AI CV screening against the job ad

The CV screening process sits at the front door of every hiring decision the organisation makes. When a new batch of CVs arrives for an open role, the HR manager and HR assistant each read through every application manually, compare it against the job advertisement, assign a numerical score, write a short reasoning note, and generate a set of suggested interview questions for each candidate. The resulting output is then passed to the hiring manager via email or a spreadsheet. This happens multiple times a day, adding up to roughly 2,600 runs per year and consuming an estimated 563 hours of HR time annually. At current rates, that represents approximately GBP 25,350 in staff cost dedicated to first-pass screening work alone.

The process is largely rule-bound for the standard case: does this person's background match the criteria in the job ad well enough to warrant an interview? Even so, somewhere between ten and fifteen percent of CVs arrive in non-standard formats or present edge cases that resist straightforward comparison, and those cases demand a different kind of attention. The organisation also operates under meaningful compliance obligations. Candidate data falls under GDPR, which means any automated processing must be covered by a data protection impact assessment. More significantly, the EU AI Act classifies automated recruitment scoring as a high-risk AI use case, which carries mandatory transparency, audit trail, and human oversight requirements. On top of that, the works council must be formally consulted before any system that evaluates people is introduced. These are not optional considerations; they are hard prerequisites that shape the architecture of any solution from the ground up.

The recommended path is Hybrid: an AI workflow that scores and reasons against the job ad for every candidate, followed by a mandatory human approval gate where the HR manager reviews, edits, or accepts the output before anything reaches the hiring manager. This is the right fit not because it is a convenient middle ground, but because the compliance environment makes it the only legally defensible design. The EU AI Act's high-risk classification for recruitment AI does not just suggest human oversight, it requires it. A human must be accountable for every decision that flows from the system, and that accountability has to be documented with an audit trail showing who approved what and when. Building the human gate in from the start means compliance is a design feature rather than a retrofit.

The fully automated AI Workflow path scored 6 and is technically viable, but it fails on the compliance dimension the moment it operates without a structured human review step. In practice, any AI Workflow implementation that takes the compliance requirements seriously would need to add a human approval step, which makes it a Hybrid by another name. The distinction matters because it affects how the workflow is designed, what the audit trail must capture, and how the works council engagement is framed. Calling it Hybrid from the outset avoids that ambiguity. The AI Agent path was scored 4 and is not recommended: the process steps here are linear and well-defined, there is no need for dynamic tool selection or multi-step reasoning loops, and an autonomous agent would reduce auditability without adding any meaningful capability. RPA scored 3 and is not the right primary tool because it cannot read and reason about unstructured CV text against a free-text job ad; it could play a minor routing role at best. Traditional Code scored 3 and is disproportionate given a one-person IT function and no stated engineering depth. Education alone scored 3 and would reduce some manual effort but cannot deliver consistent, auditable outputs at 2,600 runs per year.

The client has no strong technology preference and is constrained by a single-person IT function, a reality that directly shapes the platform recommendation. A managed low-code AI workflow platform, specifically Make or n8n, combined with an LLM API such as OpenAI or Anthropic, is the most realistic build path. These platforms offer enough flexibility to handle CV ingestion, structured prompt calls, output parsing, and a human approval interface, without requiring a custom codebase that only one person can maintain. The choice between Make and n8n will depend on whether the team prefers a fully hosted service with lower infrastructure overhead (Make) or a self-hosted option with more flexibility and lower per-operation cost at volume (n8n). Either way, the HR SaaS API upgrade is a prerequisite, not a nice-to-have. The current reliance on email and spreadsheets for data in and output out introduces inconsistency and manual handling that the automation is designed to eliminate. Without the API, the integration is either fragile or impossible.

One honest tradeoff worth naming: this architecture will not eliminate all HR time on screening. The human approval gate, by design, requires the HR manager to look at every AI output before it goes anywhere. The goal is not to remove the HR manager from the loop but to remove the part of their day spent reading CVs from scratch and writing reasoning from a blank page. If the AI does the first-pass analysis well, the manager's role shifts from author to editor and approver, which is a much faster task. The 70 percent time saving estimate is applied only to that routine first-pass effort, with the remaining 30 percent attributable to the approval gate and the exception cases that will always need full human attention. That is a conservative and defensible estimate, and it still represents a projected annual saving of approximately GBP 17,745 against a build cost range of GBP 8,000 to GBP 18,000, with a payback period of around nine months.

