AI Resume Screening Compliance Checklist for Small Employers

An AI resume screening compliance checklist for a small employer comes down to six habits: check your local law first, keep a person making every decision, tell candidates how AI is used, record criteria and outcomes, check your vendor's data terms, and review results for unfair patterns. Rules differ by country, so this is guidance, not legal advice.

Why small employers need a checklist

Large companies have legal teams to read new rules on automated hiring. A small employer usually has a founder, an office manager or one recruiter doing everything, and the first sign of a problem is a candidate's question or a complaint. A short checklist you actually follow protects you better than a long policy nobody reads.

This guide is written for teams hiring a handful of people a year up to a few dozen. It explains what to check, what to record and what to ask a vendor. It does not tell you what the law is in your country, because that is the part that varies most and changes fastest. Treat everything here as a prompt for questions to put to a qualified adviser. If you want the product side of screening first, see /ai-resume-screening.

The first rule: rules differ by country, and some places have specific laws

There is no single worldwide rule for using software to screen candidates. In some countries, general employment, discrimination and data protection law applies and nothing specific mentions AI. In other places, regulators or legislatures have written rules that cover automated tools used in hiring: they may require notice to candidates, a bias review, a right to a human decision, or limits on fully automated rejection. Some rules apply by the location of the candidate rather than the employer. Others apply to certain sizes of business only.

What this means in practice:

• Find out which country, region or city rules apply to your hiring, including where your candidates live.
• Look for rules on discrimination, data protection and automated decision-making separately, because they come from different laws.
• Check again at least once a year, because this area is changing.
• Ask a qualified employment or data protection adviser when you are unsure. A short paid consultation costs far less than a dispute.

Nothing in this article tells you that a particular tool or process is legal where you are.

Keep a person in the decision

The single most useful habit is also the simplest: let software suggest, and let a person decide. Where rules restrict automated decisions, having a real person review the information and make the call is generally the safer position, though the exact requirements depend on local law.

A person reviewing is not a person clicking approve on a list. For the review to mean something, the reviewer needs to see the evidence behind a ranking, have the time to read the CVs of people ranked low as well as high, and be free to disagree with the tool. Write down who is the decision maker for each role, and make sure a rejection never happens simply because a score was below a line.

A practical rule for small teams: no candidate is rejected on a score alone. At least one person reads the CV and records a short reason, for example "no experience with payroll, a stated must-have".

Tell candidates what you are doing

Transparency is the next habit. Candidates generally should not be surprised that software helped assess them. Many places expect or require notice, and even where they do not, it builds trust and avoids awkward questions.

Put a short plain-language notice on your job ad or apply page. Here is a word-for-word template you can adapt: "We use software, including AI tools, to help organise and review applications. It compares CVs with the skills listed for the role. A person reviews every application and makes every decision. If you would like us to consider your application without the tool, or to tell you what information we hold, contact [email]. We keep applications for [period]."

Check the wording against your local law, and make sure it is true. Do not claim human review if nobody reads the CVs. Offer an alternative route for candidates who need an adjustment, for example if they cannot use an online form because of a disability.

Record keeping: what to write down

If a decision is questioned, your best protection is a clear record made at the time. Retention rules differ by country, so check how long you must or may keep hiring records, and when you must delete them.

For each role, keep: the job description and the must-have criteria with the date they were set, how candidates applied, how many applied, how many were shortlisted and rejected, the reasons recorded for rejection, the names of the decision makers and the dates of decisions. For each candidate who reaches a decision, keep the evidence reviewed and any interview notes.

Avoid the two extremes. Keeping nothing leaves you unable to explain yourself. Keeping everything forever creates data risk and may break deletion rules. Pick a retention period that fits local law, write it down, and delete on schedule.

Check your vendor, not just your process

If you use a tool to screen CVs, you are still responsible for how candidate data is handled. Ask the vendor in writing and keep the answers.

• Where is candidate data stored, and who can access it?
• Is candidate data used to train models, and can you opt out?
• Which outside services, if any, receive CV text?
• Can you delete one candidate or one whole job, and is deletion permanent?
• Is there a record of who viewed or changed what?
• Does the tool use or infer protected characteristics, and can names and photos be hidden?
• Will the vendor sign a data processing agreement if your law needs one?

