Is the AI screening your CV audited for bias?

What did Anthropic's audit deal actually change?

On 15 October 2026, Anthropic gave researchers at METR employee-level access to look under the hood of its systems, and handed over the right to block what they publish. METR can now release its own assessments of Anthropic's risks, incidents and internal practices without a veto from the company it's examining. That's the part worth noticing. Plenty of AI firms commission reviews; very few give up editorial control over the findings. For anyone thinking about accountability in AI, this sets a reference point for what genuine third-party scrutiny looks like when a company chooses to allow it.

Now hold that standard next to the software reading your CV. The screening stack at a mid-sized employer usually involves an applicant tracking system, a parser that converts your file into structured fields, and increasingly a model that ranks or summarises candidates. No outside group has employee-level access to any of it. No independent researcher publishes incident reports on the parser that mangled your dates. The vendor's own documentation is typically the only account you'll ever see, and you won't see that either — it goes to the employer, not the applicant.

So the honest answer to "who verifies the AI that screens me?" is: in most places, nobody independent. A handful of jurisdictions require a narrow, specific kind of audit, which we'll get to. Everywhere else, the checks are commercial and private. That's not a reason to panic — it's a reason to stop treating the screening layer as a black box you can appeal to, and start treating it as a machine with known failure modes you can design around.

Which laws require a bias audit of hiring AI?

Two regimes matter most. New York City's Local Law 144, in force since July 2023, requires employers and employment agencies using an automated employment decision tool on candidates for jobs in NYC to commission an independent bias audit within the previous year, publish a summary of the results on their website, and notify candidates at least ten business days before use. The EU AI Act classifies AI used for recruitment, CV filtering and candidate evaluation as high-risk, which triggers obligations on providers and deploying employers around risk management, data governance, logging, human oversight and technical documentation.

The two work differently, and the difference matters to you. Local Law 144 is outcome-focused and public: the audit calculates selection and scoring rates by sex and by race or ethnicity category, derives impact ratios, and the employer posts the summary. You can go and read it. The EU AI Act is process-focused and mostly private: conformity assessment, documentation and registration obligations sit with providers and deployers, enforced by authorities rather than published for applicants. What you get in the EU is a right to information about automated decision-making, not a public scorecard.

Elsewhere, there's less than people assume. Illinois regulates AI video interview analysis and requires consent and disclosure. Colorado passed a broad AI act covering consequential decisions including employment, with an implementation date that has already been pushed back once. The UK has no statute banning or auditing automated CV screening; existing equality and data protection law does the work. Several US states have bills in motion. If you're applying in India, there's no equivalent audit mandate at all — the practical protection is a CV the parser reads correctly.

India-specific habits like including a photo, date of birth or marital status also give parsers extra fields to mishandle, which is why a free ATS resume check for jobs in India tends to surface more fixable problems than a regulation debate ever will.

What does a bias audit report tell you — and not tell you?

A Local Law 144 bias audit tells you how a tool treated groups in aggregate; it tells you nothing about how it treated you. The published summary reports selection or scoring rates by demographic category and the resulting impact ratios, plus the number of applicants excluded from the calculation for missing data. That's genuinely useful information about systemic skew. It is not a record of your application, not an explanation of your rejection, and not evidence that the tool read your file correctly.

Three gaps are worth understanding. First, scope: the audit covers the categories the law names, so it won't surface skew by age, disability, accent, employment gap or non-native phrasing. Second, data quality: many summaries exclude large shares of applicants whose demographic data wasn't collected, which weakens the numbers without anyone doing anything wrong. Third, timing: an annual audit describes a tool as configured months ago, while the keyword filters, score thresholds and knockout questions an employer layers on top can change any week — and those employer-side settings often decide more than the model does.

Here's the contrarian bit. A clean bias audit and a broken CV are entirely compatible. An audit asks whether a tool disadvantages a protected group. It never asks whether your two-column layout dropped your job titles into a text box the parser skipped, or whether your PDF was a scanned image with no extractable text. Those failures are demographically neutral and completely fatal. Regulation is aimed at the first problem. The second one is the one that actually ends most applications, and it's the one you can fix this afternoon.