The works council consultation and the data protection impact assessment must come before any build work begins. This is not a procedural nicety; it is the legal prerequisite that determines whether the tool can be operated at all. Skipping or rushing this step to accelerate delivery is the single most likely way to be forced to withdraw the tool after launch. The recommendation is to treat compliance groundwork as phase one of the project, not as a parallel track.

The two paths worth comparing seriously are Hybrid and AI Workflow, because they share the same underlying technology and differ only in whether a human approval gate is built in as a structural requirement. The AI Workflow path scores a 6 and is technically viable: an LLM can read a CV, reason against a job ad, and return a score, reasoning, and interview questions without any human in the loop. The problem is not the technology, it is the legal context. The EU AI Act explicitly classifies recruitment scoring as high-risk AI, which means the organisation must be able to demonstrate that a human reviewed and was accountable for every output before it was acted upon. Running a fully automated AI Workflow without that gate would require the works council to sign off on a system that makes unsupervised candidate evaluations, and that sign-off is extremely unlikely to be granted. In practice, any team that tried to run the AI Workflow path honestly would end up adding a human review step anyway, at which point they have built a Hybrid without calling it one.

The Hybrid path scores a 9 precisely because it matches the compliance reality from the start rather than treating the human gate as an afterthought. It automates the routine first-pass effort, which accounts for the bulk of the 563 annual hours, while keeping the HR manager accountable for every output that reaches a hiring manager. The AI Agent path was considered and rejected because the process steps here are linear and well-defined: there is no need for an agent to dynamically choose tools, loop on partial information, or plan multi-step sequences. Adding that complexity would reduce auditability and increase the surface area for things to go wrong without adding any capability the process actually needs. RPA and Traditional Code were both assessed and neither is a realistic fit: RPA cannot reason over unstructured CV text, and building a custom NLP pipeline in-house is disproportionate given a single-person IT function. Hybrid is the right call, and the case for it is straightforward.

The first and non-negotiable step is the compliance groundwork, and it has to happen before any build work begins. The works council needs a written description of what the tool does, what it outputs, and critically, what the human approval gate looks like in practice. Alongside that, a GDPR Data Protection Impact Assessment must be completed for the processing of candidate data by an external LLM API, which means deciding whether to use a provider such as OpenAI, Anthropic, or Azure OpenAI Service with a data processing agreement and EU data residency configured. Neither of these steps can run in parallel with the build, and skipping them creates legal exposure that could force the tool to be withdrawn after launch. Budget three to four weeks for this phase and treat it as the project's critical path.

Once the compliance groundwork is cleared, the next step is upgrading the HR SaaS subscription to activate the API tier and mapping the data fields. The workflow needs two inputs per run: the job ad text and the CV text. The output schema should be agreed at this point, before any prompts are written, because the downstream approval interface and the AI prompt need to be aligned. A practical schema is a numeric score from one to ten, two to three paragraphs of reasoning tied to specific job ad criteria, and three to five suggested interview questions tailored to the candidate. Defining this upfront means the LLM can be instructed to return structured JSON that the workflow platform parses directly, avoiding brittle text extraction later.

The core workflow is then built on a low-code platform such as Make or n8n. The data flow runs as follows: a new CV lands in a monitored email inbox or is uploaded to the HR SaaS, the workflow retrieves the associated job ad from the SaaS via API, both documents are passed to an LLM API call with a structured system prompt, the response is parsed into the agreed schema, and the result is written back to the HR SaaS and queued in the human approval interface. CVs that fall below a confidence threshold or that the LLM flags as non-standard are automatically routed to the HR assistant for manual handling, keeping the ten to fifteen percent exception cases out of the automated scoring flow entirely. The prompt should be calibrated against fifty historical CVs scored by the HR manager before go-live to validate that the AI output aligns with human judgment on the standard cases.

The human approval gate is what makes this a Hybrid rather than an AI Workflow, and it needs to be built as a first-class part of the system rather than a manual workaround. The HR manager receives a structured summary view, either inside the HR SaaS or via a simple approval interface built in the workflow platform, showing the AI score, reasoning, and questions for each candidate. The manager can approve, edit, or reject the output. The system records who approved, what they approved, and when, creating the audit trail that the AI Act requires. Once the gate is confirmed and the workflow has run in parallel with the existing manual process for two to three weeks on live roles, the spreadsheet-based manual process can be decommissioned. The parallel run is important: it surfaces any prompt quality issues or edge cases before the team is relying on the automated output exclusively.