three questions. Where is the data stored? Who can access it from other countries? Which law applies to the candidate? The answers decide which notice you show and which transfer tools you need. Keep a simple map: one line per tool, with country of storage and the vendor agreement. Update it whenever you add a new tool or move a team. A current map is often the first thing an auditor asks to see.

Frequently asked questions

Does GDPR apply if I only hire a few people a year?

Yes. The size of your hiring does not exempt you. Smaller organisations can use simple tools, but the principles still apply.

Can I keep a CV from a rejected candidate?

Only for as long as you can justify. If you want to keep it for future roles, ask the person and set a review date.

Do I need a data protection officer?

Only in specific cases, such as large-scale monitoring or processing special category data on a large scale. Your national regulator and the official text explain when. Even if you do not need one, name a person responsible.

Can I use LinkedIn to find candidates?

Yes, but you must still tell people how you got their data and what you do with it, usually within a month, and use it only for the stated purpose. Read the official guidance for your country.

What if the candidate lives in the EU but my company is in the US?

GDPR may still apply in some cases when you target people in the EU. Ask a data protection adviser about your situation.

Related guides

• Hiring guides for fair and compliant hiring
• Applicant tracking system compliance checklist: GDPR and US records
• EU AI Act and hiring tools
• How to reduce bias in resume screening
• All hiring guides for employers
• Applicant privacy notice: what to include, with a template
• Data protection impact assessments for hiring tools
• Criminal record checks in hiring: fair practice by country
• How to handle candidate data requests under GDPR

This is general information, not legal advice.

Article 22 of the GDPR gives people a right not to be subject to a decision based solely on automated processing, including profiling, where the decision has legal or similarly significant effects. In hiring, a decision to reject someone with no human involvement can fall under it. The safest approach is to make sure a real person weighs the evidence and makes each decision.

What Article 22 says

Paragraph 1 of Article 22 in the GDPR gives the data subject the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them. The recitals of the regulation mention, as an example, the automatic refusal of an online credit application and e-recruiting practices without any human intervention.

Paragraph 2 lists three exceptions: the decision is necessary for entering into or performing a contract; it is authorised by law that sets safeguards; or it is based on the explicit consent of the person. Where the first or third exception applies, paragraph 3 requires safeguards, at least the right to obtain human intervention, to express a point of view and to contest the decision. Paragraph 4 sets stricter limits where the decision uses special category data, such as health or ethnicity.

The articles on transparency also matter. People must be told about the existence of automated decision-making, including profiling, and given meaningful information about the logic involved and the significance and expected consequences. The European Data Protection Board publishes guidelines on automated individual decision-making. UK rules have been changed by recent legislation, so read the Information Commissioner’s Office pages on automated decision-making for the current position.

Does it apply to my hiring process?

Ask two questions. First, is the decision based solely on automated processing? Second, does the decision have legal or similarly significant effects on the person? A decision to refuse a job application usually has a significant effect. So the key question is the first one: is there meaningful human involvement?

Situation	Likely position	Why
A tool automatically rejects applicants below a threshold, and nobody looks at the rejected ones	Likely solely automated	No human decides
A tool ranks applicants and a recruiter reads the top 20 only, never opening the rest	Needs careful assessment	The ranking may effectively decide who is considered, so the human step may not be meaningful
A tool highlights evidence in each CV and a reviewer reads every CV and decides	Human decision	The person weighs the evidence and decides
A tool schedules interviews	Not a hiring decision	No evaluation of the person
A chatbot asks knock-out questions and ends the application if an answer is “no”	Likely solely automated if no person reviews	The answer to a rule decides the outcome

The EU Court of Justice has held, in a case about credit scoring, that producing a score can itself be an automated decision where a third party relies strongly on it to decide. The reasoning may be relevant if a hiring manager follows a tool’s score without further thought. Read the court’s judgment and the regulator’s guidance for the exact reasoning, and ask a specialist how it applies to your tools.

What makes human involvement meaningful

Regulators expect more than a click on “approve”. A human step is more likely to count when the reviewer has authority and competence to change the outcome, has access to all the relevant information including the original CV, actually considers the evidence, and the tool’s output is only one input. Use the checklist below to test your process.

Test	Meaningful	Not meaningful
Reviewer authority	Can overturn the tool and often does	Never overrides, or is discouraged from doing so
Information	Sees the full CV and the job requirements	Sees only a score or label
Time	Has time to read	Approves hundreds a minute
Evidence	Writes a reason tied to the CV	Types “ok” or leaves no note
Training	Understands what the tool does and its limits	Has not been told how it works
Audit	The team checks a sample of decisions	Nobody checks

Practical steps

1. List every tool that touches applications. Include chatbots, parsers, screening tools and scheduling tools.
2. Classify each tool. Does it only help a person, or does it decide? Describe in one sentence.
3. Remove automatic rejections. Replace them with a review step, where a person reads the evidence.
4. Show the evidence to the reviewer. A tool that shows the exact CV passage behind each mark makes human review practical.
5. Tell applicants. In your applicant privacy notice, say which tools you use, and how a person reviews outcomes.
6. Offer a route to human review. Give a contact point for applicants who want a person to check the decision.
7. Train reviewers. Explain what the tool can and cannot do, and tell them they are expected to disagree with it when the CV says so.
8. Check samples. Review a sample of tool-assisted decisions each quarter to see if reviewers follow the tool without thought.
9. Do an impact assessment. See data protection impact assessments for hiring tools.

If you rely on an exception

Some employers rely on explicit consent or on contract necessity for limited automated steps, such as an eligibility check against a legal requirement. If you do, document the exception and the reason. Consent for an application process is hard to rely on because applicants may feel they have no real choice. Contract necessity is read narrowly; a regulator may ask whether a person could do the step. For decisions that use special category data, the exceptions are tighter still. Ask a specialist before you use an automated rejection step in the UK or EU.

Beyond GDPR: other rules to know

• EU AI Act. Some AI systems used in hiring are treated as high risk, with duties on providers and on employers who use them. We do not state dates here. Read the official text and our overview.
• United States. There is no general automated decision right. Some state and city laws apply, such as New York City rules on automated employment decision tools. Federal equal employment law still applies to results from any tool.
• United Kingdom. Equality Act duties apply to outcomes from tools just as they do to human decisions, and data protection rules on automated decisions are in change. Check current ICO guidance.

FastHire is designed so that a person makes each decision. It shows each job requirement next to the exact CV passage that supports it, which gives the reviewer the evidence in one view. FastHire does not rank, score or reject candidates. It is coming soon.

A worked example (fictional)

A retailer in the Netherlands receives 1,800 applications for seasonal warehouse roles. This case is invented to show the reasoning. The company considers two designs.

Design	What happens	Article 22 view
A. Automatic cut-off	A tool compares answers with the requirements and removes everyone below a threshold. Recruiters read only the rest.	High risk. Rejections are made without a person. Needs an exception, safeguards and a DPIA, or a redesign.
B. Evidence view	A tool highlights where each requirement appears in the CV. Two recruiters read every application with the highlights, using a shared sheet, and decide. They can overrule the highlights.	A person decides on all applications. The tool is a support, not the decision-maker.

The company chooses design B. It writes the review steps in the process document, tells applicants in the notice that software highlights CV text and that people decide, and adds a contact for questions. It takes a sample of 50 decisions each quarter and checks that recruiters sometimes overrule the highlights, which shows that the review is active. If recruiters never disagree with the tool, the company asks why.

Template: wording for applicants

How we use software when we read applications
We use software to help our recruiters find the parts of your CV that relate to the job requirements. The software does not decide who we interview or hire. A recruiter reads every application and makes the decision.
If you would like a person to review the outcome of your application, write to [email]. We will reply within [period].

Only write this wording if it is true. If you use a tool that does more, describe it honestly and ask a specialist to review.

Questions to ask your software vendor

• Does any feature reject, rank, score or remove applicants without a person acting? Can we turn it off?
• Can the reviewer see the underlying CV and the reasons for any mark?
• Do you record when a reviewer agrees or disagrees with the tool? Can we export that record?
• Do you provide documents to support our impact assessment?
• Which of your features does the EU AI Act regulate as high risk, and what do you provide to help us?

