CV screening software for recruitment agencies UK (2026): the rule changed in February and it changed what you are buying

I build one of the tools mentioned on this page, so read it with that bias in mind.

Almost every "best AI CV screening tools" roundup you will find was written to a US template, then had the word CV swapped in for resume. It will rank tools by accuracy, speed and integrations, and it will price them in dollars. For a UK agency that list is missing the single most important thing that happened to CV sifting this year.

On 5 February 2026, section 80 of the Data (Use and Access) Act 2025 came into force and replaced Article 22 of the UK GDPR with four new articles, 22A to 22D. The old Article 22 was a prohibition. Solely automated decisions with a legal or similarly significant effect were banned unless you fitted one of three narrow gateways: explicit consent, contractual necessity, or authorisation in law. Shortlisting is a decision affecting someone's employment position, so under the old rule, a tool that auto-rejected candidates without a human in the loop was legally awkward by default.

That prohibition is largely gone. The new regime is permissive and safeguard-led. You can now run automated significant decisions on the ordinary lawful bases, legitimate interests included, without hunting for consent. The catch is that the safeguards are no longer optional extras attached to a rare edge case. They are the price of admission for everybody, and there are four of them.

So the buying question for a UK agency in 2026 is no longer "how good is the matching". It is "when a candidate asks why they were cut, can this tool hand me an answer I can defend, and did a human see it first". A tool that gives you a number and no reasoning cannot help you answer that, however good the number is.

That is the lens this page sorts by. Prices in pounds where the vendor publishes them, read off their own pricing pages in August 2026.

Contents

• Quick summary
• Why should you listen to us?
• What actually changed on 5 February 2026
• The special category trap that makes a CV the awkward document
• What the ICO has actually found when it looked
• The four questions to take into every demo
• What UK CV screening actually costs
• The vendors, grouped by what they really are
• Four things the US roundups get wrong about the UK
• Where Gemsift fits, and where it does not
• FAQ

Quick summary

• The law changed on 5 February 2026. Section 80 of the Data (Use and Access) Act 2025 replaced Article 22 UK GDPR with Articles 22A to 22D. Automated shortlisting went from presumptively prohibited to permitted, on condition that four safeguards are in place.
• The four safeguards are the new spec. Tell people the decision was automated, let them make representations, give them meaningful human intervention, and let them contest it. Every one of those needs a written reason to exist. A bare score cannot produce any of them.
• Special category data is the exception that survived. Where a significant decision is based on special category data, the old strict rule still applies. A CV is a document that arrives carrying special category data you never asked for.
• The ICO has already looked and has already found problems. Its November 2024 audit of AI recruitment tools issued nearly 300 recommendations, and found tools inferring gender and ethnicity from candidate names and letting recruiters filter out applicants with protected characteristics.
• UK pricing is structured differently from the US. The pattern here is a per-seat CRM licence with AI sold as a second line item, often per agency rather than per user. Vincere publishes an ATS from £69 per user per month with AI from £25 per agency per month on top. Bullhorn's UK site publishes £80 and £120 per user per month, and puts AI search, match and agentic screening in the two tiers that are quote-only.
• Most UK vendors do not publish a price at all. Firefish, Eploy, Hireserve, idibu, Teamtailor, JobAdder, Recruit CRM and Occupop all ran on "book a demo" when we read their pricing pages this month.
• Setup fees are a real UK thing. Tribepad publishes a £2,000 set-up cost next to a £579 per month entry plan. US roundups almost never mention implementation fees, because most US self-serve tools do not charge them.

Why should you listen to us?

I am the founder of Gemsift, an AI-native ATS for recruitment agencies. That makes me an interested party, so this page is written to be checkable rather than trusted.

Two things ground it. First, primary sources read this month rather than remembered. The commencement date and the text of Articles 22A to 22D come from the legislation and from the practitioner analysis of it, the ICO findings come from the ICO's own audit and its 2026 report on automated decision-making in recruitment, and every price below was read off the vendor's own pricing page in August 2026 rather than copied from another listicle. Where a vendor did not publish a price, I say so instead of quoting a range I heard somewhere.

