Yes, a small business can use AI in hiring, and the rule that keeps you safe is a line between helping and sorting. AI that drafts, schedules or summarizes is low risk. AI that ranks, scores, filters or rejects people needs a named person who can read the application behind each result and overturn it. Regulators in the UK and Illinois are asking for exactly this.
The pressure to cross that line is real. In a July 2026 survey of 1,000 US small business owners and hiring decision-makers, run for the payroll software vendor Patriot Software, 56.4% said AI-written resumes and cover letters make qualified candidates harder to identify. When 120 applications land for one job, a tool that sorts them looks like rescue. Sometimes it is. This guide shows where it stops being one, and gives you a sheet to copy.
What can AI do in hiring without much risk?
AI can draft, schedule and summarize, because in each case a person reads the output before anything happens to a candidate. Drafting the job ad, writing the interview questions every candidate will get, proposing interview slots, writing a polite regret email that a person sends, and condensing one application into notes all sit here.
What they share is that the AI never changes the candidate's route. If the ad is poor, you fix the ad. If the summary is wrong, the reader who has the original application in front of them catches it. If you want the ad to match the role as it now exists, start from the Core and Margin Rule for job descriptions and paste that, not last year's ad, into the tool.
One caution on the chat assistant that answers candidate questions. Tell candidates it is AI, and let them reach a person. The Surprise Test applies to applicants as it does to customers.
Where is the Sort Line?
The Sort Line is where I suggest a small business draws the border in hiring AI. Above the line, AI drafts, schedules and summarizes, and a person acts on the result. Below it, AI ranks, scores, filters or rejects people, and every application it touches must be readable by a named person who can overturn the result. If you cannot name that person, the step stays above the line.
I use the line because the legal words (automated decision-making, high-risk system, consequential decision) are hard for an owner to apply at a desk, while "did the AI put these people in order?" is a question anyone can answer. Copy the sheet below, fill in the right-hand columns, and you have a record of where your own line sits.
| Hiring step | What AI may do | Side of the line | Named owner | Check before it counts |
|---|---|---|---|---|
| Write the ad | Draft the text | Above | Hiring manager | Matches the role's core and margin |
| Answer candidate questions | Reply from facts you approved | Above | Office manager | Says it is AI; a person can take over |
| Schedule interviews | Propose slots | Above | Office manager | Same offer to every candidate |
| Summarize an application | One page of notes | Above | Reviewer | Reviewer reads the original, not only the notes |
| Rank or score applications | Put the list in order | Below | Hiring manager | Every application at this stage is read, not the top slice |
| Filter out or reject | Apply a rule you wrote | Below | Hiring manager | Rule is written down, tested, and rejections are reviewable |
| Rate video, games or tests | Score the answers | Below | Hiring manager | Vendor has told you in writing how it tested accuracy and bias |
| Make the offer | Nothing | Human only | Owner | A person decides |
Two rows deserve a second look. The built-in "match score" or "recommended" badge in your job board or applicant tracking system is a ranking, whether or not anyone called it AI. And a tool that scores a video interview is a rating of a person from a recording, which is where the regulators have found the most to worry about.
Why does reading the top of the list not count as a human check?
Because everyone below the cut-off received a decision from the machine alone. Take 120 applications, ranked by a tool, with the owner reading the top 15. The owner will say a human reviews the hiring. The other 105 would say nobody read their application.
The UK Information Commissioner's Office (ICO) made this point in its March 2026 report, Recruitment rewired. It found that many employers using automated recruitment are likely relying on solely automated decisions, and it recommended that any meaningful human involvement be applied consistently across all candidates at each hiring stage. The ICO's introduction adds that a tool built to support a human decision can end up making it. The test is whether a person really shapes the outcome, whatever the product brochure calls the feature.
You have three honest ways to fix it:
- Read every application at the stage. With 120 applications and a one-page summary each, that is a morning, and it is the cheapest fix.
- Use AI to organize, not to rank. Summaries and a tick-list against the ad's must-haves let you read everyone without the tool deciding who goes first.
- Shrink the pile before the stage. Add one job-specific question to the application form, so fewer people reach the stage and you can read them all.
Sampling the bottom of a ranking is worth doing, but it is a bias check, not human involvement. Call it by its right name.
What do the UK and US rules expect from a small employer?
In short: tell candidates, keep a person in charge, and watch for bias. This is general information from the sources below, not legal advice, and a short call with an employment lawyer is cheap next to a complaint.
United Kingdom. The ICO's 31 March 2026 release says the Data (Use and Access) Act 2025 made it easier to use automated decisions, but that safeguards are still needed. It asks employers using them to monitor for bias (it suggests considering monthly reviews), to tell candidates when automation is used and how it works, and to explain how they can challenge a decision and ask for a human review. Its report drew on voluntary conversations with more than 30 employers between March 2025 and January 2026. It was not an audit, and the ICO said it wrote to 16 organizations likely to be using automated decisions. A draft ICO guidance on automated decision-making went out for consultation until 29 May 2026, so check whether the final version has appeared.
Earlier, the ICO's November 2024 audit of AI recruitment tool providers produced 296 recommendations. It found tools that let recruiters filter candidates by protected characteristics, or inferred characteristics such as gender and ethnicity from names, and tools that collected far more personal information than they needed. Its advice to the employer side included not using "fit" or suitability scores to make automated decisions where the tool was not designed for it, completing a data protection impact assessment before high-risk processing, and giving candidates a simple way to challenge a decision.
