Insights · For lawyers Is AI reading your CV? What happens to your application at a law firm

You send a CV on a Sunday night and get a reply at 6 a.m. that says "unfortunately". It is fair to wonder whether anyone read it. This guide says what is known, what the law gives you, and what to ask.

Is AI reading your CV at a law firm?#

Possibly. It depends on the firm or the recruiter, and nobody outside can see which tools sit behind the inbox. We found no published figure for how many law firms use screening software, so we will not guess one.

What is documented is that such tools exist in UK recruitment. In 2024 the Information Commissioner's Office (ICO) published the results of audits of AI tools used to find, screen and select candidates. The UK government also published a Responsible AI in Recruitment guide in 2024, which covers technologies used in sourcing, screening, interview and selection.

The honest answer for a law firm is therefore this: ask. A firm that uses software and a person to decide will usually say so. One that cannot answer is worth noting.

How do applicant tracking systems and AI screening tools work?#

An applicant tracking system stores applications and moves them through stages. Some also add tools that search a database, score a CV, or predict who will do well. The ICO sorts these into sourcing, screening and selection.

That list comes from the ICO's audits of tool developers and providers, carried out between August 2023 and May 2024. The ICO did not audit generative AI or biometric tools in that work.

• 296296

  recommendations the ICO made to AI recruitment tool providers in its audits

  ICO, AI tools in recruitment: audit outcomes report, November 2024

• 97%97%

  of those recommendations were accepted, 3% were partially accepted, and none were rejected

  ICO, AI tools in recruitment: audit outcomes report, November 2024

The findings matter to you as a candidate. The ICO found tools with a search function that let recruiters filter out candidates with certain protected characteristics. It found tools that guessed gender or ethnicity from a name. And it found tools that gathered far more personal information than needed and kept it for long periods, often without candidates knowing.

It also found good practice. Many providers monitored accuracy and bias. Most included some human review of outputs. The ICO said the tools it reviewed were designed to support human recruiters, and most gave only indicative grades or fit scores.

One more point is easy to miss. The ICO warned that human recruiters may be influenced by scores or predictions that might have limited scientific validity. A person in the loop is not the same as a fair decision.

What does UK law say about software deciding on your application?#

UK GDPR sets rules for significant decisions about you that are made with no meaningful human involvement. They need safeguards, and some uses of sensitive data are restricted. The Data (Use and Access) Act 2025 rewrote the rule in section 80. It replaced old Article 22 with new Articles 22A to 22D, and legislation.gov.uk shows section 80 in force on 5 February 2026, so far as not already in force.

In plain terms, as the Act is written:

• A decision is "solely automated" where there is no meaningful human involvement in taking it.
• A decision is "significant" where it has a legal effect on you or a similarly significant effect.
• Where a significant decision is solely automated, the organisation must have safeguards. You must be able to get information about the decision, make representations, obtain human intervention and contest it.
• If a significant decision uses special category data, it cannot be solely automated unless limited conditions are met, such as your explicit consent.

Two limits apply. First, the Act does not say whether a rejected job application is a significant decision. That depends on the facts. The ICO has draft updated guidance on automated decisions out for consultation, and the page we read gives no recruitment example. Second, the Act defines "solely automated" as having no meaningful human involvement. A decision with real human review is not solely automated, whatever software helped.

The ICO's recruitment audit adds practical points. It recommended that recruiters should not use AI scores, particularly fit scores, to make automated decisions where the tool is not designed for that. It also recommended a simple way for candidates to object to or challenge automated decisions, where tools make them.

What can you ask a firm or recruiter about your application?#

You can ask four questions, and you can ask them politely before you apply. The ICO says candidates should receive clear privacy information about how AI is used in processing their data. Questions are how you check that it is true.

Our guide on what to ask a legal recruiter before you send your CV goes through the wider list, including which firm the CV is going to. Salary is another question to settle early, and our piece on whether to tell a recruiter your current salary covers it. If you are checking whether an advert is real before you apply at all, read how to tell a real legal vacancy from a ghost job.

How do you write a CV that works for people and for software?#

Write for the person first. A plain, accurate CV is also the easiest for software to read. Nobody can promise what a particular system reads, because systems differ, so keep the format simple.