Second, conversations with owners of small UK and US agencies about what actually happens when three hundred applications land on a Tuesday. That is where the practical half of this comes from: nobody loses a tribunal claim because their matching algorithm was 4% less accurate. They lose because they cannot reconstruct why anybody was cut.

I am not a lawyer and this is not legal advice. Take advice on your own setup. What I can do is tell you which product characteristics make the compliance question easy and which make it hard, because that part is a product question and I work on it every day.

What actually changed on 5 February 2026

The short version, for a recruiter rather than a data protection officer.

Before. Article 22 UK GDPR said a person has the right not to be subject to a decision based solely on automated processing which produces legal effects or similarly significantly affects them. In practice that read as a prohibition with three exits: explicit consent, necessity for a contract, or authorisation by law. Recruitment shortlisting is generally treated as a significant decision, so if your software auto-rejected people, you needed one of those exits, and the honest ones were awkward to get.

After. Section 80 of the Data (Use and Access) Act 2025 swapped Article 22 for a set of four articles.

• 22A defines a significant decision as one producing a legal effect for the data subject, or having a similarly significant effect. Decisions affecting someone's employment position are the standard example.
• 22B deals with special category data. More on that in a moment, because for CV screening it is the important one.
• 22C sets out the safeguards a controller must have in place. The measures must provide the data subject with information about decisions, enable them to make representations about such decisions, enable them to obtain human intervention on the part of the controller, and enable them to contest the decision.
• 22D lets the Secretary of State make regulations defining things like what counts as meaningful human involvement, which means this settles further rather than being finished.

The general prohibition is largely removed and you can rely on ordinary lawful bases, including legitimate interests. The DUAA also lifted the old limitation to consent or contractual necessity for recruitment, provided no special category data is involved.

Read the four safeguards again as a product specification, because that is what they are. Information about the decision. Representations. Human intervention. Contest. Every single one of them presupposes that a decision has a stated reason attached to it. You cannot inform somebody about a decision that exists only as the number 61. You cannot let them make representations against it, because there is nothing to argue with. A human cannot meaningfully intervene in it, because there is nothing to review beyond the ranking. And they cannot contest it, because there is no proposition to contest.

That is why "does it explain itself" stopped being a nice-to-have in the UK on 5 February. It is the feature that all four safeguards run through.

The special category trap that makes a CV the awkward document

Article 22B kept the strict rule for one category of case. Where a significant decision is based on the processing of special category data, it may not be taken based solely on automated processing unless a narrow condition is met, essentially explicit consent or a substantial public interest basis.

Special category data means racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic and biometric data, health, sex life and sexual orientation.

Now think about what actually arrives in your inbox. A CV is an unstructured document that a stranger wrote about themselves with no field validation, and UK candidates routinely put things in it that are special category data by definition:

• A photograph, which is how a lot of European-formatted CVs come.
• Volunteer work for a church, a mosque, a synagogue or a political party.
• Trade union roles, which are common and often a genuine leadership credential on an industrial or public sector CV.
• A disability disclosure, a career gap explained by illness, or a note about reasonable adjustments.
• A name, a nationality line, or a language section from which ethnicity can be inferred, correctly or otherwise.

You did not ask for any of it. You cannot stop it arriving. And if your screening tool reads the whole document, it is processing it.

This is the practical reason I would not build a fully automated reject path for CV screening in the UK even now that the general prohibition has gone. The moment the decision leans on that material, you are back under the strict rule and looking for explicit consent you almost certainly do not have. Keeping a human on the reject decision, with a written reason in front of them, sidesteps the whole argument. It also happens to be how good recruiters already work.

What the ICO has actually found when it looked

This is not theoretical risk. The regulator has already audited this exact product category.

The November 2024 audit. The ICO ran consensual audits of AI tool developers and providers used in sourcing, screening and selection, carried out between August 2023 and May 2024, and published the outcomes report on 6 November 2024. It made nearly 300 recommendations, all of which the providers accepted or partially accepted. Among the findings: some tools were processing personal data unfairly, for example by inferring characteristics such as gender and ethnicity from a person's name, and some allowed recruiters to filter out applicants with protected characteristics. It also flagged tools collecting more personal data than necessary and lacking clear retention schedules.

