AI Resume Screening: Bias and Compliance Guide for HR Teams

AI Resume Screening: Bias and Compliance Guide for HR Teams

In resume screening, AI helps organize, summarize and compare applications against written criteria, but it should not decide on its own who moves forward and who is rejected. Safe use depends on criteria tied to the role, human review of every decision that affects a candidate, minimal collection of personal data, and a record of what was done. Without those controls, a company automates the bias it already had and loses the ability to explain its own choices.

Key takeaways

• AI is useful for support tasks: standardizing resumes, extracting information, comparing against requirements and preparing a summary for the HR person.
• The decision to reject or advance a candidate should stay with a person who can explain the reason based on the criteria for the role.
• Bias does not disappear with a newer model. It comes from the criteria, from the history used as a reference and from the data the system sees.
• LGPD (Brazil's data protection law) asks for a clear purpose, necessity, transparency and the possibility of reviewing automated decisions that affect the candidate.
• Criteria, instruction versions, exceptions and human reviews need to be recorded so the process can be audited and corrected.

Where does AI really help in resume screening?

The safest gain is in the repetitive tasks that come before judgment. An HR team that receives many applications for the same role spends much of its time opening files in different formats, looking for the same information in different places and rewriting summaries. That is where AI adds value without taking over the decision.

The uses that usually make sense:

• Extracting structured data from PDFs and documents: previous job titles, education, tools, languages, work location.
• Comparing the resume content with objective requirements for the role and showing, with a supporting excerpt, what was found and what was not.
• Generating a standardized summary for the recruiter, always shown next to the original resume.
• Flagging incomplete or duplicate applications and asking for the missing information.
• Drafting follow-up and scheduling messages, with human review in sensitive cases.

Notice the pattern: AI organizes and points to evidence. It does not hand over a magic score or a list of approved candidates. When each statement comes with the excerpt from the resume that supports it, the reviewer can check quickly and disagree with confidence.

Where should the decision stay with a person?

Some decisions carry a high cost of error, and context matters more than the text of the resume. Rejecting a candidate is one of them. Resumes describe careers in very different ways: a person may have a gap because they cared for family, changed fields by choice, or described real experience in words the model does not associate with the role.

As a decision rule, use this guide:

• If AI only formats, summarizes or extracts data, review can be done by sampling.
• If AI suggests an order or a comparison, every suggestion must be seen by a person before any action is taken.
• If the action is to reject, fail or stop contacting a candidate, the decision always belongs to a person, with the reason recorded.
• If the case involves a person with a disability, a leave of absence, a career change, an internal application or any other exception, the case leaves the automatic flow and goes straight to human review.
• If AI does not find enough evidence, it says it did not find it and does not fill the gap with an assumption.

This separation also protects the company legally and in terms of reputation. The company must be able to tell a candidate, or its own leadership, who decided and why. An answer such as the system did not select you does not hold up.

Where does bias come from in AI resume screening?

It is common to assume the bias lives only in the model. In practice it usually enters through four doors, and three of them are under the company's control.

• Poorly defined criteria: asking for a proactive profile, good presentation or culture fit without defining what that means leaves room for arbitrary interpretation, whether human or automated.
• History as a reference: if the tool learns from, or is guided by, people hired in the past, it tends to repeat the pattern of who the company already hired.
• Irrelevant data: photo, name, age, address, marital status, children, school attended and gaps in the resume can work as shortcuts to discrimination, even without intent.
• Resume language: models may favor people who write in a certain way, with certain terms, and penalize those who describe the same skill differently.

The practical measures are simple to list and take discipline to maintain. Remove from the material sent to the AI any data that is not needed to assess the requirements of the role. Write observable criteria, such as experience with a specific tool or a required license. Test the flow with resumes from varied profiles and check whether the AI treats equivalent descriptions equivalently. And repeat this whenever the model, the instruction or the role changes.

At this point it helps to separate what is documentation, what is implementation experience and what is hypothesis. That bias can enter through data and criteria is a concern covered in official risk management references such as the NIST AI Risk Management Framework. That comparative tests before and during operation help detect deviations is implementation practice. That one model is less biased than another is a hypothesis, and it only holds after you test it with your own cases.

What does LGPD require when screening resumes with AI?

A resume is personal data, and it often carries data that deserves extra care, such as health information, disability, origin, religion or union membership. When you add AI to the flow, the company remains responsible for the processing and needs to answer a few questions before starting.

• What is the purpose? Assessing applications for specific roles. Using the same data for another purpose requires a new analysis.
• What is the legal basis? Legal counsel or the data protection officer should define and record, case by case, the basis that applies to the hiring process.
• Is the data necessary? The necessity principle asks you to collect and send to the AI only what serves the assessment.
• Is there transparency? Candidates should know, in clear language, that their data is processed and that automated systems support the process.
• Is review possible? Article 20 of LGPD provides the right to request review of decisions made solely on the basis of automated processing that affect the data subject's interests, including those meant to define a professional profile. If there is real human review of every decision, this risk is lower, but the channel and the procedure still need to exist.
• How long is the data kept? Define a retention period for the resumes of people who were not hired and communicate it.
• Who else receives the data? The AI provider, the recruiting platform and cloud services belong on the list of processors and subprocessors, and contracts need to reflect that.