Can AI screening reject you unfairly without anyone noticing?

Yes — and the most common unfair rejections aren't bias at all, they're parsing failures nobody logs. When a parser can't extract your text, you don't appear as a low-scoring candidate; you appear as a thin or empty record, which reads to a recruiter as a weak applicant. Nothing in a bias audit catches this, because the tool treated every demographic group's broken files equally badly. The rejection is silent on both sides: you never learn why, and the employer never learns you were qualified.

The mechanics are mundane. Two-column layouts get read in the wrong order, so a date lands next to the wrong employer. Icons and graphical skill bars carry no text, so "Python — 90%" conveys nothing. Headers, footers and text boxes are skipped by some parsers entirely. Tables collapse. Non-standard section names like "My Journey" don't map to the fields a system expects. Hebrew and other right-to-left files can extract reversed or garbled, which is why bilingual applicants in Israel often need to check how a Hebrew CV survives automated screening rather than trusting that it looks fine on screen.

Then there's the newer layer: agentic systems that read, summarise and shortlist with no recruiter in the loop until later. These change what counts as legible, and they're moving fast — worth understanding how agentic hiring actually weighs your CV before you assume a human will catch an error. The through-line is the same in every case. Automated screening fails quietly. Your only reliable protection is checking the file yourself before you send it, because no audit regime inspects individual outcomes.

What can you ask an employer about an automated rejection?

You can usually ask three things, and you'll often get an answer to one. Ask whether an automated tool was used in screening, ask where the bias audit summary is published if you applied for an NYC-based role, and in the UK or EU ask for information about automated decision-making in your application under data protection law. Keep it short, polite and specific. A vague complaint about "the algorithm" gets filed; a precise question about disclosure and documentation lands with someone who has an obligation attached to it.

Set your expectations honestly, though. Employers rarely disclose score thresholds, keyword weightings or the reasoning behind an individual decision, and in most jurisdictions they don't have to. Opting out of automated screening isn't a realistic option either — it usually means not applying. The UK picture in particular is frequently misread; the practical limits on what you can ask about an automated rejection are narrower than most candidates expect. The energy you'd spend on an appeal is almost always better spent on the next application.

So invert the problem. Instead of auditing the screener, audit your own file against it. Upload your CV for a free CV check that scores ATS compatibility and you'll get an overall score out of 100, five category scores — experience, tech stack, impact and ownership, clarity and structure, and ATS compatibility — plus a visual layout analysis showing what the extraction actually captured. Paste in the job description and you'll see which of its skills are missing from your CV, and get ATS-friendly rewrites across six templates that mirror the ad's language. That's the half of this you control.

How should you rebuild a CV that survives automated screening?

Build it single-column, in a text-based PDF, with conventional section headings and dates in a consistent format. That one sentence solves most parsing failures. Use "Experience", "Education", "Skills" and "Certifications" rather than creative alternatives. Write dates the same way every time — "Mar 2021 – Aug 2024" throughout, never a mix of formats. Put your job title, employer and dates on separate, plainly structured lines rather than inside a graphic block. Keep contact details in the body of the document, not in the header, because some parsers never read the header at all.

Then make the language match the posting without stuffing it. Parsers and ranking models look for the terms the job ad uses, so if the role says "incident response" and your CV says "handling outages", mirror the ad's phrasing where it's genuinely true of your work. Spell out acronyms once alongside the short form — "security information and event management (SIEM)" — so either query hits. Quantify outcomes with real numbers: headcount managed, percentage reduction, revenue influenced, tickets closed per sprint. Measurable bullets survive both automated ranking and the human skim that follows it.

One more thing people get wrong: polished prose can now work against you. Over-smoothed, adjective-heavy writing with no specifics reads as machine-generated to experienced recruiters, and a CV that sounds like everyone else's AI draft is forgettable even when it parses perfectly. If you're drafting with an assistant — and most readers here are — keep your own voice, your own numbers and your own project names in the final file. If you'd rather start clean than patch a broken layout, build a single-column CV from scratch and export it as a file that both the parser and the recruiter can read.

Frequently asked questions