Sit with that middle finding for a second. A commercial recruitment product, in the field, with a filter that screens people out by protected characteristic. That is the Equality Act problem and the data protection problem arriving in the same click.

The 2026 recruitment report. On 31 March 2026, alongside a consultation on new draft ADM guidance, the ICO published a report on automated decision-making in recruitment drawing on evidence from more than thirty employers. Its headline finding was that many employers did not recognise that what they were doing was automated decision-making at all, and had not put the safeguards in place. It also pressed on the thing that decides your exposure: human involvement has to be meaningful and active rather than a rubber stamp.

A recruiter clicking accept on the top ten of a ranked list they cannot interrogate is a rubber stamp. A recruiter reading a written reason per candidate, disagreeing with two of them, and overriding is meaningful involvement. Same amount of clicking. Completely different position if anyone ever asks.

We wrote about the meaningful involvement point and the retention rules in more detail in how to reactivate your candidate database without burning it and how to rediscover past applicants for a new role, so this page will not repeat that ground.

The four questions to take into every demo

Everything above collapses into four questions. They are boring and they work, and they will tell you more about a tool in ten minutes than a feature matrix will in a week.

1. Show me a rejected candidate and the reason, as a candidate would receive it. Not the score. Not the matched keywords. A sentence a human wrote or a model wrote that a human can read, disagree with, and act on. If the demo pivots to "our model is 94% accurate", you have your answer.

2. Can the system reject anyone without a human clicking? If yes, find the setting that turns it off, and check it is off by default. Then ask what the audit trail records when a human does click: the reason shown, the time, the person.

3. What does it do with a photo, a disability disclosure or a union role in the document? You want to hear about redaction, exclusion or explicit non-use. If the honest answer is that everything in the document goes into the model, that is workable with a human on the reject path, and much less workable without one.

4. Has it been tested for bias, and will you show me the result? The ICO's position is that you should be questioning your supply chain about this. Vendors that have done the work will tell you. Vendors that have not will talk about how their AI is unbiased because it does not see names, which is a claim the ICO's own audit found does not survive contact with a name-based inference.

Note what is not on this list: accuracy, speed, and number of integrations. Not because they do not matter, but because they are the questions every vendor is already prepared for.

What UK CV screening actually costs

Read off vendor pricing pages in August 2026. Prices change quietly and often, so confirm on the vendor's own site before you rely on any of it. Where a vendor prices in dollars, I have left it in dollars rather than converting, because that is a real fact about the purchase.

Two patterns fall out of that table, and neither shows up in a US listicle.

The UK sells AI as a second line item. Vincere is the clearest example: the ATS is per user, the AI is per agency, and you cannot buy the second without the first. Bullhorn's UK page does the same thing by tiering, with the published prices on the two plans that do not include AI search and match, and a sales conversation on the two that do. If you are budgeting for CV screening in the UK, budget for two numbers, not one.

Setup fees are alive here. A £2,000 implementation charge on top of £579 a month is a normal UK enterprise-software shape and a serious number for a four-person agency. We wrote about the entry floor and the exit cost in more detail in ATS for a small recruitment agency.

The vendors, grouped by what they really are

Ranking these one to ten would be dishonest, because they are not the same kind of thing. Group them by the job instead.

Full UK agency ATS with screening inside. Vincere, Firefish, JobAdder, Access Recruitment, Mercury xRM, Bullhorn, Recruit CRM, Recruitly, Manatal, Crelate. This is where most UK contingency agencies end up. The screening is a feature of the system of record. Strength: one system, one dataset, one bill. Weakness: the reading quality is whatever the vendor decided to build, and on several of these it is a scoring number rather than a written reason, which is exactly the thing the February rules made expensive.