Keep the answers in writing. If a vendor cannot explain a feature in plain language, you cannot explain it to an applicant or a regulator.

Documenting your position

Keep a short record for each tool that supports hiring. It should say what the tool does, whether it makes any decision on its own, who reviews the output, what the reviewer can see, how often reviewers disagree, and who checked this and when. This record is useful for three readers. A regulator can use it to see how you reached your view. An applicant who asks a question can get a clear answer. And a new recruiter can learn how the process is meant to work.

Review the record when the tool changes, which can happen without notice when a vendor updates a feature. Ask vendors to tell you in writing before they add or change any automated step. A feature that was only a highlight last quarter may become a recommendation next quarter, and your notice and assessment would then be out of date.

A final practical tip: run a short drill each half year. Pick five recent applications at random and trace each from the CV to the decision. Ask the reviewer to show where in the CV the evidence sits and why they chose the outcome. If the reviewer cannot do this, or if the tool’s output seems to have decided the case, the human step needs strengthening. The drill takes under an hour and gives you real examples to use in training and in answers to any questions from applicants or regulators.

Frequently asked questions

Is a ranking of applicants an automated decision?

A ranking alone may not be a decision, but it can become one if people treat it as the outcome and do not look at lower-ranked applicants. Design the process so that people review the evidence for everyone who meets the stated requirements.

Can I use an automatic knock-out question?

Be careful. A knock-out question based on a legal requirement, for example a licence the law requires, is easier to defend than one based on a preference. Even then, offer a way for a person to review.

What should I say to an applicant who asks about automated decisions?

Explain which tools you use, what they do, and that a person makes each decision and can review their case. Give a contact point.

Do these rules apply to internal candidates?

Yes. Data protection rights apply to employees as well as external applicants.

Does Article 22 apply to employers outside the EU?

It can apply if GDPR applies to your processing, for example when you offer jobs to people in the EU. Ask a specialist about your case.

Related guides

• Hiring guides for fair and compliant hiring
• GDPR for job applicants: what employers must do
• Data protection impact assessments for hiring tools
• EU AI Act and hiring tools
• All hiring guides for employers
• New York City Local Law 144: bias audits for hiring tools
• How to handle candidate data requests under GDPR

This is general information, not legal advice.

There is no single legal answer to how long you may keep a rejected applicant’s data. In the UK and EU you must keep it no longer than necessary and be able to justify the period. In the United States you must keep hiring records for at least a minimum period set by law. The practical method is to set a period for each record type, tied to a stated reason, and to delete on a schedule.

The two pressures: delete and keep

Employers often feel pulled in two directions. Data protection rules in the UK and EU say you should not keep personal data longer than necessary. Equal employment rules in the US, and the wish to defend a possible claim, say you should keep enough to show how you decided. The way through is to keep what you need for a defined reason, for a defined time, and no more.

Region	Main rule	Source to read
EU	Storage limitation: personal data must be kept in a form that permits identification for no longer than necessary for the purposes	Article 5(1)(e) of the GDPR
UK	Same principle under the UK GDPR. The regulator expects a justified, documented period	ICO recruitment and selection guidance
US (federal)	Employers covered by federal equal employment laws must keep certain hiring records for a minimum period, and longer if a charge or claim is filed	EEOC recordkeeping requirements

The EEOC page states the minimum period and the circumstances that extend it. Read the current text and keep records at least that long. Federal contractors, public employers and some state laws can add longer periods or other duties. Confirm the position for your organisation with a specialist.

What to keep, by record type

Different records serve different purposes, so they can have different periods. The suggestions below describe the logic. They do not give a number, because the number depends on your country, sector and risk.

Record	Why you keep it	How to set the period
Application form and CV	To show who applied and what you saw	Tie it to the period in which a claim could realistically be brought in your country, and the US minimum where it applies
Screening notes or evidence sheet	To show the job-related reasons for the decision	Same period as the application
Interview notes and scorecards	To show a fair, comparable process	Same period as the application
Test or exercise results	To show what you assessed	Same period, or shorter if the test result has no further use
Reference responses	Part of the decision record	Same period as the application, if used
Equal opportunities monitoring data	To check the fairness of the process	Keep in a separate, protected file, with its own period. Anonymise when you can
Talent pool data (with consent)	To contact people about future roles	A fixed period, such as a year or less, then ask again. Choose your own
Offer and onboarding records for the person hired	To start employment	Move to the employee file and follow employee record rules

A seven-step method

1. List the record types. Use the table above. Add any you create, such as video interview files.
2. Find where each lives. Applicant system, email, shared drives, spreadsheets, calendar notes, paper.
3. Write the reason for keeping each type. If you cannot write a reason, you probably should not keep it.
4. Check the legal minimum. For US hiring, read the EEOC page. For other countries, look for local rules and ask an adviser.
5. Choose the period. Take the longer of the legal minimum and the shortest period you can justify. Record the date you decided and who approved it.
6. Put it in the notice. Tell applicants the period in your applicant privacy notice.
7. Automate and test. Use retention rules in your system, run a monthly report for exceptions, and test that deleted data is gone from lists, exports and backups.

Talent pools and “keep your CV for future roles”

Keeping a CV for a later role is a different purpose from assessing the current application. In the UK and EU, ask the applicant. Make the request separate from the application, with a clear “yes” or “no”. Say how long you will keep the CV and how to withdraw. Ask again before the period ends. Do not treat silence as consent.

A talent pool is only useful if it is current. Old CVs show past skills and may no longer match a person’s situation. Reviewing the pool once a year, and deleting what you do not use, supports both privacy and quality.

Handling deletion in practice

Delete from every place

• The applicant system. Use the delete or anonymise function, not only an archive status. Ask the vendor what archive means.
• Email. Search for the candidate’s name and delete attachments and messages when the period ends.
• Shared drives and chats. Remove copies of CVs and notes that managers saved.
• Spreadsheets. Keep trackers free of names or delete rows on schedule.
• Backups. Ask IT how long backups last. Document that deleted data will leave the backups on a known date, and make sure restored data is cleaned again.

Anonymise when you want to keep statistics

You can keep counts and rates without keeping identities. For example, keep “120 applications, 40 screened in, 10 interviewed” and delete the underlying records. True anonymisation means that nobody can identify a person from the data, including by combining it with other information. If a person can still be identified, the data is still personal data. Remove names, contact details and free text, and group small categories together.

Pause deletion when a claim or complaint exists

If a candidate has made a complaint or you have been told of a claim or an investigation, do not delete related records until you have advice. Mark the records with a hold. Document who placed the hold and when it ends.

A fictional example

This example is invented. A mid-sized company with offices in Germany and the United States uses one applicant system. The HR lead builds the schedule below with the legal adviser. The periods in brackets are placeholders that the adviser sets from local law.

Record	Germany	United States	Review owner
Declined application, CV and notes	[period set by adviser under German and EU law]	[at least the federal minimum, or longer if state or contractor rules apply]	HR lead
Talent pool with consent	[one fixed period, then ask again]	[one fixed period, then ask again]	Recruiter
Monitoring data	[period set by adviser]	[period set by adviser]	HR lead

The point of the example is the structure. Each row has an owner, each period has a source and each country is treated separately. If a manager asks “Why do we delete in one country and keep in another?”, the table and the adviser’s note answer the question.

Mistakes to avoid

• One period for every country. Rules differ. Use the strictest where you cannot separate data, and document the choice.
• Archive instead of delete. An archived record is still a stored record.
• Forgetting documents outside the system. Email is where many old CVs live.
• Deleting before the legal minimum in the US. Check first.
• No owner. Assign one person to run and report on the schedule every quarter.

FastHire is being built so that decisions rest on the exact CV passage that supports each requirement, with people making every decision. FastHire does not rank, score or reject candidates. It is coming soon. Whatever tool you use, the retention schedule above stays your responsibility.

Replying to a deletion request: a short template

Candidates sometimes write and ask you to delete their data. Reply within the time your law requires, and make the reply clear and kind. Adapt the text below to your case. If you must keep some records, say which ones and why, in plain words.

