AI AI at work: policies, tools and what to watch
AI in hiring: what the screening software really does
How AI is used to sort job applicants, what it can legally do, where it goes wrong, and what both candidates and employers should check before trusting the output.
The short answer
- Most hiring software ranks and filters rather than decides, and the parts that reject you outright are usually simple rules about licenses, location or work authorization, not AI judgment.
- The best thing a candidate can do is make the resume machine readable: one column, plain text, standard headings and the posting's own vocabulary used once where it is true.
- Keyword stuffing and white text no longer work, because matching is based on meaning rather than repetition and the human reviewer sees the trick.
- Bias enters through training on past hires, through proxy variables such as postal code and career gaps, and through tools that are simply less accurate for some groups.
- Employers carry the legal responsibility even when a vendor built the tool, and existing discrimination law already applies without any AI specific statute.
- New York City, Illinois and other US jurisdictions impose bias audits or notice duties, while the EU AI Act treats recruitment as a high risk use with oversight and documentation obligations.
Most hiring software does not decide anything. It parses your resume into structured fields, matches those fields against the requirements a recruiter typed in, and produces a ranked list a human then skims. That has been true of applicant tracking systems for twenty years. What has changed is that the matching step now uses language models rather than keyword counts, that some employers add automated assessments and video analysis on top, and that regulators have started requiring notice, bias testing and human review for exactly this use. The practical consequences differ completely depending on which side of the process you are on, so this article splits in two.
What the software actually does
Five distinct things get bundled together under the phrase AI in hiring, and they carry very different risks.
Parsing. Converting your document into fields: name, employers, dates, titles, skills. This is unglamorous and it is where most silent failures happen. Tables, columns, headers, graphics, text inside images and unusual fonts all confuse parsers. A resume that looks beautiful can arrive as scrambled fields.
Matching and ranking. Comparing the parsed profile to the job requirements and producing a score or an ordering. Modern systems use embeddings, which represent meaning as numbers, so related terms match without being identical. This is why exact keyword repetition matters far less than it used to.
Knockout filters. Simple rules applied before anything clever: work authorization, minimum years, required license, location. These are hard filters, not scores, and they are the most common reason for an instant rejection.
Assessments. Automated tests of skills, situational judgment or personality, scored by algorithm. Long predating AI, now sometimes scored by models.
Video and voice analysis. Systems that score recorded interview answers. Analysis of content, meaning what you actually said, is defensible. Analysis of facial expression, tone or speech patterns to infer personality has weak scientific support and is the most legally exposed category, with some jurisdictions restricting or banning it outright.
For candidates: what helps and what is a myth
The single highest value action is making your resume machine readable. Not clever, readable. One column, standard section headings such as Experience, Education and Skills, real text rather than text inside an image, dates in a consistent format, and a common file type the employer asks for. A plain document beats a designed one at this stage, and you can always bring the designed version to the interview.
Use the words the job posting uses, once, in the place where they are true. If the posting says stakeholder management and your resume says client relationships, add the phrase they used to the relevant role. This is not gaming the system, it is translation.
Now the myths, because they cost people real effort.
| Common advice | Reality |
|---|---|
| Stuff keywords in white text so only the machine sees them | Detected easily, read as deception by the human who checks, and increasingly flagged by the software itself |
| Repeat the key term twenty times to raise your score | Semantic matching does not count repetitions, and the human reviewer will notice |
| 75 percent of resumes are rejected by a robot before a human sees them | A widely repeated figure with no solid source; most systems rank rather than reject, though hard filters do reject automatically |
| A creative design helps you stand out | It helps with a human and hurts with a parser, so lead with the plain version |
| Longer resumes score better | Length is not scored; relevance to the specific posting is what the matching step looks at |
| Applying to more roles improves your odds proportionally | Volume with a generic resume performs worse than fewer tailored applications, because matching is per posting |
Using AI to write the application itself is a separate question with its own trade offs, and the honest answer is that it helps with structure and hurts when it produces the same three paragraphs every other applicant submitted. That is covered in using AI on a job application without sounding like everyone else.
You may also have rights worth using. In the EU and UK, you can ask an employer what personal data it holds about your application and request meaningful information about the logic of any solely automated decision that significantly affects you. Several US states and cities require employers to tell candidates when an automated tool is used, and some require that you can request an alternative process or an accommodation. Asking politely for a human review costs nothing and occasionally works. The general shape of these entitlements is set out in what you can ask a company to do with your data.
For employers: where this goes wrong
The failure mode is not a system that suddenly develops prejudice. It is a system trained or configured to reproduce your past hiring, which encodes whatever your past hiring did, including patterns you would never write into a job description.
Three mechanisms cause most of it. Training on historical outcomes teaches the model to prefer profiles resembling people you hired before. Proxy variables carry protected characteristics indirectly: postal code, school, career gaps, sports, even writing style can correlate with age, gender, disability or ethnicity. And unequal accuracy means a tool can work well for one group and badly for another, which shows up as a disparity in scores rather than as an obvious rule. The general mechanics are covered in where AI bias comes from and where it shows up.