United States. Illinois amended its Human Rights Act, effective 1 January 2026, so that employers may not use AI in hiring in a way that discriminates against protected classes and must notify applicants and employees when they use AI for employment decisions. A law firm summary says it covers any employer with at least one employee in Illinois and bars ZIP codes as a proxy for protected classes. The Illinois Department of Human Rights announced proposed notice rules on 15 May 2026 (comments closed 29 June 2026), covering what the notice must say: the tool and vendor, the decision it influences, its purpose, the data it uses, the job types, a contact, and how to request an accommodation. Those rules were still proposed when I checked, so confirm their status. Other states are moving too, so check where your applicants live.
European Union. The EU AI Act lists AI systems "intended to be used for the recruitment or selection of natural persons" among its high-risk uses. My guide to the EU AI Act for small businesses covers the timetable.
The Mistake I See Most Often
The mistake I see most often is a rule that exists in the owner's head and nowhere else. Across the business teams I train, the owner can usually tell me, kindly and sincerely, that "a person always makes the final call". When I ask which person, and what they see before they call it, the answer is often that nobody has decided.
I have advised governments and system leaders on AI, including the UK Department for Education, and I read regulator guidance for what it asks a person to do on a Tuesday, not what it asks a policy to say. This is why the Sort Line has a column for a name. A line with no name beside it is a signature. As I put it in the Loop Test: "Oversight that survives all three is a safeguard. Oversight that fails any of them is a signature." The three questions are whether that person would notice a wrong result without being told to look, whether they would notice in time, and whether the work could be put back.
What should you tell candidates?
Tell them what the AI does, who reads their application, and how to ask for a second look. A short notice on the careers page and in each ad is enough for most small employers. Copy and adapt this:
How we use AI in hiring. We use AI to [draft our job ads, schedule interviews and summarize applications]. [We do not use it to rank, score or reject candidates.] Every application is read by [role], who makes each decision.
[If you do use it below the line: We use [tool name, supplied by vendor] to [put applications in order against the requirements in the ad]. [Role] reads every application it handles and can change the result.]
If you would like a person to look again at any decision, or you need an adjustment to how you apply, contact [name and email].
Delete the bracketed sentence that does not apply. If you hire in Illinois, compare your notice with the content list in the proposed rules above. If you use the assistant for candidate questions, say so in the first message it sends.
How do you check a hiring tool for bias without a data team?
You check it once a month with five small jobs, and you write down what you find. None needs a data scientist.
- Ask the vendor in writing how they test accuracy and bias, and keep the reply. The ICO says to ask developers about their bias testing.
- Count the stage. How many people entered, how many passed.
- Look for patterns in who drops out. If you lawfully hold equal opportunities data, compare pass rates by group. If you do not, look at proxies the tool might use, such as postcode, career gaps or names.
- Read ten rejected applications yourself. If you would have advanced two of them, the rule or the tool is wrong.
- Pause the step if you cannot explain a gap. A paused tool costs you a few days. An unexplained pattern costs you a complaint.
What does the Sort Line look like in a 40-person firm?
Take a hypothetical 40-person commercial cleaning company, with one supervisor post and 90 applications. The operations manager wants the tool to "pick the best ten".
She fills in the sheet. The ad, scheduling and summaries go above the line, with the office manager as owner. Ranking would go below it, and she is the only person who could own it. Ninety applications is too many to read in full, so she does two things. She adds one question to the form ("Which of the three shift patterns can you work?"), and she has AI produce a one-page summary and a tick-list against the ad's four must-haves for each applicant.
She then reads all 90 summaries and marks yes, maybe or no. Her note on the sheet says that the knock-out rule is the shift question, which she wrote, and that she will read ten of the "no" applications in a month. The tool saved her hours. No candidate was ranked by a machine she could not overrule. The whole record fits on one page.
What should you do this week?
- List every point where software touches a candidate: your job board, your applicant tracking system, any chat assistant, any video or test platform. Include the badges and scores you did not choose to switch on.
- Copy the sheet and fill in one row for each. Mark each step above or below the line.
- For every step below the line, write a name in the owner column. If you cannot, turn the feature off for now.
- Send each vendor the bias and accuracy question in writing.
- Paste the notice onto your careers page and into your next ad.
- Put a monthly twenty-minute check in the diary, and read ten rejected applications at the first one.
- Once a quarter, ask a recent hire what they were told about AI in the process. Their answer tells you what the notice really says.
Where to go from here
If your team is using AI in hiring, or on its way to it, and nobody has set the line, that is the kind of working session my AI training for teams is built around. If you want to know where your business stands before you change anything, the Business AI Readiness Scorecard takes about five minutes. To write the rules into a policy, the UK small business AI policy template has room for a hiring section.
Sources and further reading
- Information Commissioner's Office, "Recruitment rewired", report on automated decision-making in recruitment (30+ employers, March 2025 to January 2026), published 31 March 2026.
- Information Commissioner's Office, "Automated decisions can streamline the hiring process, with the right safeguards in place", news release, 31 March 2026.
- Information Commissioner's Office, "AI tools in recruitment: Audit outcomes report", November 2024 (audits August 2023 to May 2024).
- Patriot Software, "4 in 10 Small Business Employers Have Rejected a Candidate Over AI Skills", 17 August 2026 (online survey fielded July 2026, 1,000 US small business owners and hiring decision-makers; vendor-sponsored).
- Epstein Becker Green, "Illinois' Proposed Notice Rules for Complying with Workplace AI Anti-Discrimination Law", 3 June 2026.
- Hunton Andrews Kurth, "Illinois Enacts New Law Regulating Employer Use of Artificial Intelligence" (law signed 9 August 2024, effective 1 January 2026).
- EU Artificial Intelligence Act, Annex III, high-risk AI systems, point 4(a).
Dan Fitzpatrick, The AI Educator, advises governments and system leaders and has trained more than 150,000 people in 30+ countries. About Dan.