Hello [Name],
Thank you for your message. We have received your request to delete your application data for [role].
We have deleted [list: your CV, your contact details and our notes] from our recruiting system on [date].
[If something is kept: We must keep [short description] until [date] because [short reason, such as a legal duty to keep hiring records]. After that date we will delete it.]
If you have any questions, please write to [email].
Kind regards,
[Name]

A quarterly retention review

Once a quarter, one person runs the review. It should take under an hour once the system is set up.

Step	Question	Evidence
1	How many records passed their deletion date in the last quarter?	Report from the system
2	How many were deleted, and how many remain?	Report from the system, plus a spot check of 10 records
3	Are there records on hold? Is each hold still needed?	List of holds with owner and date
4	Have any new tools, countries or record types appeared?	Notes from recruiters and IT
5	Were there any requests from candidates? Were they answered in time?	Request log
6	Does the privacy notice still match what we do?	Read the notice side by side with the schedule

Write the result in two lines and file it with the schedule. If something is late, add an owner and a date. A short regular review is far more useful than a long audit once every few years.

How to explain the schedule to hiring managers

Managers keep their own notes and files, so they need to know the rules. Give them a one-page summary. It should say where to save notes, what not to write, how long records stay in the system, and who to ask when a candidate wants to see or delete data. Add one rule that is easy to remember: if it is about a candidate, it lives in the recruiting system and nowhere else.

Also tell managers what to do when they receive a CV by email from a friend or a referrer. They should forward it to recruiting, and recruiting adds it to the system with the source field set to referral. That way the record falls under the same schedule as every other application and the manager’s inbox does not become a hidden archive of personal data.

Frequently asked questions

Is six months a safe period to keep rejected applications?

There is no universally safe period. It depends on the country, the sector and the claims risk. In the US, check the federal minimum. In the UK and EU, choose and record a period you can justify.

Can I keep rejected applicants’ CVs in an email folder?

You can only keep them for the period you set, and email counts. Include mailboxes in your deletion routine, or store CVs only in the system.

What if a rejected candidate asks me to delete their data?

In the UK and EU, the request must be considered. You may refuse in some cases, for example if you need the data for a legal claim, and you should explain your reason. In the US, state laws may give some rights. Follow your procedure and ask an adviser if unsure.

Do the same periods apply to interns and contractors?

Often similar rules apply, but they depend on the status of the person and the country. Check with an adviser.

Should I keep the data of candidates who withdrew?

Treat withdrawn applications the same as declined ones unless the person agrees to be in a talent pool.

Related guides

• Hiring guides for fair and compliant hiring
• GDPR for job applicants: what employers must do
• Applicant privacy notice: what to include, with a template
• Applicant tracking system compliance checklist: GDPR and US records
• All hiring guides for employers
• How to build a talent pool with consent
• How long can you keep applicant data? US, UK and EU
• How to document hiring decisions so they stand up to review
• How to respond to a discrimination complaint from an applicant

This is general information, not legal advice.

Structured screening means judging every applicant against the same written, job-related criteria, and recording the evidence for each decision. You write the must-haves first, read every application for the same things, note the passage in the CV that supports each criterion and decide by a rule you set in advance. It is fairer because personal preference has less room, and it is easier to explain because the evidence is on paper.

What structured screening is

Screening is the step where you decide whom to take forward. It is often the least structured step in hiring, even in organisations that run structured interviews. A reviewer opens a CV, forms an impression in seconds and moves on. The impression may be influenced by a name, a photograph, a school, a gap in dates or the style of the layout. None of these show whether the person can do the job.

Structured screening replaces impression with a method. The method has four parts: criteria written in advance, a standard way of marking each criterion, a record of the evidence and a decision rule. The same idea sits behind structured interviews, which the US Office of Personnel Management describes as asking every candidate the same questions in the same order and scoring them on the same scale. See our guide to structured interviews. The principle is equal treatment on job-related grounds.

Why it supports fair hiring

• Equal treatment. Every applicant is read against the same list, so two similar CVs get the same outcome.
• Job relevance. If a criterion is not in the written list, it cannot decide the outcome. This keeps out proxies such as school names, employment gaps and age signals.
• Explainability. You can tell a candidate, a manager or a regulator which criterion was not met and where you looked.
• Consistency over time. Reviewers who are tired or rushed still follow the sheet.
• Better calibration. When two reviewers disagree, the sheet shows which criterion caused it, and you can fix the wording.

Structured screening does not guarantee fairness. Criteria can themselves be unfair, for example a requirement for a specific degree when the work does not need it. It is a tool that makes bias easier to see and correct.

The six steps

Step 1: Write the criteria from the role

Use the role brief. Choose three to five must-haves that someone can verify on a resume or CV. Test each one with two questions: does the job really need this on day one, and could a person show it in more than one way? If the answer to the second is yes, write the alternatives, for example “two years of customer support work, paid or unpaid” instead of “two years in a call centre”.

Step 2: Build a screening sheet

Column	Content
Application ID	A number for the first pass, if you can hide names
Criterion 1 to 5	Yes, no or unclear
Evidence for each yes	The exact CV passage, copied or paraphrased
Question to ask (unclear)	One neutral question that would settle it
Reviewer and date	For traceability
Decision	Move forward, hold or decline
Reason	The criterion not met, if declined

Step 3: Mark every application the same way

Mark	Use it when	Do not use it when
Yes	The CV clearly shows the criterion, with a passage you can point to	You assume it from a job title or a company name
No	The CV clearly shows the criterion is missing, or the applicant says so	The CV is silent. Use unclear.
Unclear	The CV could support the criterion but does not say, or is ambiguous	You simply dislike the style of the CV

Step 4: Ask before you decline on unclear

Send one short, neutral question to anyone with an unclear mark and no clear no. For example: “Your CV lists project work from 2022. Did it include managing a budget? A short reply is fine.” Give a date. Ask all unclear applicants the same question. This step often rescues strong candidates with short CVs.

Step 5: Decide by a rule

Write the decision rule before you screen. A common rule: invite everyone who has yes for every criterion. If you have more qualified people than you can interview, use a written, neutral tie-break, such as random selection among all who meet every criterion. Do not use hidden scores, impressions or the order in which you read applications.

Step 6: Check and record

Ask a second reviewer to check a sample, for example every tenth “no” decision. Keep the sheet. It is your record of job-related decisions. In the UK and the EU, the sheet is personal data about applicants, so protect it and delete it on schedule. The Information Commissioner’s Office explains the duties in its guidance on recruitment and selection.

An example: two similar CVs

This example is fictional. It shows how evidence changes the discussion. The role is Customer Support Assistant. The criteria are: one year of customer support work (paid, unpaid or volunteer), clear written English, comfort with new software.

Criterion	Applicant A	Applicant B
One year of customer support work	Yes. “Support agent, Brightside Pets, 2022 to 2024”	Yes. “Volunteer helpline adviser, 18 months, evenings”
Clear written English	Yes. Cover note is clear and organised	Yes. Short, clear CV and cover note
Comfort with new software	Yes. “Introduced a ticket tool for a team of four”	Unclear. Lists “quick learner” with no example
Action	Invite	Ask one question: “Can you give an example of learning a new tool?”

A reviewer who skimmed might have preferred A because of the paid job title. The sheet shows that B meets two criteria with evidence and has one open question. B gets the question, replies with a clear example and is invited. The structured sheet made the volunteer experience count as the criterion allowed. Note that the example is for illustration only.

What structured screening does not mean

• It does not mean rejecting people for one missing nice-to-have. Nice-to-haves are not criteria.
• It does not mean software decides. If you use software to find passages, a person still checks the evidence and decides.
• It does not mean ignoring context. If a CV shows the criterion in an unusual way, count it and write why.
• It does not mean you can skip legal rules. You must still avoid discrimination on protected grounds, make reasonable adjustments and protect data.

Legal anchors by region

Rules differ by country, so check the official sources for the places where you hire. In the US, the Equal Employment Opportunity Commission explains prohibited practices in selection on its page about prohibited employment policies and practices. In Great Britain, the Acas page on recruitment explains how the Equality Act applies, including to shortlisting. In the EU, equal treatment is set out in EU directives and national laws, and data protection rules apply to applicant data.

