AI in hiring should be defensible.
Regulators are watching, candidates are asking, and buyers are being warned. Via was built for a world where employers have to prove their hiring AI is fair, transparent, and lawful. Here is how we do it.
Book a compliance walkthrough- UK GDPRIn force
- EU AI ActFrom Dec 2027
- Equality Act 2010In force
- Data (Use and Access) Act 2025In force
Like our approach to responsible hiring?
Add Via as a Preferred Source on Google to see more of our insights on fair, responsible and effective hiring.
You control what you see. Learn more
The problem with off-the-shelfAI in hiring
Consumer AI tools were not designed to process job applications. When employers feed candidate data into them, the risks are legal, reputational, and personal. Regulators have started to enforce.
16
Organisations written to
The UK ICO wrote to 16 organisations likely to be making automated decisions about jobseekers, following evidence gathered from over 30 employers between March 2025 and January 2026.
December 2027
EU AI Act, high-risk obligations
High-risk obligations for recruitment become enforceable. Every AI hiring tool sold in the EU must be defensible by then.
Article 22
UK GDPR
Restricts solely automated decision-making in hiring. It applies today, regardless of the EU AI Act timeline.
Four principles behindevery Via shortlist
These are not marketing statements. They are the operating rules the platform is built on, and every shortlist we deliver can be audited against them.
No bias by design
Every candidate is scored against the criteria the client sets, using fixed weights and fixed rules we will share with any client who asks. The AI reads the CV and evidences each requirement; the rules that turn that evidence into a score are the same for every candidate, every time. No self-learning system, no scoring logic the client cannot see.
Human on every shortlist
Every shortlist is reviewed and approved by a senior Via recruiter before it reaches the client. Meaningful human oversight, not rubber-stamping.
Audit-ready by default
A full audit trail is generated for every candidate scored, showing the criteria applied and the outcome of each check. Available to clients on request.
UK GDPR & EU AI Act ready
Built to meet Article 22 requirements on automated decision-making, with human review and candidate-level explainability. Article 28 processing agreements in place with every sub-processor. Building against EU AI Act high-risk obligations ahead of December 2027.
How we do it
The mechanics behind the four principles. Every element is documented and available to clients under NDA.
Rules-based scoring on client-set criteria
Clients define the requirements for the role and mark each as essential or desirable before any matching runs. Via applies a fixed weighting to those requirements, and a smaller weighting to the supporting evidence around them. The weights are the same for every client, and we will share the schedule with any client who asks.
The scoring engine is stateless. It holds no memory of previous candidates, it does not learn from outcomes, and no client's data changes how any other candidate is scored. A candidate is scored once against a role, and that score does not move between runs.
AI models are used to read and structure unstructured text: to read a CV, to read a job brief, and to record what evidence exists for each requirement. The rules that turn that structured output into a score are fixed arithmetic, and we will walk any client or auditor through them line by line.
Essential requirements carry the heaviest weight in the score. Missing one lowers a candidate's score furthest, and on our specialist finance pipeline it caps that score outright.
Senior recruiter QA before delivery
Every shortlist is manually reviewed by a senior Via recruiter before it reaches the client. The reviewer has authority to remove, re-rank, or query any candidate on the shortlist. No shortlist reaches a client that has not passed human review.
Article 28 DPAs and sub-processor mapping
Signed Article 28 processing agreements with every sub-processor in the Via technology stack, and a full sub-processor map available on request.
Candidate records are stored on UK and EEA infrastructure. CV content is sent to our AI provider for assessment, with that transfer governed by Standard Contractual Clauses or the UK IDTA and by an Article 28 agreement that prohibits training on the data.
Bias review on criteria and source pools
Via does not collect, store or score any protected characteristic. There is no ethnicity, gender, age or disability field on a candidate record, and none is inferred from a CV. A CV is read by our AI model as the candidate wrote it, so we will not claim the model never sees what a document discloses — only that nothing it discloses is recorded as a characteristic or used as a scoring input.
What we do review is the input side: whether a client's criteria contain requirements that could indirectly disadvantage a protected group, and whether a source pool is skewed in a way that would carry through to shortlists. Findings are reviewed by senior operations and raised with clients where they are relevant to a role family.
Explainability at the candidate level
For every candidate scored, Via records each requirement assessed and the outcome of that assessment, and retains the record. Where a role is assessed through our specialist finance pipeline, the record also carries the specific line of the CV or the interview answer each judgement was grounded in.
Candidates have the right to request an explanation of any decision that affected them, and to request meaningful human review under UK GDPR Article 22.
Documented data protection framework
Data Protection Impact Assessment, Legitimate Interests Assessment, and Privacy Governance Notice completed and reviewed annually. Available to clients and auditors on request.
Filtering and decision-making are not the same thing
Most candidates never reach an assessment. They are filtered out beforehand on factual, checkable grounds: the role is in a different sector to the one they chose, the salary is below the minimum they told us they would accept, they do not have the right to work in the country, the contract type is not one they are open to, or the commute exceeds the limit they set.
These are rules applied to values the candidate gave us and confirmed. The comparison is a direct match against a fixed list of sectors, not a judgement call, and the candidate can see and change every value it uses.
Candidates who pass those checks are assessed against the role's requirements, and that assessment produces a score. Below a fixed threshold a candidate is not contacted about the role, and since a candidate progresses only by expressing interest in a role they were told about, that ends their candidacy for it. That step is automated and no recruiter reviews it.
Above the threshold, a senior recruiter decides who reaches the client and in what order. Any candidate can ask why a decision was reached and request human review of it under UK GDPR Article 22.
What we are ready for
The regulatory environment for AI in hiring is tightening. Via is designed to meet the standard being set, not the standard that existed when the market moved to AI two years ago.
Restrictions on solely automated decision-making
Via's human review on every shortlist and explainability at candidate level are designed to meet the ICO's “meaningful human review” test.
Processor obligations
Signed DPAs with every sub-processor in the stack. Full sub-processor list available on request.
High-risk classification
Hiring AI is a high-risk system under the EU AI Act, with obligations enforceable from 2 December 2027. Via is building against those obligations now.
Bias in criteria and source pools
Bias review on client-set criteria and on source pools is designed to help employers identify and address potentially discriminatory patterns before they cause harm.
UK data reform
Via's data protection framework has been updated to reflect the current UK statutory position, not the pre-reform framework.
The regulator's expectations for AI in hiring
Via's processes are aligned to the guidance and we are engaged with the ICO on emerging best practice.
Your rights on Via
Via handles your personal data lawfully and gives you meaningful control over how it is used.
- You stay invisible to employers until you accept a match
- You can request an explanation of any decision made about you
- You can request meaningful human review under UK GDPR Article 22
- You can request deletion of your profile and associated data at any time
- Your data is not sold or shared for marketing
- Full privacy notice available in your account settings
What you get with Via
The evidence you need to defend your AI-assisted hiring decisions to your board, your regulator, and your candidates.
- Signed Data Processing Agreement under Article 28
- Full audit trail on every shortlist delivered
- Senior recruiter accountable for every shortlist
- DPIA and LIA documentation available on request
- Sub-processor list and transfer risk assessment
- Regular compliance review meetings included in Unlimited tier
Documents available on request
Full documentation is available to clients, prospects under NDA, and regulators. Request via the compliance team below.
Talk to our compliance team
Whether you are evaluating Via for a procurement decision, a candidate with a question about your data, or a regulator seeking information, we will respond within one working day.
