This article summarises publicly available guidance from regulators and official sources. It is general educational information only and does not constitute legal or professional advice. Requirements vary by jurisdiction. Consult your regional authority or a qualified professional for advice specific to your situation.
If you've already accepted that an AI CV-screening or shortlisting tool is a genuinely useful part of your recruitment process, the next question isn't whether the tool works. It's whether it's quietly disadvantaging a group of candidates in a way the law already treats as unlawful, even without anyone intending it to.
In short: under the Equality Act 2010, a hiring practice can be unlawful indirect discrimination if it disadvantages people who share a protected characteristic, even when that characteristic was never an explicit input into the decision. An AI tool trained on historical hiring data can reproduce old patterns through proxy indicators such as postcode, university, or employment gaps, and "the software decided it" is not a defence. The employer, not the vendor, carries the legal responsibility.
How a tool discriminates without ever seeing a protected characteristic
An HR manager at a 60-person logistics firm using an AI CV-screening tool to shortlist warehouse and driver applicants is a realistic example. The tool was trained on the firm's own past successful hires, and after a few months, it started scoring down candidates from certain postcodes. Postcode was never entered as a factor. But postcode can correlate strongly with ethnicity or other protected characteristics, and if the pattern in the training data reflected who happened to get hired in the past rather than who was genuinely best qualified, the tool learned to repeat that pattern.
This is the core mechanism behind indirect discrimination claims involving AI: a neutral-looking criterion (a postcode, a university name, an employment gap, even certain phrasing patterns in a CV) ends up acting as a stand-in for a protected characteristic, and the disadvantage shows up in outcomes even though no explicit characteristic was ever part of the scoring logic.
Why "the vendor built it, not us" doesn't hold up
The Equality Act's protection against indirect discrimination in recruitment applies to the employer making the hiring decision, not to whoever wrote the underlying software. An employer cannot defend a discrimination claim on the basis that the decision was generated by a third-party tool. The organisation remains responsible for the recruitment process it adopts and the outcomes that follow, regardless of who built the tool behind it.
Where indirect discrimination is found, it isn't automatically unlawful if the employer can objectively justify the practice as a proportionate means of achieving a legitimate aim. In practice, this is a high bar, and "the tool is efficient" or "it saves recruiter time" is unlikely to meet it on its own if the actual outcome disadvantages a protected group.
The ICO's related angle: fairness under data protection law
This sits alongside, not instead of, the ICO's own guidance on fairness, bias, and discrimination in AI, which addresses the data protection angle: whether the processing of candidates' personal data by the AI system is itself fair under UK GDPR. A recruitment AI tool that produces discriminatory outcomes is very likely to fail both the Equality Act's fairness test and the ICO's data protection fairness test at the same time, since the same underlying pattern (a proxy for a protected characteristic driving the outcome) triggers both.
What this looks like in practice for a business your size
A 30-person professional services firm doesn't need a data science team to check for this. The practical version is: periodically compare who the tool shortlists against who applies, broken down by any pattern you can reasonably observe (not just protected characteristics directly, which you may not hold data on, but proxies like postcode or education background), and look for a consistent gap that can't be explained by genuine job-relevant criteria.
What you can do about it
Three practical steps: ask the vendor directly what bias testing they've done and ask to see it, rather than accepting a general assurance; keep a human genuinely reviewing a sample of the tool's shortlisting decisions rather than treating its output as final; and if you ever notice a pattern that looks like it's disadvantaging a particular group, treat that as a trigger to pause and investigate, not something to explain away.
This is general guidance, not a legal assessment of any specific tool or hiring process. Confirm your position with the Equality and Human Rights Commission's published guidance or a qualified employment law adviser before relying on any specific AI hiring tool as safe.
FAQ
Methodology (Real-World, Verified)
We test AI tools against real SMB workflows: the tasks a 20-person business actually uses AI for, not enterprise demos. Pricing is verified at the vendor's published rates, with local-currency conversions noted where relevant. Compliance notes reference the legislation and regulatory guidance relevant to each article's region. Every tool is judged on one question: could a business with no dedicated IT department actually pick this up and use it on Monday morning.
Related reading: our AI governance by region.
Can an employer be held liable for discrimination if the AI vendor built the biased tool?
Yes. The employer using the tool to make hiring decisions carries the legal responsibility under the Equality Act, regardless of who built the underlying software. A vendor's own assurance that its tool has been bias-tested does not remove the employer's responsibility for the actual outcome.
Does removing protected characteristics from the data used to train or run the tool prevent discrimination?
Not on its own. Proxy indicators like postcode, university attended, or employment gaps can still correlate strongly with a protected characteristic even when that characteristic is never an explicit input, and the tool can reproduce the same disadvantage through those proxies.
Is it ever lawful for an AI tool to produce a disadvantage for a protected group?
Only if the employer can objectively justify the practice as a proportionate means of achieving a legitimate business aim. This is a genuinely high bar to meet, and general efficiency arguments are unlikely to satisfy it on their own.
How often should we check an AI hiring tool for this kind of pattern?
There's no fixed legal interval, but checking periodically, and immediately after any change to the tool or a noticeable shift in who gets shortlisted, is a reasonable practical approach for a business without a dedicated compliance function.
The information in this article is general in nature. It reflects a summary of publicly available guidance and does not constitute legal, privacy, or professional advice. Your obligations will depend on your specific situation, jurisdiction, and business circumstances. Do not rely on this article as a substitute for qualified legal or professional advice.
Already told candidates AI is involved in your process? Here's what the ICO's transparency expectations require, separate from this discrimination question.
Read the ICO Transparency Guide