Common mistakes

• Writing criteria after seeing the applications.
• Using a vague criterion such as “strong communicator” that cannot be checked on a CV.
• Giving half marks. If you need a scale, use it in interviews. For screening, yes, no and unclear are enough.
• Not recording evidence. A tick with no passage cannot be reviewed.
• Changing the rule midway without telling everyone and re-applying it to all.

FastHire is being built around this method. It shows employers each job requirement next to the exact CV passage that supports it, and candidates check their fit before applying. FastHire is coming soon. It does not rank, score or reject candidates. People make every decision.

Turning vague requirements into checkable criteria

Vague requirement	Why it fails	Checkable version
Excellent communication skills	Cannot be seen on a CV and invites bias towards accent and style	Writes clear emails or reports. Evidence: cover note, work samples or a short written task for all candidates
Degree in business	Excludes people who learned the skill another way	Can prepare budgets and forecasts. Evidence: work, study or volunteering that shows it
Native English speaker	Points to national origin and is not a skill level	English at the level needed to write customer replies. State the level
5 years of experience	An arbitrary number that favours age	Has handled at least [number] customer cases a week in a past role, paid or unpaid
Team player	Vague and not verifiable on a CV	Has worked in a team on a shared outcome. Evidence: one example in the CV or answered question
Culture fit	Invites sameness and bias	Remove from screening. If values matter, define behaviours and test them in a structured interview
Recent graduate	Points to age	Early-career role, with up to [number] years of experience. Say what you will teach

Notice what changed. Each checkable version names a task, a result or a way to show evidence. It also allows several ways to meet the criterion. This helps both fairness and quality, because the person who can do the work has more ways to show it.

A five-question fairness test for each criterion

1. Is it job-related? Can you link it to a task or outcome in the role brief?
2. Is it necessary on day one? If you could teach it in a few weeks, it is a nice-to-have.
3. Is there more than one way to show it? If not, check whether the single way excludes people for reasons unrelated to the work.
4. Could it work as a proxy for a protected trait? Age, sex, race, religion, disability, family status or nationality may be signalled by schools, years, names, languages or gaps. If yes, rewrite it as a task.
5. Can you check it from the application? If not, test it later in a structured interview or work sample, for everyone.

If a criterion fails a question, rewrite it before you screen. If you must keep a requirement that affects some groups more than others, such as a licence required by law, note the reason in the role brief. We cover the legal ideas of disparate treatment and disparate impact in other guides in this section.

Handling special cases

Situation	What to do
Career break	Do not treat the gap as a negative. Ask only about the criterion, for example the relevant skills used in the last role.
Qualifications from another country	Compare the skills, not the name of the qualification. If you need a formal equivalence, use the official recognition service in your country.
Non-linear career path	Count relevant work wherever it happened, including freelance, volunteer or family business work.
CV in a different format or language	Read for the criteria. Offer a translation or an alternative way to apply where the role needs it.
Applicant states a disability or a need for adjustment	Do not use it in the decision. Provide the adjustment and apply the same criteria.
Internal applicants	Use the same criteria and the same sheet. Avoid assuming that you already know them.

Frequently asked questions

What is structured screening?

Judging every applicant against the same written, job-related criteria and recording the evidence for each decision, with a decision rule set in advance.

How is it different from reading CVs normally?

Normal reading relies on impressions. Structured screening uses written criteria, standard marks and recorded evidence, so that two reviewers can reach the same result.

What should I do about unclear applications?

Mark them unclear and send one short, neutral question to each, with a date for a reply. Decide after you receive the answers.

Can I use AI in structured screening?

Tools can help find passages, but a person should check the evidence and make the decision. Rules on automated decision making and on AI in hiring may apply in your country.

How long should I keep screening records?

Only as long as needed and according to the rules of your country. State the period in your applicant privacy notice.

Related guides

• Hiring guides for fair and compliant hiring
• Structured interviews: what they are and how to run one
• Screening at volume: a process for 500 applications
• How to screen applications quickly: a 20-minute method for small teams
• All hiring guides for employers
• How to reduce bias in resume screening: 15 practical steps
• How to write a screening call script
• Blind CV screening: does it work and how to do it
• Adverse impact and the four-fifths rule explained
• Disparate treatment vs disparate impact in hiring
• How to screen resumes against must-haves with evidence
• Age discrimination in hiring: wording, screening and examples
• How to write fair knock-out criteria

This is general information, not legal advice.

New York City Local Law 144 of 2021 applies to employers and employment agencies that use an automated employment decision tool (AEDT) for hiring or promotion decisions in the city. In outline, the tool must have had a bias audit within the year before use, a summary of the results must be public, and candidates and employees must receive notice. The city’s Department of Consumer and Worker Protection (DCWP) enforces the law.

What the law is

Local Law 144 is a city law. It does not ban automated tools. It sets conditions for using them: independent testing for bias, public information, and notice to the people affected. The city describes the requirements on its DCWP page on automated employment decision tools, which links to the law, the rule and a set of frequently asked questions. Read those documents; this guide is a plain-language orientation and not a substitute.

According to the city page, DCWP began enforcing the law and the rule on July 5, 2023. The page also records that DCWP held roundtables in May 2023 and clarified in June 2023 that the notice must be provided 10 business days before the tool is used. Rules and guidance can change, so check the page before you rely on this summary.

Who is covered

The law covers employers and employment agencies. Based on the city’s description, it applies where such a tool is used to make employment decisions about candidates or employees for jobs in New York City. Where the job is located matters. A company outside the city may be covered if the job is in the city. Remote roles raise questions that you should put to a lawyer.

What is an automated employment decision tool?

The law defines an AEDT using a few elements. In general, it is a computational process derived from machine learning, statistical modelling, data analytics or artificial intelligence that produces a simplified output, such as a score, classification or recommendation, and that is used to substantially assist or replace discretionary decision-making. The text of the law and the DCWP rule explain these words in detail, including what “substantially assist” means. Read them for your tool.

Tool example (generic)	Likely question to ask
A resume screening tool that ranks applicants by a score	Does the score substantially assist or replace discretionary decisions? Likely to be considered
A tool that highlights CV text next to job requirements for a person to read	Does it produce a score, classification or recommendation? If it only shows evidence and a person decides, ask a lawyer how the definition applies
A scheduling tool	Does it evaluate candidates? Probably not
A video interview tool that scores speech or facial features	Likely to be covered if it produces a score or recommendation that informs the decision
A job board that recommends jobs to candidates	The law concerns decisions about candidates, not job recommendations. Check the definition

This table gives questions, not legal conclusions. A tool’s design and your use both matter. Ask your vendor and your adviser.

The three main duties

1. A bias audit

The city page states that a tool may be used only if it has undergone a bias audit within one year before its use. The audit must be done by an independent auditor. The rule describes the calculations the audit must include; in general, these compare how the tool’s results differ between groups defined by sex and by race and ethnicity categories. Read the rule for the exact method and for how to treat small groups and intersectional categories. An audit report is not a guarantee that a tool is fair, but it is a legal condition of use.

2. A public summary

Information about the audit must be publicly available, and a summary of results must be posted. Check the rule for where it must appear and what it must show. Many employers link it from their careers page.

3. Notice to candidates and employees

Candidates and employees who live in the city must receive notice that a tool will be used, and DCWP guidance says to give it at least 10 business days before use. The rule lists what the notice contains, which includes information about the job qualifications and characteristics the tool will assess and, on request, about the data it uses. It also addresses how a person can request an alternative selection process or a reasonable accommodation where available. Read the rule text for the current wording.

What to do in practice

1. List every tool used in hiring and promotion for New York City jobs. Include screening, chatbots, video tools and assessments.
2. Classify each one. Does it produce a score, classification or recommendation? Does it substantially assist or replace human judgment? Write the reason.
3. Ask each vendor for an audit. Request the audit date, the auditor, the summary and the data it used. If the audit is more than a year old, it does not meet the condition for continued use.
4. Check the data in the audit. An audit that uses data from other employers may be allowed by the rule in some cases. Ask your adviser how it applies to you.
5. Publish the summary. Put it on a page that candidates can find, and keep a record of when it was posted.
6. Send the notice. Build it into the application flow or the invitation. Keep a record of when each notice was sent.
7. Set up an alternative route. Decide how a person can ask for another process or an adjustment, and who answers.
8. Train recruiters. They should be able to answer a candidate’s question about the tool and the notice.
9. Review each year. Put the audit date in a calendar with a reminder.