Two specific risks deserve naming. Career gap penalties disadvantage people who took parental leave, cared for a relative or were ill, which maps onto sex and disability discrimination in most legal systems. And speech or video analysis can disadvantage candidates with accents, speech differences or visible disabilities, which is why it attracts the most regulatory attention.
Note that the legal exposure sits with you, not the vendor. In most jurisdictions the employer is the one making the employment decision, and a contractual indemnity does not transfer a discrimination claim. The clauses that matter, including audit rights and what the vendor will actually tell you about the model, are the subject of AI vendor contracts.
The rules in the US and the EU
This is general information rather than legal advice, and this area is changing quickly, so verify the current position for your jurisdiction before relying on it.
In the US there is no single federal AI hiring statute. Existing anti discrimination law applies to automated tools exactly as it applies to human decisions, including the disparate impact theory, where a neutral looking process that disadvantages a protected group can be unlawful regardless of intent. Equal employment guidance has confirmed that using a vendor tool does not relieve an employer of responsibility. On top of that sit local rules: New York City requires an annual independent bias audit and a published summary for automated employment decision tools, plus notice to candidates. Illinois regulates AI analysis of video interviews, requiring notice, explanation and consent. Maryland restricts facial recognition in interviews. Colorado has passed broader legislation on algorithmic discrimination in consequential decisions, employment included. More states are moving in the same direction.
In the EU, the AI Act treats AI used for recruitment, selection, promotion and termination as high risk. That brings obligations including risk management, data governance, technical documentation, logging, transparency to affected people and genuine human oversight. Most of the heavy duties fall on providers, but deployers, meaning the employers, carry their own set: use the system as intended, assign competent people to oversee it, monitor for problems and inform workers. Separately, the GDPR restricts decisions based solely on automated processing that produce legal or similarly significant effects, and requires a data protection impact assessment for this kind of systematic evaluation. What high risk classification actually demands is unpacked in high risk AI under the EU AI Act.
A defensible setup for employers
- Write down what each tool is used for and where it sits in the funnel. You cannot govern a system you cannot describe.
- Keep humans in the decision. Not a rubber stamp: a named person with authority to disagree, the information to do so, and time in the process for it.
- Test for adverse impact before launch and at intervals afterwards, comparing selection rates across groups. Use an independent auditor where the law requires one.
- Give notice to candidates, plainly, before they apply, and offer an accommodation route.
- Ban inference of personality, emotion or fit from face, voice or video. The evidence is weak and the exposure is high.
- Keep records: inputs, scores, decisions, the model version and who reviewed what. You will need them for an audit, a complaint or a claim.
- Review job requirements first. Most hiring bias enters through requirements that were never necessary, and no amount of algorithmic fairness work fixes a badly written posting.
That last point is the one that gets skipped. A tool faithfully implementing an unjustified degree requirement is doing what you asked, at scale, with a record of it.
What to do next
If you are applying for jobs, spend an hour producing one plain, single column, machine readable version of your resume, and tailor the top third of it to each posting using that posting's own vocabulary. Then stop optimizing and start networking, because a referral routes around the entire ranking problem.
If you are hiring, start by listing every tool already in your process, including features your recruiting platform switched on without asking. Then pick the one that touches the most candidates and check three things: whether anyone has tested it for adverse impact, whether candidates are told, and whether a human can actually overrule it. Fold the answers into your broader rules, since hiring is the most regulated AI use most organizations have, and it belongs explicitly in your workplace AI policy rather than in a recruiting team's private habits. For context on how this sits alongside everything else AI is doing in your organization, see AI at work.
Common questions
Does an AI really reject my resume before a human sees it?
Sometimes, but usually through a simple rule rather than AI. Hard filters for work authorization, required licenses, location or minimum experience can reject automatically. The AI part generally ranks candidates so a recruiter reads the top of the list first, which means a low rank hurts your odds without formally rejecting you.
What resume format works best with screening software?
A single column document with real selectable text, standard headings, consistent date formats and no text trapped inside images, tables or headers. Send the file type the employer requests. Save your designed version for the interview stage, where a person is reading it and presentation actually counts for something.
Can I ask whether AI was used to assess me?
In several places yes, and asking is free everywhere. Some US jurisdictions require employers to disclose automated tools and offer alternatives, and EU and UK data protection law lets you request your personal data plus meaningful information about the logic of a solely automated decision with significant effects. Ask the recruiter in writing and keep the reply.
Is it illegal for employers to use AI to screen candidates?
No, it is legal in the US and the EU, but it is regulated. Discrimination law applies to the outcomes regardless of how they were produced, and specific rules add bias audits, candidate notice, human oversight and record keeping depending on where you operate. Facial and emotion analysis faces the tightest restrictions.
Should employers just avoid AI in hiring entirely?
Not necessarily, since structured, consistently applied criteria can be fairer than unstructured human judgment, which has well documented biases of its own. The realistic answer is to use it for high volume administrative steps, test it for adverse impact, keep a person accountable for decisions, and avoid anything that infers personality from appearance or voice.