In-house and employer platforms that agencies get sold anyway. Tribepad, Eploy, Hireserve, Teamtailor, Talos360, Occupop. Genuinely good products aimed at employers filling their own vacancies. Talos360's per-employee pricing gives the game away. If you are a contingency desk submitting to clients, you will be paying for workflow you do not use, and missing the client and placement side you do.

Assessment and interview layers. Willo, Applied, Arctic Shores, Sova, Thomas International. These do not sift your CV pile, they replace or supplement the interview with structured assessment. Applied is worth knowing about for a different reason: its whole design premise is reducing CV bias through structured work-sample review, which is an interesting answer to the same regulatory pressure from the opposite direction. Wrong category if your problem is three hundred CVs on a Tuesday, right category if your problem is that your shortlist keeps interviewing badly.

Multiposting and application flow. idibu. Its job is getting your advert onto UK boards and pulling applications back. Screening is secondary. Buying it to solve a sifting problem is a category error.

AI-native systems of record. Gemsift, and increasingly the AI story from the incumbents above. The premise is that reading the base is the product rather than a module bolted onto storage. I build one of these, so weigh that accordingly, and see the shift to AI-native recruiting for what I mean by the category.

Four things the US roundups get wrong about the UK

1. The job boards are different, and it matters more than the ATS brand. Your applications come from CV-Library, Reed, Totaljobs, Indeed and LinkedIn, and increasingly through job aggregators. A tool with beautiful Greenhouse and Lever connectors and no UK board integration solves a problem you do not have. Ask specifically which UK boards it ingests from, and what happens to a .doc CV from 2019 that CV-Library hands over.

2. Contract terms are heavier here. Annual commitment is the UK default even where the price is quoted monthly. Tribepad's own page spells out an annual commitment on both its monthly and annual payment options. Zoho Recruit's "no forced contracts" line stands out precisely because it is unusual in this market.

3. Most of them quote. Eight of the vendors above would not tell us a price without a call. That is not a scandal, it is how UK recruitment software has always been sold, but it changes your buying process. Budget the calls, and ask for the number in the first fifteen minutes rather than the third meeting.

4. The compliance layer is UK-shaped and no US page covers it. Everything in the first half of this article. A US roundup will talk about NYC Local Law 144 or Illinois, which do not apply to you, and will not mention section 80 of the DUAA, which does.

Where Gemsift fits, and where it does not

This is the pitch, marked as one.

Gemsift is an AI-native ATS for recruitment agencies. You move in with one export file from your old system, and it re-reads your whole candidate base against every new role automatically, returning a client-ready shortlist with a plain-English reason per pick, plus flags where something needs checking on the call. Free on a base of 100 people with no card, Solo $99 a month for a base of 1,000, Agency $299 a month for 5,000 and three seats, Scale from $899, annual billing is two months free. Full export, CSV or JSON, whenever you want out.

The reason it appears on a page about UK regulation is that the written reason is not a compliance feature we added in February. It is the output. Every score arrives with the reasoning attached, a human decides, and the trail of what was shown and who decided exists because that is how the product works. If you go looking for a tool that can satisfy the four safeguards without changing how you work, that shape is the one you are looking for, whether you buy it from me or from somebody else.

Now the honest disqualifications, which matter more than the pitch.

• It is deliberately not everything a classic platform is. No job-board posting, no interview scheduling, no HRIS, no two-way email sync. If your desk runs on posting to CV-Library from inside your ATS, that is a real gap and a heavier UK system is the better buy. Read the section on our own home page that says this before you move anything.
• We price in dollars. For a UK agency that means an FX line on the card. Vincere, Bullhorn UK, Tribepad and Talos360 will bill you in pounds.
• Pure outbound headhunters do not need this. If you are not fielding inbound applications and you are not sitting on a base you have already paid for, the whole premise does not apply and you should be buying sourcing, not reading.
• Single-digit applications per role does not need this either. If ten people apply, read them. Software is the wrong answer.
• Heavy integrations and enterprise compliance procurement. If your client contracts require a specific security questionnaire, SSO estate and a named integration list, a traditional ATS will clear that bar and we will not, today.