Enforcement and complaints

DCWP enforces the law. According to the city page, workers and others can file a complaint online, including about a missing audit, a missing audit summary or missing notices. The law and rule set the penalties; read them rather than relying on summaries. Treat a complaint as a chance to fix a process. Keep your records ready: tool list, audit reports, publication dates and notice logs.

Other laws that still apply

Passing a bias audit does not remove other duties. Federal anti-discrimination law covers decisions made with or without tools. The Equal Employment Opportunity Commission explains the statutes on its page on Title VII and the principles for selection procedures in 29 CFR Part 1607, the Uniform Guidelines. Enforcement priorities on disparate impact at the federal level have changed since 2025, but the statutes and state and city laws remain. Our guide to the four-fifths rule explains one common screening statistic and its limits.

Other places have their own rules, and new ones are being proposed. In Illinois and some other states, laws address AI in employment or video interviews. In the EU, the AI Act covers some hiring systems, and in the UK and EU, data protection rules on automated decisions apply. See our guides on GDPR Article 22 and the EU AI Act and hiring tools. Check the current position in each place you hire.

Questions for your vendor

• Do you consider your product an AEDT under Local Law 144? Why or why not?
• When was the latest bias audit, who did it, and where is the public summary?
• Which data did the auditor use? Can you share the full report under an agreement?
• Can we turn off any scoring or ranking function?
• Can you supply text for the candidate notice and support the alternative process?
• How will you tell us if the product changes in a way that affects the audit?

Our guide to choosing recruiting software includes 25 questions for vendors, several of them on automated features.

FastHire is being built to keep people in charge. It shows each job requirement next to the exact CV passage that supports it. FastHire does not rank, score or reject candidates. People make every decision. FastHire is coming soon, and we will publish our approach to fairness testing when it is ready.

A compliance log you can keep

A simple log helps you show that you followed the rules. Keep one row for each tool.

Tool	Used for	Counts as AEDT? (reason)	Audit date	Auditor	Summary link	Notice added to	Alternative route	Next review
Example screening tool (fictional)	Screening for NYC roles	Yes, produces a score used in decisions	Date	Auditor name	Link	Application page and invitation email	Email to a named contact	Date
Example scheduling tool (fictional)	Booking interviews	No, does not evaluate candidates	n/a	n/a	n/a	n/a	n/a	Date

Fill the log from your own facts. Have a lawyer check the classification column. Keep copies of notices as they appeared on the day. If a tool changes, update the log and ask the vendor whether the audit still applies.

Wording for a candidate notice (outline only)

The rule sets the required content, so check it. In plain terms, a notice should say that an automated tool will be used in the assessment, which job qualifications and characteristics the tool will assess, and how to ask for another process or an adjustment. It should also say how to ask about the data the tool collects. Keep it short and put it where candidates see it before they apply or are assessed. Have a lawyer approve the final text.

Notice about automated tools
We use [tool name], an automated tool, to help review applications for [role] in New York City. The tool looks at [qualifications and characteristics it assesses]. A person makes the final decision.
A summary of the latest bias audit is at [link].
If you would like us to use a different process, or if you need an adjustment, write to [email] at least [number] business days before [date].

Only use wording that matches the tool and your process. If the tool does more than the notice says, the notice is wrong.

Plan the timing too. If notice must be given before a tool is used, build it into your process early: in the job advert, in the application form or in the first email. Do not add the notice after the tool has already run. Also plan for what happens if a candidate asks for an alternative process. Decide who handles the request, what the alternative looks like, such as a manual review of the CV by two people, and how long it takes, so the candidate is not disadvantaged by asking.

Frequently asked questions

Does Local Law 144 apply to my company if we are outside New York City?

It can apply if the job is located in the city. Remote roles and mixed roles raise questions that a lawyer should answer.

Is a bias audit a legal guarantee of fairness?

No. It is a legal condition of use under the city law, and it measures differences in outcomes between groups. Other laws still apply to your decisions.

Do I need to give notice if a person makes the final decision?

The law applies to tools that substantially assist or replace discretionary decisions, so a human final step does not by itself remove the duty. Ask a lawyer how the definition applies to your tool.

Where can I find the official text?

On the DCWP page linked in this guide, which links to the law, the rule and the FAQ.

Do other US cities have similar laws?

Some states and cities have passed or proposed laws on AI in hiring. Check the official sources for each place where you hire.

Related guides

• Hiring guides for fair and compliant hiring
• Automated decisions about applicants under GDPR Article 22
• Data protection impact assessments for hiring tools
• The four-fifths rule in hiring
• All hiring guides for employers
• US law on AI and hiring: what employers should know

This is general information, not legal advice.

The four-fifths rule is a rule of thumb from US federal guidelines. It compares selection rates between groups: if the rate for one group is less than four-fifths (80 percent) of the rate for the group with the highest rate, enforcement agencies will generally regard it as evidence of adverse impact. It is a screening signal, not proof of discrimination and not a legal safe harbour.

What adverse impact is

Adverse impact, also called disparate impact, happens when a rule or test that looks neutral selects members of one group at a much lower rate than members of another group. A requirement can look fair on its face, and still exclude more people from a protected group. The question is then whether the requirement is job-related and necessary, and whether a less exclusionary alternative exists.

The US Equal Employment Opportunity Commission describes this in its page on employment tests and selection procedures: neutral tests that disproportionately exclude a protected group can violate federal law unless they are job-related and consistent with business necessity. For the difference between disparate treatment and disparate impact, see our guide on disparate treatment vs disparate impact.

Where the four-fifths rule comes from

The rule appears in the Uniform Guidelines on Employee Selection Procedures, which US federal agencies adopted. The text of 29 CFR 1607.4 says that a selection rate for any race, sex or ethnic group that is less than four-fifths (or 80 percent) of the rate for the group with the highest rate will generally be regarded as evidence of adverse impact. It adds that smaller differences may still constitute adverse impact if they are significant in both statistical and practical terms, and that greater differences may not count where they are based on small numbers and are not statistically significant.

So the rule is a first screen. It tells you where to look. It does not give a verdict.

How to calculate it, step by step

1. Choose the step. For example, resume screening, a test, or an interview stage.
2. Count applicants and selections by group. Use only data you may lawfully collect and use for monitoring.
3. Calculate each group’s selection rate. Rate = number selected divided by number of applicants in the group.
4. Find the highest rate.
5. Divide each group’s rate by the highest rate. The result is the impact ratio.
6. Compare to 0.80. Below 0.80 is a flag for review.
7. Check the numbers. If groups are small, results may be unstable. Collect more data or look at several searches together.

A worked example (fictional)

This example is invented. A company screens 200 applicants for a role. The table shows applicants and those who passed the resume screen, by a fictional group split.

Group	Applicants	Selected	Selection rate	Impact ratio (rate divided by highest rate)
Group A	120	48	48 / 120 = 0.40	0.40 / 0.40 = 1.00
Group B	80	20	20 / 80 = 0.25	0.25 / 0.40 = 0.625

Group A has the highest rate, 0.40. Group B has a rate of 0.25. The impact ratio is 0.25 divided by 0.40, which is 0.625. This is below 0.80, so the result flags a possible adverse impact at the resume screening step. The next step is not to conclude that discrimination happened. It is to look at the criteria used at that step and ask: Which rule produced the gap? Is it job-related? Is there a less exclusive alternative? Are the numbers large enough to trust? A statistician or an employment lawyer can advise on tests of significance.

Same example, different numbers	Group A	Group B	Impact ratio
Selection rate	0.40	0.34	0.34 / 0.40 = 0.85
Result	Above 0.80		No four-fifths flag, but still check the criteria

If the selection rates are 0.40 and 0.34, the ratio is 0.85. That is above 0.80 and the rule does not flag it. Yet the guidelines say smaller differences can still matter if they are significant in statistical and practical terms. Treat the rule as one tool.