Our guide to how to read a legal job advert shows which phrases in the advert point to what the firm really wants. Mirror its language where it is true, and nowhere else. If you are still choosing roles, our jobs page shows the pay or earnings basis, the working pattern and the date on every advert, and the salary guide shows what firms are paying.

Do not use hidden text, keyword stuffing or invented experience. They are easy to spot and can end your application. The SRA tells candidates for its own roles not to use AI to invent, exaggerate or misrepresent experience, and says it will withdraw candidates who do. That is the SRA's rule for its own recruitment. It shows how seriously accuracy is taken.

What are the signs that a person is reading your application?#

Look for specifics. A person leaves traces that a template does not. You are more likely to be dealing with a human who has read your CV if you see these.

A written statement helps too. The SRA says on its recruitment page that applications and assessments are reviewed by people throughout its recruitment process. It does not say whether software is also used. Even so, a firm that states it in writing has given you something to point to.

Our article on why recruiters ghost lawyers and what good looks like covers what you should expect once you are in touch.

How do you see what a firm holds about you?#

Make a subject access request. It is a request for a copy of your personal information and the details of how it is used. You can make it in writing or verbally, to any contact at the organisation, and you do not need special wording.

• 1 month1 month

  the usual time an organisation has to answer a subject access request. Complex requests can be extended by up to two more months.

  ICO, A guide to subject access, updated 16 July 2026

In most cases the organisation cannot charge a fee. It may charge a reasonable fee if the request is manifestly unfounded or excessive, or if you ask for further copies. It can also pause the clock to ask for ID or to clarify a vague request.

Here is a short sample, in plain English. Send it by email to the firm's HR team or to the recruiter, and keep a copy.

Subject: Subject access request. Application for [role], [date] Dear [name], I applied for the role of [role] on [date]. I would like a copy of the personal information you hold about me, including any scores, rankings or notes from the screening of my application. Please also tell me whether any part of the decision on my application was made by automated means, and how long you will keep my data. Please reply within one month.

To withdraw your application and ask for your data to be deleted, say so in the same message. The ICO says the right to erasure applies, among other cases, where you withdraw consent or the data is no longer needed for its original purpose. It is not absolute, and the guidance is under review after the 2025 Act, so ask and see what they say.

What if you think software rejected you unfairly?#

Start with the firm, then escalate step by step. Most problems end at the first or second step, and a calm paper trail helps at every later one.

Keep every message and note the dates. Acas advises recording dates, evidence and witnesses. If you believe discrimination was involved, get advice quickly. Acas says tribunal claims have strict deadlines. Its page gives three months minus one day. GOV.UK says the time limit for most tribunal claims was extended to six months minus one day on 1 October 2026. The new limit applies only where the relevant date is on or after 1 October 2026 (regulation 4 of SI 2026/954). For unfair dismissal, that date is when employment ended. For most claims based on an act or failure, it is that act or failure, or the last in a series. Earlier events stay on three months. Check which limit applies to your claim.

A checklist before you send your next application#

If you would rather talk first, the screening call for lawyers is a confidential 20 minutes on Microsoft Teams. It costs you nothing, and no CV goes to a firm without your say so.

Sources

• ICO: AI tools in recruitment, audit outcomes report (November 2024)
• ICO: ICO intervention into AI recruitment tools leads to better data protection for job seekers (6 November 2024)
• legislation.gov.uk: Data (Use and Access) Act 2025, section 80 (automated decision-making)
• ICO: Automated decision-making, including profiling (draft updated guidance, March 2026)
• ICO: A guide to subject access (updated 16 July 2026)
• ICO: Right to erasure
• ICO: Make a data protection complaint
• legislation.gov.uk: Equality Act 2010, section 39 (employees and applicants)
• Acas: If you've been discriminated against at work
• GOV.UK Business: Unfair dismissal rights (page updated 1 October 2026; tribunal time limit change)
• SRA: Use of artificial intelligence in the SRA recruitment process
• GOV.UK (DSIT): Responsible AI in Recruitment guide (25 March 2024)
• legislation.gov.uk: The Employment Rights Act 2025 (Commencement No. 5 and Transitional Provisions) (Amendment) Regulations 2026, SI 2026/954, regulations 3 and 4

This is general information, not legal advice. Where a figure comes from another organisation, the source is above, and we say when it is dated.