How to Automate Resume Screening Without Bias Risk

How-to — 2026-11-01 — by Mahmoud Zalt

Automated CV screening is legally high risk in the EU and audited in New York City. Here is how to sort applications faster and stay defensible.

A single decent posting can pull several hundred applications in a week, and most of them arrive in the first forty eight hours. Reading them properly is real work, and reading them badly is how good candidates get missed while the process still eats everyone's week.

So automation is a reasonable answer. It is also the single most regulated thing you can point software at, because a screening decision changes someone's livelihood. This guide covers what to automate, where the bias comes from, what the rules require, and where a human has to stay in the loop.

What does automated resume screening actually do?

In practice it does three separate jobs that often get bundled into one product. It parses each application into structured fields, it checks those fields against criteria you defined, and it ranks or scores the results. The first two are mostly safe. The third is where the legal and ethical weight sits.

Parsing: pulling roles, dates, tools, qualifications and location out of a document into fields you can compare.
Checking: confirming stated requirements, such as work authorisation or a specific certification, against what the candidate wrote.
Summarising: producing a short evidence-based note per candidate so a human reads five lines instead of three pages.
Ranking or scoring: ordering candidates by a computed fit number. This is the part that most often triggers regulatory obligations.

If you stop after summarising, you have removed most of the drudgery and taken on very little risk. If you let a score drive automatic rejections, you have built something that is regulated in several jurisdictions and that you will need to be able to explain, in detail, if anyone asks.

Where does the bias actually come from?

From proxies, mostly. A screening system rarely sees a protected characteristic directly. It sees things that correlate with one: graduation years, employment gaps, university names, postcodes, phrasing that differs by first language, or the shape of a career that pauses for caregiving.

The other source is the training signal. A tool tuned on who you hired before will reproduce who you hired before, including the parts of that pattern you would not defend out loud. That is not a hypothetical failure mode, it is the most documented one in this field.

That case involved an explicit rule, which makes it unusually clear cut. The harder situation is a model that produces the same effect without anyone writing the rule, which is precisely what disparate impact law is built to catch. Under the EEOC's guidance on algorithmic decision tools, an employer can be liable for adverse impact even when the tool was built and run by an outside vendor.

What do the rules actually require?

Three regimes matter for most small teams, and they stack rather than replace each other. If you hire in the EU, in New York City, and in the rest of the US, you can be inside all three at once with a single tool.

Regime	What it says	What it means for you
EU AI Act, Annex III point 4(a)	Classifies as high risk any AI system intended for the recruitment or selection of people, including placing targeted job adverts, analysing and filtering job applications, and evaluating candidates.	CV filtering is high risk by name. High-risk duties cover risk management, data governance, logging, transparency and human oversight. The compliance timeline has been amended more than once, so check the current dates.
NYC Local Law 144	Covers automated employment decision tools that substantially assist or replace discretionary decision making. Requires an independent bias audit within the past year, publication of a summary of the results, and advance notice to candidates.	In force since 5 July 2023. Notice must be given ahead of use, and the audit and notice duties are separate violations with separate penalties.
US Title VII and EEOC guidance	Selection procedures, including algorithmic ones, must not produce adverse impact unless they are job related and consistent with business necessity, with no less discriminatory equally effective alternative.	The four-fifths rule is offered as a rough check: a selection rate below 80 percent of the highest group's rate suggests adverse impact. Passing it is not a safe harbour.

There is also live litigation to watch. In Mobley v. Workday, a federal court in California granted preliminary certification of a nationwide collective action under the age discrimination statute, covering applicants aged 40 and over who were rejected through the platform. Whatever the outcome, the case establishes that plaintiffs will pursue the screening layer itself.

How to set this up so it holds up

Write the criteria before you write the prompt — List the requirements in plain language and mark each one as required or preferred. If you cannot justify a requirement in terms of the job, remove it now rather than after someone asks.
Extract evidence, do not assign a score — Ask the tool to answer, for each criterion, whether the application shows evidence and to quote the line. A quote a human can check beats a number nobody can explain.
Blind the fields you do not need — Strip name, photo, address, graduation years and nationality before the screening step wherever your system allows it. You can always restore them for the humans later.
Group, then let a person decide — Three buckets works well: clear evidence, partial evidence, no evidence. A person reviews the middle bucket and every rejection. No candidate is rejected by software alone.
Log every decision and the reason — Which criteria, which quotes, who reviewed it, what they decided, on what date. Logging is a legal requirement under the high-risk duties and it is also the only way to debug your own process.
Measure selection rates by group — Run the four-fifths comparison across the protected characteristics you can lawfully collect. If a group passes at well under 80 percent of the top group's rate, stop and investigate before you hire again.
Check your notice and audit duties — If you screen candidates in New York City, you need an independent bias audit from within the past year, a published summary, and advance notice to candidates. Confirm your obligations before the first posting goes live, not after.