The limits of the rule

Limit	What it means	What to do
Small samples	A change of one person can move the ratio a lot. With 10 applicants in a group, one extra hire changes the rate by 10 points	Pool several searches. Use statistical tests. Take advice
Only one measure	It compares rates; it ignores why	Examine the criteria and the evidence
Not a safe harbour	Passing does not make a process lawful	Keep criteria job-related and documented
US-specific	UK and EU law use different tests	Use local guidance in each country
Data availability	Many employers cannot collect group data in all countries	Check what the law allows. Some countries restrict collecting such data
Group definitions	Results depend on how groups are defined	Use official categories where required; avoid guessing a person’s group

What to do if a step is flagged

1. Check the data. Look for counting errors and double counts.
2. Check the sample. If groups are small, collect more data before you act.
3. Find the cause. Which criterion or test separated the groups? A required qualification, a test score, a keyword filter, a location rule?
4. Test job-relatedness. Is the criterion needed to do the job? Write why. Show the link to the tasks.
5. Look for alternatives. Could another way of checking the same skill select people more evenly without losing quality?
6. Change the step if needed. Test the new version on past data where possible.
7. Record what you did. Keep notes on the analysis, the reasons and the decision.
8. Take advice. Employment lawyers and industrial psychologists can advise on validation and risk.

Common causes of adverse impact include rigid keyword filters, degree requirements that are not needed, strict years-of-experience rules, tests with no validation and location rules. See must-haves vs nice-to-haves for how to separate real requirements from habit.

The current US landscape: check the position

US federal approaches to disparate impact enforcement have shifted. In April 2025 an executive order directed federal agencies to deprioritise enforcement of disparate-impact liability. That order does not change the statute. Title VII still contains the provisions on disparate impact, and private plaintiffs and many state laws can still raise such claims. Because the position is changing, check the current EEOC and Department of Labor guidance, and the law of each state where you hire, before you rely on any summary, including this one. This is general information, not legal advice.

Other countries use different tests

Region	Concept	Where to read
United States	Adverse (disparate) impact; the four-fifths rule is a rule of thumb in federal guidelines	29 CFR 1607; EEOC
United Kingdom	Indirect discrimination under the Equality Act 2010: a provision, criterion or practice that puts a group at a particular disadvantage and cannot be justified as a proportionate means of achieving a legitimate aim	Acas: recruitment
European Union	Indirect discrimination in the equal treatment directives, applied by national courts	Directive 2000/78/EC; Directive 2000/43/EC

The UK and the EU do not use the four-fifths rule as a formal test. Employers there can still use selection-rate comparisons as a monitoring tool, provided that data protection rules allow the data to be collected and used.

Using the rule well: a monitoring routine

• Choose the steps to monitor: screening, tests, interviews, offers.
• Decide what group data you may collect and how you will keep it separate from decision records.
• Calculate selection rates every quarter or after each large search.
• Review ratios below 0.80, and also any trend that worries you.
• Pool data across similar roles for stability.
• Record what you did and what you changed.
• Share a summary with leaders: numbers, causes and actions.

Monitoring pairs well with the steps in how to reduce bias in resume screening. If you use software to screen applicants, ask the vendor how the tool was tested for adverse impact, and test it on your own data. People must make the decisions.

Common questions about the calculation

Which group is the comparison group?

Use the group with the highest selection rate at that step as the reference. Do not use a fixed group such as “men” or “majority” unless that group happens to have the highest rate. Compare each other group with the reference group.

Which applicants count in the denominator?

Count the people who actually applied and entered the step. If a step is screening, count all who were screened. If a step is the interview, count all who were invited to an interview. Be consistent. Do not mix counts from different steps.

Can I combine groups?

You can check each protected category on its own, such as sex, or each ethnic group. Very small groups may need to be combined or tracked across several searches. Take statistical advice before you draw a conclusion from small numbers.

What about intersections?

The rule is usually applied to single categories. Real people belong to several. If you have enough data, look at combinations such as sex and age band together. If you do not, note that single-category results may hide issues.

A reporting template

Field	Entry
Step analysed
Period and roles included
Data source and how groups were recorded
Selection rate by group
Impact ratio by group
Sample size note
Possible causes
Job-relatedness of the criterion
Alternatives considered
Action taken and date
Review date

A one-page report like this helps you show that you looked at the issue and acted. Keep the report and the data secure, and limit access. In the UK and EU, data about protected characteristics is special category data, which needs a lawful basis and extra care. See the ICO employment guidance and the GDPR text.

What the rule does not tell you

The rule does not say why a gap exists. A gap may come from the criteria, from where you advertise, from who applies in the first place, or from a mix. Look at the whole funnel: who sees the ad, who applies, who is screened in, who is interviewed, who is offered and who accepts. A gap at one step may begin at an earlier step. If your ad reaches mainly one group, your selection rates at later steps will look different even if each step is fair. Compare the applicant pool to the working population where you have reliable data, and test the reach of your ad channels.

Finally, a ratio above 0.80 is not a goal. Aim for a process in which every criterion is job-related and every applicant has a fair chance to show their evidence. The rule helps you find places where that is not happening.

Frequently asked questions

What is the four-fifths rule in hiring?

It is a rule of thumb from US federal guidelines. If a group’s selection rate is less than 80 percent of the highest group’s rate, it is generally regarded as evidence of adverse impact.

Does passing the four-fifths rule mean my process is fair?

No. It is only one signal. Smaller differences can still matter, and a process can be unfair in ways the rule does not measure.

Does the rule apply in the UK or the EU?

It is a US federal guideline. UK and EU law use the concept of indirect discrimination, with different tests.

What if my group sizes are small?

Ratios can swing a lot. Pool data across searches and seek statistical advice.

Can I collect group data from applicants?

Often yes, with rules. Keep it separate from decision records and explain the purpose. Rules differ by country, so check the official guidance.

Related guides

• Hiring guides for fair and compliant hiring
• How to reduce bias in resume screening: 15 practical steps
• Must-haves vs nice-to-haves
• Blind CV screening: does it work and how to do it
• All hiring guides for employers
• Disparate treatment vs disparate impact in hiring
• New York City Local Law 144: bias audits for hiring tools
• US law on AI and hiring: what employers should know

This is general information, not legal advice.

In the United States, federal anti-discrimination laws apply to hiring decisions made with software in the same way as to decisions made without it. Employers remain responsible for the results of tools they use, including tools bought from vendors. Federal enforcement priorities have shifted since 2025, but the laws have not changed, and states, cities and private plaintiffs can still act.

What the law covers

The main federal laws on employment discrimination apply regardless of the technology used. Title VII of the Civil Rights Act of 1964 prohibits discrimination based on race, color, religion, sex and national origin. The Americans with Disabilities Act (ADA) protects qualified people with disabilities, and requires reasonable accommodation in the application process. The Age Discrimination in Employment Act (ADEA) protects workers aged 40 and over. The Equal Employment Opportunity Commission (EEOC) enforces these laws, and its page on prohibited employment policies and practices summarises the basics.

None of these laws has an exception for software. If a tool produces results that treat applicants differently because of a protected trait, the employer who uses it can be liable. The same logic applies when the tool is simple, such as a keyword filter, and when it is complex, such as a model trained on past hires.

Two kinds of risk

Risk	What it means	Example (generic)
Disparate treatment	Treating people differently because of a protected trait, on purpose	A tool is set to filter out applicants over a certain age
Disparate impact	A neutral rule or tool that falls more heavily on a protected group and is not job-related and consistent with business necessity, or where a less discriminatory alternative exists	A screening score trained on past hires reproduces a past imbalance in the workforce
Disability screen-out	A tool or test that screens out a person because of a disability, when the person could do the job with a reasonable accommodation	A timed online test that a person with a motor or processing difference cannot complete in the usual way
Failure to accommodate	Not offering an alternative way to take a test or interview	No route to ask for another format

Our guides on disparate treatment vs disparate impact and the four-fifths rule explain the first two in more detail. The EEOC explains how selection procedures are judged in its page on employment tests and selection procedures, and the Uniform Guidelines on Employee Selection Procedures are published as 29 CFR Part 1607.