When the processing involves relevant risk to candidates, it is worth preparing an impact assessment. We wrote about when to do it and what to include in data protection impact assessments for AI projects. For a broader view of the obligations, see also LGPD and artificial intelligence: what companies should do. The Brazilian data protection authority (ANPD) publishes official guidance, and the topic should go through the company's legal team before going into production.

One piece of context: laws in other countries already treat recruiting systems as a higher-risk use, as the overview of the EU Artificial Intelligence Act shows. This does not automatically apply to a Brazilian company, but it indicates where governance expectations are heading, especially for those who recruit candidates from other countries.

How do you document criteria, instructions and decisions?

Documentation is what turns AI-assisted screening into an auditable process. Without records, you cannot explain a decision, fix an error or show that the same criteria were applied to everyone. The useful minimum fits on one page per role.

Documentation checklist:

• Job description with mandatory and desirable requirements, written in observable terms.
• List of data the AI may see and list of data removed before sending.
• Version of the instruction given to the AI, with the date of change and the person responsible.
• Expected output: summary format, required fields and the rule that every statement cites the excerpt from the resume.
• Routing rules: which cases go straight to a person and which must never be rejected without review.
• Record of each human decision: who decided, when and for what reason, linked to the criteria for the role.
• Record of disagreements: cases where the person disagreed with the AI, because they are the best source of adjustments.
• Channel for candidates to ask for information or review, with an internal response deadline.
• Retention period and routine for deleting data.

This set follows the idea of validating the inputs, outputs and actions of the system. To see how that works in agents, read Guardrails for AI agents: input, output and action controls. In screening, the most important guardrail is simple: the AI never carries out the rejection.

How to start: an illustrative scenario and a pilot

Illustrative scenario: a services company opens an administrative analyst role and receives applications by email and through a form. Today, one HR person opens each file and builds a spreadsheet. In the pilot, the flow becomes: the resume arrives, a deterministic step removes the photo, date of birth, marital status and full address, and the AI extracts experience, tools and education into a standard profile sheet and marks each requirement as found, not found or uncertain, always with the source excerpt. The HR person sees the sheet next to the original resume, decides who moves on to an interview and records the reason. Cases marked as uncertain, or with a request for accommodation, go straight to manual review. Nobody is rejected by the system.

The method we apply to this type of project follows four steps, with no promise of results:

• Map: describe the current process, where resumes come from, who decides, how long each step takes and where rework happens. This becomes the baseline.
• Limit: define which data the AI sees, which actions it can perform (none involving rejection) and who approves each step.
• Pilot: run one role or one family of roles, with records and a success metric agreed in advance, such as time to prepare the profile sheet and the rate of corrections made by the reviewer. To structure the measurement, see How to measure an AI automation pilot.
• Transfer: hand over documentation, the review routine and an internal owner, then decide whether to expand, adjust or stop.

One practical point: if part of the contact with candidates happens on WhatsApp, also define when the conversation passes to a person and what data can be requested there. The WhatsApp AI agent human handoff playbook covers that design. This care applies to screening as much as to any automated service.

Frequently asked questions

Can I use AI to rank candidates? It is technically possible, but it is the form of use that concentrates the most risk, because the order influences who the HR person reads first and can become the decision in practice. If the company chooses to do it, it should have objective criteria, effective human review, tests with varied profiles and a record of disagreements. A safer alternative is to show the comparison per requirement, without a single score.

Does LGPD prohibit automated decisions in recruiting? LGPD does not prohibit automated processing, but it guarantees the data subject the right to request review of decisions made solely on that basis, including those that define a professional profile, and it requires clear information about criteria and procedures. Keeping a person as the decision maker, with the reason recorded, reduces the risk, but the analysis of your case belongs to legal counsel or the data protection officer.

Do I need to tell candidates that I use AI? Transparency is an LGPD principle, so the recommendation is to state clearly, in the privacy notice for the hiring process, that automated systems support it, for what purpose and how to ask for clarification or review. The exact wording should be validated by legal counsel.

How do I know if AI screening is working well? Compare the AI's profile sheet with a person's reading on a sample of resumes, track how often corrections are needed and check whether equivalent descriptions receive equivalent treatment. If corrections are frequent or concentrated in certain profiles, adjust the criteria and instructions, or stop using it for that role. Defining these decision gates before the pilot avoids deciding by impression.

Sources

• NIST AI Risk Management Framework
• ANPD: Autoridade Nacional de Proteção de Dados
• EU Artificial Intelligence Act overview