Do not accept "we are fully compliant" as an answer. Compliance depends on how you use a tool as well as how it is built. Ask for specifics, and check current documents rather than a sales page.

Watch for unfair patterns

Bias checking does not need a data science team. Once a quarter, or after each hiring round, look at who applied, who was shortlisted and who was hired, and ask whether any group seems to drop out at a particular step. You can only do this properly if you collect the data lawfully, and some places limit what you may ask candidates, so check local rules before adding any question about personal characteristics.

Useful checks that need no personal data: do candidates with career gaps score far lower than others with the same skills? Do people from unusual schools or non-standard CV layouts get skipped? Do unreadable files, such as scans, silently disappear? Read the bottom ten CVs on a regular batch and ask whether you would have rejected them. If you find a pattern, change the criteria or the process, and write down what you changed.

The checklist you can copy

Score each line 0 for no, 1 for partly, 2 for yes. This is an example scoring sheet to prompt discussion, not a legal test.

A total of 18 to 20 shows a well-managed process. From 12 to 17, fix the zero and one lines in order. Below 12, pause automated steps until the basics are in place and talk to an adviser.

A decision table: what to do at each step

This table maps each step of hiring to the compliance habit that fits. Adjust it to your local law.

Worked example with example numbers

These numbers are examples only. A 25-person company hires six people a year and expects about 80 applications for one operations role. The owner decides to use a screening tool for the first time.

Before switching it on, she spends an hour on the checklist. She checks local guidance and books a 30-minute call with an adviser, who confirms that applicants must be told about automated tools. She adds the notice template above to the apply page. She writes five must-haves and dates them. She names herself as the decision maker and the operations lead as the second reviewer.

When 80 applications arrive, the tool ranks them. She reads the top 20 and a random 10 from the bottom 40, and finds two strong candidates ranked low because their CVs used different wording for a must-have. She moves them up, records why, and edits the criteria wording for next time. Of the 80, 12 are shortlisted, 8 interviewed and 1 hired, and every rejection has a recorded reason. Her records took about ten minutes extra per week. If a candidate asks why they were not selected, she can answer.

Common mistakes, and who this checklist is not for

Mistake one: assuming a vendor's compliance claim covers your use. Mistake two: letting a score act as a rejection. Mistake three: no notice to candidates, or a notice that says human review happens when it does not. Mistake four: keeping CVs forever in email and folders. Mistake five: collecting personal characteristics without checking whether you are allowed to. Mistake six: never looking at who the tool ranks low. Mistake seven: treating this checklist as legal advice instead of as a starting point for asking the right questions.

If you hire in a heavily regulated sector, or across many countries, or at scale, you need proper legal advice and probably a formal assessment process, and a checklist like this is only the start. If you never use any software to filter candidates and read every CV yourself, most of the automated-decision items do not apply, though notice, records and deletion still do. And if a dispute is already under way, stop and speak to a qualified adviser rather than relying on a general guide.

Where Rezumz fits

Rezumz is an AI hiring workspace for small and mid-size hiring teams. It scores each CV against the must-haves you set and shows the CV lines it relied on, so the reviewer sees evidence. It never rejects a candidate for you: people make every decision. The apply page collects applications at the job's own link with up to five screening questions and a data notice the candidate agrees to, and it can automatically delete a job's candidates 3, 6, 12 or 24 months after the job closes, with each deletion written to the audit log. The account owner can see an audit log of who did what and download it, and you can export candidate data.

It does not give legal advice, certify that you comply with any law, or replace an adviser. It is not built for large enterprises needing deep HRIS or payroll connections, and it does not post to job boards in one click. It suits small and mid-size hiring teams, and the Team plan fits teams with four or more recruiters.

Prices: a free plan with 2 free candidate analyses; $29 a month, $199 a year, or $499 lifetime (limited); Team is $79 a month or $699 a year for up to 10 teammates. See /pricing, try /demo and compare options at /compare.