What changed in 2025

Employers should know three developments, and should verify each on official sources. First, the EEOC published technical assistance documents on AI and hiring in 2022 and 2023. Those pages were later removed from the agency’s site, so they should not be treated as current EEOC guidance. Second, an executive order in April 2025 told federal agencies to deprioritise enforcement of disparate impact liability. Third, the statutes, including Title VII’s disparate impact provisions, were not repealed. Private individuals can still bring claims, and state attorneys general and state or local agencies can apply their own laws.

What this means in practice: federal agencies may act less on disparate impact. Lawsuits and state action remain possible, and tools that may cause unequal results are still a business and reputational risk. Intentional discrimination, including by an automated tool, remains unlawful. Rules and priorities keep changing, so check the EEOC site and ask a lawyer for current advice.

Employer responsibilities with vendor tools

Buying a tool does not move legal responsibility to the vendor. In general, if you use a tool to make or inform decisions, you answer for the effects on your applicants. Contract terms can share costs, but they do not remove your duties. So you need to understand the tool and test its effects on your own process.

1. List all tools used in hiring. Include resume parsers, chatbots, video tools, assessments and scoring or ranking features.
2. Ask each vendor what the tool does. What inputs does it use? What is the output? How was it built and tested?
3. Ask for evidence of testing. Has the vendor tested for differences in outcomes between groups? Can you see the summary?
4. Review job-relatedness. Does the tool measure something the job needs? Can you explain how?
5. Test with your own data. Compare outcomes for applicants by group where the law allows, and use a sample review by people to check for errors.
6. Provide accommodations. Offer another way to take an assessment, and a clear contact for requests.
7. Keep a person in charge. Make sure a trained person reviews the evidence and makes each decision.
8. Keep records. Store what you tested, what you found and what you changed, for the period required by law. See how long to keep rejected applicant data.

Disability and AI tools

Many hiring tools time responses, measure speech or facial expression, track mouse movements or use games. These can disadvantage people with disabilities who could do the job. Practical steps include telling candidates what the tool measures, giving a simple way to ask for an alternative or more time, and training staff to respond to requests. Our guides on reasonable adjustments in interviews and the ADA and hiring cover the process. The EEOC’s enforcement guidance on reasonable accommodation is still available.

State and local rules

Place	Example	Where to read
New York City	Local Law 144 requires a bias audit within a year before using covered tools, a public summary and candidate notice	City page and our Local Law 144 guide
Illinois	A law on artificial intelligence in video interviews requires notice and consent in covered cases	Check the Illinois General Assembly site for current text
Other states	Several have passed or proposed rules on automated decisions or AI in employment	Check state legislature and attorney general sites for each state where you hire

Because the picture changes, make “check current rules” a standing item in your procurement checklist, as in our guide to choosing recruiting software. The US National Institute of Standards and Technology also publishes a voluntary AI Risk Management Framework that employers can use to structure their own review.

A short policy for AI in hiring

Write a one-page policy and share it with recruiters and hiring managers. It can follow this outline.

Section	Contents
Purpose	Hire fairly and lawfully; keep people responsible for decisions
Scope	All tools that sort, score, rank, recommend or screen candidates
Rules	No automatic rejection; every decision reviewed by a trained person; no use of protected traits or close proxies
Approval	New tools need approval from HR and legal after a review
Testing	Outcomes checked by group where lawful; sample review of decisions each quarter
Accommodations	A clear route to request alternatives; staff know how to respond
Transparency	Candidates are told which tools are used and how to ask questions
Records	Keep the review, tests and changes for the required period
Review	Reviewed each year and when rules or tools change

FastHire is being built to help you keep people in charge. It shows each job requirement next to the exact CV passage that supports it. FastHire does not rank, score or reject candidates. People make every decision. FastHire is coming soon.

A vendor review sheet (fictional example)

Question	Vendor answer (fictional)	Follow-up
What does the tool output?	A match percentage for each applicant	Is it used to rank? Can we switch it off?
What data does it use?	CV text and answers to screening questions	Does it use anything that is a close proxy for a protected trait?
How was it tested?	Internal testing, summary available on request	Request the summary; ask who ran the test and when
How do applicants ask for an accommodation?	Not built in	We add a contact in the invitation and a manual route
Can reviewers see why a result appeared?	A list of matched words	Can they see the CV passage and overrule the result?

The answers are invented. The structure is the point: each answer leads to a follow-up that either reduces the risk or ends the use of the feature. Keep the completed sheet in your file for the tool.

What to do when a test shows a gap

1. Do not ignore it. Document the finding, the date and who reviewed it.
2. Check the data. Small groups can show large swings. Look at more data before you conclude anything.
3. Look for the cause. Which step or requirement produces the gap? Is it a feature of the tool, a job requirement or the source of applicants?
4. Test job-relatedness. Is the requirement or feature necessary for the job? Could a less exclusive method work?
5. Change the process. Adjust the requirement, remove or limit the feature, add a human review, or change how the tool is used.
6. Re-test. Check again after the change, and note the result.
7. Take legal advice. Do this early if the gap is large or affects a legally protected group.

Remember that testing your own tool is a good-faith step toward fair hiring, and it is much better than not looking. Handle the data with care, limit who can see protected-trait data and delete it on schedule.

Talking to candidates about tools

Candidates increasingly ask whether AI is used on their application. Give a plain answer in your careers page and your application confirmation. Say what the tool does, that a person makes the decision, and how to ask for another process or an adjustment. Do not claim that a tool removes bias. Say what you do to test and review. Honest, specific language builds more trust than large claims, and it keeps you consistent with what your vendors really provide.

One more practical point: assign a single owner for hiring tool risk. Without an owner, the vendor relationship sits with whoever signed the contract, the data sits with IT and the fairness question sits with nobody. A named owner, usually in HR with support from legal, keeps the tool list current, collects vendor documents, schedules tests and reports to leadership once a year. Even in a small company, one person with an hour a month for this task makes a difference.

Frequently asked questions

Does the EEOC still have AI guidance?

The EEOC’s earlier technical assistance pages on AI and hiring were removed from its site. The laws they described are still in force. Check the EEOC website for what is current, and ask a lawyer.

Am I liable for a vendor’s tool?

You can be liable for the effects of tools you use in your hiring decisions. Contract terms do not remove your legal duties.

Do small employers need to worry?

Coverage of the federal laws depends on the number of employees, and state laws may reach smaller employers. Tool risk exists at any size.

Is a keyword filter an AI tool?

The law does not care about the label. A simple filter that causes unlawful discrimination is still a problem.

Can I test my own tool for bias?

Often yes, using lawful methods and data. Work with a specialist, and be careful with how you collect and store protected-trait data.

Related guides

• Hiring guides for fair and compliant hiring
• Disparate treatment vs disparate impact
• New York City Local Law 144: bias audits for hiring tools
• EU AI Act and hiring tools
• All hiring guides for employers
• The ADA and hiring: reasonable accommodation for applicants

This is general information, not legal advice.

An accessible job application can be completed by people who use a keyboard only, a screen reader, magnification, voice control or extra time, and by people who find long or unclear forms hard. Test your careers page and form against 25 checks in four groups: content, structure, forms, and alternatives. Start with the free checks from the W3C.

Why accessibility belongs in hiring

Your application page is the first step in the process. If a candidate who uses a screen reader cannot submit the form, you will never read their CV, and you may never know that you lost them. Barriers also affect many people who are not disabled: someone on a phone with a small screen, someone with a slow connection, someone who reads in a second language or someone in a hurry.

Legal duties differ by place, and they are changing. In the US, the ADA applies to the application process, and the Equal Employment Opportunity Commission covers it in its guidance on reasonable accommodation. In Great Britain, the Equality Act 2010 requires reasonable adjustments in recruitment. In the EU, the Employment Equality Directive applies, and some EU and national accessibility laws cover websites and digital services. See our guides on the ADA and hiring and UK reasonable adjustments in recruitment. This guide is a practical checklist, not a legal audit.