The design above is deliberately unexciting. It gives up the thing vendors like to demonstrate, which is a ranked list with a confidence number at the top, and keeps the thing that actually saves time, which is not having to read three hundred documents to find the twenty worth a conversation.

What has to stay with a person?

Every rejection, every borderline call, and every judgement about potential. Software is good at asking whether a document contains evidence of something. It is poor at deciding whether a career change, a gap, or an unusual background predicts success in your team, and those are exactly the candidates worth the extra minute.

Keeping people in that seat is also what the rules assume. Human oversight is a named requirement in the EU high-risk regime, and New York's law turns on whether a tool substantially assists or replaces discretionary decision making. A process where a person reads and decides is easier to explain to a regulator and easier to defend to a candidate.

That approval boundary is built into how Sistava works. An AI Employee reads the inbound applications, pulls the evidence against the criteria you wrote, and hands you a sorted queue with quotes attached. Anything consequential stops and asks you, and the whole run is logged so you can see exactly what it looked at.

What automated screening will not fix

It will not fix a posting that attracts the wrong people. If three hundred of your four hundred applicants are unqualified, the problem is upstream in how the role is described and where it is advertised, and faster sorting just processes the same mismatch more efficiently.

It cannot tell you why someone will be good, only whether a document contains the evidence you asked for. Those are different questions.
It does not remove your liability. EEOC guidance is explicit that an employer can be responsible for adverse impact from a tool built by a vendor.
It cannot audit itself. New York's law requires an independent auditor with no material financial interest in the tool or the employer.
It will reproduce your past if you tune it on past hires, including the parts of that pattern you would not choose deliberately.

There is a quieter benefit worth naming. When the sorting is consistent, everyone gets read against the same criteria in the same order, which is more than most manual processes achieve at three hundred applications. Consistency is a genuine fairness gain, as long as the criteria themselves are defensible.

Start narrow. One role, criteria written down, evidence extracted with quotes, a person deciding every outcome, and a log of what happened. That version is useful in a week and you can explain every part of it, which is more than can be said for most screening stacks.

If you are hiring once or twice a year, buying a dedicated screening platform for it is hard to justify, and the audit obligations that come with a scoring engine are not something a small team wants to own. A general purpose AI Employee from Sistava can read the applications and prepare the queue for the weeks you are hiring, then go back to other work when you are not.

FAQ

Is it legal to use AI to screen resumes?

Generally yes, but it is regulated. The EU AI Act lists AI used to analyse and filter job applications as high risk under Annex III point 4(a), which brings duties around risk management, logging and human oversight. New York City requires an independent annual bias audit and candidate notice for tools that substantially assist hiring decisions. In the US more broadly, Title VII adverse impact rules apply to algorithmic selection procedures. This is general information, not legal advice.

Can an AI tool reject a candidate on its own?

Technically yes and practically you should not allow it. Automatic rejection is what turns a support tool into a decision maker, which is the trigger for most of the regulatory duties and the fact pattern in the enforcement actions so far. Let software group and summarise, and have a person confirm every no.

What is the four-fifths rule?

It is a rough check for adverse impact used in the US Uniform Guidelines on Employee Selection Procedures. If the selection rate for one protected group is below 80 percent of the rate for the highest-scoring group, that suggests adverse impact. The EEOC treats it as a rule of thumb rather than a safe harbour, and a tool that passes can still be challenged on statistically significant differences.

Do I need a bias audit for my hiring tool?

If you screen candidates in New York City with a tool that substantially assists or replaces discretionary decision making, Local Law 144 requires an independent bias audit conducted within the past year, a published summary of the results, and advance notice to candidates. Other jurisdictions have their own rules, so check where your applicants actually are.

How do I stop the system from picking up bias?

Remove the proxies you do not need before the screening step, including name, photo, address, graduation years and nationality. Extract evidence with quotes instead of computing a fit score. Do not tune anything on your own past hires. Then measure selection rates by group and investigate any gap before you hire again.

What should I tell candidates?

That automated tools are used in your process, what they assess, and that a person makes the decisions. In New York City this notice is a legal requirement with a defined lead time and specific content. Even where it is not required, saying it plainly costs nothing and is the thing candidates most often say they wanted to know.