If you want to see the difference between a keyword search and a read of the same base, you can do it on sample data without uploading a single CV. That is the fastest way to work out whether any of this is a real difference or just my marketing.

FAQ

Is AI CV screening legal in the UK in 2026? Yes, and it got more permissive on 5 February 2026 rather than less. Section 80 of the Data (Use and Access) Act 2025 replaced the old Article 22 prohibition with a safeguard-led regime, so you can now run automated significant decisions on ordinary lawful bases including legitimate interests. What you cannot do is run them without the safeguards: information about the decision, a route to make representations, meaningful human intervention, and a way to contest. And where the decision is based on special category data, the old strict rule still applies. Not legal advice, and the ICO's detailed guidance was still being consulted on through mid-2026, so check the current position.

Do I have to keep a human in the loop for CV sifting? Not automatically, not any more, for decisions that do not involve special category data. But there are two good reasons to anyway. First, a CV routinely contains special category data you never asked for, which drags you toward the stricter rule. Second, "meaningful human intervention" is one of the four safeguards regardless, and the ICO has been explicit that it has to be active rather than a rubber stamp. Keeping a person on the reject decision with a readable reason in front of them is the cheapest way to be obviously fine.

What is the difference between CV screening software and an ATS? An ATS is the system of record: candidates, jobs, pipeline, clients, placements. CV screening is the reading step: deciding who in a pile is worth a call. In the UK most agencies buy them together, and vendors increasingly sell the screening as a priced add-on to the ATS licence rather than as part of it. Vincere is the clearest published example, with the ATS per user and the AI per agency on top.

How much does CV screening software cost in the UK? It depends whether the vendor will tell you. Published prices we could read in August 2026 ranged from £69 per user per month for Vincere's ATS, plus £25 per agency per month for its entry AI package, to £579 per month plus a £2,000 set-up for Tribepad, to £833 per month for Talos360. Bullhorn's UK site publishes £80 and £120 per user per month for its two lower tiers. Eight of the vendors we checked published no price at all. Confirm any of these on the vendor's own site, because they move.

Half the CVs are AI-written now. Will screening software just be fooled? This is the problem the category exists for. The useful behaviour is judging what someone actually did rather than how polished the writing is, cross-checking claims against the work history, and flagging generic filler for your review rather than silently downranking it. What you do not want is a tool that penalises "looks AI-written", because honest candidates now write to the filter too, and you will cut good people for having used a spellchecker with opinions. We wrote about the underlying failure mode in why keyword filters keep rejecting good candidates.

Does the EU AI Act apply to my UK agency? Possibly, if you place candidates into the EU or use a provider established there, because employment and recruitment systems are classified as high-risk under it. It is a separate regime from UK data protection law and it does not replace the DUAA analysis above. If any meaningful share of your placements are EU-side, that is a conversation to have with an adviser rather than with a listicle.

Which CV screening tool is best for a small UK agency? There is no single answer, which is why this page groups rather than ranks. If you want the cheapest published entry to a full agency ATS, Manatal and Zoho Recruit publish the lowest numbers. If you want a UK-billed agency-native system, Vincere publishes a price and Bullhorn publishes two tiers. If you are an employer rather than an agency, Tribepad and Talos360 are built for you. And if your actual problem is that your existing base has become a filing cabinet nobody can read, that is the problem Gemsift is built for, and you can test it free on a base of 100 without a card.

---

Regulatory positions in this article were read from primary sources in August 2026: the text of section 80 of the Data (Use and Access) Act 2025 and the Articles 22A to 22D it inserts, practitioner analysis of its 5 February 2026 commencement, the ICO's AI tools in recruitment audit outcomes report of November 2024, and the ICO's March 2026 report on automated decision-making in recruitment. Vendor prices were read off vendor pricing pages in August 2026. Laws and prices both change, sometimes quietly. Confirm current status before relying on any of it, and take legal advice on your own situation rather than mine.

Gemsift is the AI-native ATS for agencies whose current ATS has become a filing cabinet. Move in with one file and it re-reads your whole candidate base against each new role, returning a client-ready shortlist with a plain-English reason per pick. Start free, no card.