The standard to use

The W3C publishes the Web Content Accessibility Guidelines, known as WCAG. The W3C says that WCAG 2.0, 2.1 and 2.2 exist and encourages the use of the latest version, 2.2. Many laws and public buyers refer to WCAG at a stated level, often AA. Ask your lawyer or procurement team which level applies to you. The W3C also offers a page of easy checks for a first review. It notes that passing these quick checks does not mean a page is fully accessible.

The 25-point checklist

A. Content and language (checks 1 to 6)

1. Plain language. Write the advert and the form at a level most adults can read quickly. Short sentences, common words.
2. Clear page title. Each page has a title that says where the person is, such as “Apply for Operations Assistant – Step 2 of 4”.
3. Headings in order. Use real headings, not bold text, so screen reader users can move around.
4. Describe images. Informative images have alt text. Decorative images have empty alt text. Do not put job requirements only in an image.
5. Link text makes sense alone. Use “Read the privacy notice”, not “Click here”.
6. State the language of the page, and mark changes of language.

B. Structure and design (checks 7 to 13)

1. Keyboard access. Everything works without a mouse: links, buttons, menus, form fields and upload buttons.
2. Visible focus. A clear outline shows where the keyboard cursor is.
3. Logical order. The tab order follows the visual order.
4. Colour contrast. Text and controls stand out from the background. Check with a contrast tool, and do not use colour as the only signal, for example for errors.
5. Zoom and reflow. The page remains usable when text is enlarged to 200 percent, and on a small screen, without sideways scrolling.
6. No time traps. If the session times out, warn the user and allow an extension. Save progress where possible.
7. No flashing or auto-moving content that cannot be paused.

C. Forms (checks 14 to 20)

1. Labels for every field. A visible label is linked to its field, not just a hint inside the box.
2. Mark required fields in text, not only in colour.
3. Helpful errors. Say which field has a problem and how to fix it. Place the message next to the field and at the top.
4. Group related fields (such as an address or a set of options) with clear group labels.
5. Do not demand too much. Ask only for what you need to assess the application. Offer to accept a CV without re-typing it into 15 fields.
6. Accessible upload. The file upload works with a keyboard and a screen reader, and accepts common file types.
7. Accessible CAPTCHAs. Avoid image puzzles. Use an alternative that does not block people. Ask your vendor about options.

D. Alternatives and support (checks 21 to 25)

1. Another way to apply. Offer email, phone or a paper option, and put it next to the form.
2. A named contact for help, with a reply time.
3. Accessible documents. Job descriptions and notices are available as accessible web pages or tagged PDFs.
4. Accessible video and audio. Captions for speech and a transcript. Audio description where visuals carry information.
5. An accessibility statement. Say what you tested, known problems and how to report a barrier.

How to test, in an hour

Test	How	What you learn
Keyboard-only	Put the mouse away. Use Tab, Shift+Tab, Enter and Space to complete the whole application	Missing focus, traps, unreachable controls
Zoom	Zoom the browser to 200 percent and then 400 percent	Overlaps, hidden buttons, sideways scrolling
Screen reader	Use a free screen reader (NVDA on Windows, VoiceOver on Mac and iPhone, TalkBack on Android) for the first two pages	Unlabelled fields, bad reading order, missing alt text
Colour and contrast	Use a contrast checker on text, buttons and error messages	Low contrast and colour-only signals
Phone	Complete the form on a mid-range phone on a mobile connection	Slow pages, tiny controls, awkward uploads
Real people	Ask two or three people who use assistive technology to try it, and pay them for their time	Problems that automated tools miss

Automated tools help, but they find only a share of problems. Use them for a first pass, and then test with people. Record what you find, give each issue an owner and a date, and retest after the fix.

Working with your software vendor

Most employers use a vendor for the application form. You are still responsible for the experience. Ask for the vendor’s accessibility statement, the standard it follows and a recent test report. Ask how they handle bug reports and how fast they fix them. Test your own configuration, because custom fields, embedded questions and added scripts can create new barriers. Our guide on choosing recruiting software includes accessibility among the points to cover.

Make the process better for everyone

• Shorter forms. Fewer fields means fewer chances to fail.
• Save and return. Let people leave and finish later.
• A progress indicator. “Step 2 of 4” reduces stress.
• Confirmation that is clear. Tell people their application was received, and what happens next.
• A way to give feedback. Add a short link: “Tell us if anything on this page was hard to use.”

These changes help people with disabilities most, but they also help almost everyone. A form that is easy to complete increases the number of qualified people who finish it.

FastHire is coming soon, and we are building it with accessibility in mind. It shows each job requirement next to the exact CV passage that supports it. It does not rank, score or reject candidates. People make every decision. Whatever tools you use, test the application experience yourself.

Plain language: before and after

Before	After
Candidates must possess demonstrable proficiency in the utilisation of enterprise resource planning systems.	You have used a system for orders and stock, such as an ERP system.
Please be advised that incomplete submissions will not be considered.	We can only read applications that are complete. Please fill in every field marked “required”.
Applicants should endeavour to submit their documentation prior to the closing date.	Please send your CV by 17:00 on [date].
Successful candidates will be contacted forthwith.	We will write to everyone by [date].

Plain language does not mean simple ideas. It means clear sentences that more people can read the first time. Test your text with a colleague outside the team. If they must read a sentence twice, rewrite it.

An issue log for your application page

Issue	Page or step	Who it affects	Severity	Owner	Fix by	Retested
Upload button cannot be reached by keyboard (fictional)	Step 3	Keyboard and screen reader users	High	Web lead	Date	Yes / No
Error message in red only (fictional)	Step 2	People with colour vision differences	Medium	Vendor	Date	Yes / No
Session ends after 10 minutes with no warning (fictional)	All steps	People who need more time	High	Vendor	Date	Yes / No

The rows are invented to show the format. Rank issues by how much they block a person from finishing. A blocked upload ranks above a spelling error. Review the log at a monthly meeting until the high-severity items are closed.

What to say in your accessibility statement

A short statement builds trust and tells people what to do if they hit a barrier. Include the following points in plain words.

1. What you tested, which standard you aimed for and the date of the last review.
2. Known problems and when you plan to fix them.
3. How to apply another way: an email address and a phone number.
4. How to report a barrier, and how fast you will reply.
5. The name or role of the person responsible.

Be honest. A statement that lists real gaps and clear plans is better received than a claim that everything is perfect. Update it after each review.

A quarterly routine

Put a recurring task in the calendar. Each quarter, one person completes the application on a phone and on a desktop, using the keyboard only. They also run an automated scan, check the issue log and read any feedback received. They record the result in two lines. Every year, add a test with people who use assistive technology. This is a small amount of work that prevents large problems, and it keeps the form accessible when vendors, templates or questions change.

Costs and priorities

Teams often worry that accessibility is expensive. Many fixes are small: adding labels, changing a colour, adding a visible focus outline, writing clearer error messages and offering an email option. The larger costs usually come from systems that were not chosen with accessibility in mind. That is why the questions belong in procurement, before you sign a contract. If you already have a system with problems, rank the issues by impact, ask the vendor for a dated plan and put the commitment in writing.

Start with the first three steps of the application, since that is where most people leave. Fix the barriers that block completion. Then work on the issues that make completion hard. Last, polish. Measure the share of people who start and finish the form before and after your changes. A rise in completion is a sign that the changes help.

Frequently asked questions

Is an accessible application the same as an accessible interview?

No. The application is the first step. Interviews and tests have their own needs. See our guide on accessible interviews.

Do I need to meet WCAG AA?

It depends on the law that applies to you and on your contracts. WCAG AA is a common target, and it is good practice. Ask a lawyer about your duties.

Can I use an accessibility overlay or plugin to fix my form?

Be careful. Many experts warn that overlays do not fix underlying problems. Fix the page itself, and test with real users.

What if my vendor says its form is accessible?

Ask for evidence: a test report and the standard used. Then test it yourself with your own configuration.

How often should I test?

After every change to the form or the careers page, and at least once a year.

Related guides

• Hiring guides for fair and compliant hiring
• The ADA and hiring: reasonable accommodation for applicants
• UK reasonable adjustments in recruitment
• Candidate experience checklist
• All hiring guides for employers
• How to run an inclusive job ad check

This is general information, not legal advice.