A mid-sized UK staffing firm recently sat down to fix its CV workflow and landed on two problems that had nothing to do with sourcing or candidate quality. Both were about what happened to a CV between "good candidate" and "in front of the client."
Neither problem was new. Both had just quietly gotten worse as the team grew.
TL;DR
Recruiters reach for ChatGPT to tidy up messy CVs because it's fast and free, but pasting candidate data into it creates a data protection exposure under UK and EU GDPR, and equivalent privacy law in Australia and New Zealand, that most agencies haven't actually assessed. Separately, every recruiter formatting CVs their own way means clients get an inconsistent product from the same firm. Both are workflow problems, not people problems, and both get fixed the same way: take the manual step out of recruiters' hands and automate it to a fixed standard.
Problem 1: staff pasting CVs into ChatGPT
Ask most ops leads whether their recruiters use ChatGPT and the honest answer is "probably, informally." It's not sanctioned and it's not written into any process doc. It's just what someone does at 4:45pm when a CV arrives as a scanned PDF and needs to go out in ten minutes.
That informality is exactly the risk. Nobody signed off on it, so nobody assessed it.
What's actually happening: a recruiter pastes a candidate's full CV (name, email, phone number, employment history, sometimes a photo) into a public AI tool to reformat or clean it up. That data now sits on a third party's servers, outside any data processing agreement the agency has with its clients or candidates.
Why it's a compliance problem, not just an IT one:
- Under UK and EU GDPR, and equivalent obligations under Australia's Privacy Act and New Zealand's Privacy Act 2020, the agency is the data controller for candidate PII. Sending it to OpenAI without consent or a data processing agreement is hard to defend if a candidate or client ever asks how their data was handled.
- Free-tier AI tools don't guarantee data isn't retained or used for model training.
- There's no anonymisation step: names, contact details, and graduation dates (a proxy for age) all go through unfiltered.
- It's invisible to management. There's no log of who pasted what, when, or where it went.
A memo telling people to stop doesn't fix this. It just pushes the behavior underground. Give recruiters a tool that's as fast as ChatGPT for the same job, without the exposure: no retention, no third-party data sharing, built for exactly this task. We cover the compliance angle in detail in the hidden GDPR risk of using ChatGPT on CVs.
Problem 2: CVs don't look consistent going out to clients
The second problem showed up in client feedback, not a compliance review: two consultants submitting for the same role, sending CVs in two visibly different formats. One client asked, not unreasonably, whether the agency was actually reviewing what went out under its name.
This is the standardisation problem every growing agency hits. When each recruiter has their own template (their own font, their own way of handling gaps, their own header), the agency's output quality depends on who happens to be working the desk that day. Clients don't see "we have great recruiters with different styles." They see inconsistency, and inconsistency reads as a lack of attention to detail in the one part of the process they can actually inspect.
What inconsistent formatting costs an agency in practice:
- Clients spend time reorienting to a new layout every time, instead of scanning for what matters.
- ATS parsing errors climb: tables, columns, and odd fonts break more often than agencies expect.
- Recruiters lose time manually reformatting instead of sourcing or screening.
- It undermines the pitch to enterprise clients who run vendor assessments and expect a consistent, branded product.
We've written up why this happens and what it costs in why your agency's CVs don't look consistent. The short version: define the template once, then take the formatting decision out of each recruiter's hands entirely rather than relying on everyone remembering to follow it.
The common fix
Both problems trace back to the same root cause: a manual step that depends on individual recruiter judgment, repeated dozens of times a week, with no consistent standard behind it. Telling people to be more careful doesn't scale. Removing the manual step does.
That's the same reason Distill exists for both cases. Recruiters get a CV back in their client-ready format in under 30 seconds, with sensitive fields stripped or kept per the agency's own policy, and nothing retained afterward. The tool that stops staff from needing ChatGPT is the same one that guarantees every CV looks like it came from the same agency.
FAQ
Isn't banning ChatGPT enough to fix the data risk?
A policy without a workable alternative doesn't hold. If ChatGPT is still the fastest way to reformat a messy CV, some recruiters will keep using it regardless of the policy. Replace it with a tool that's just as fast and doesn't carry the same exposure.
Do we need separate tools for anonymisation and formatting?
No. Treat them as the same step. Anonymising after formatting (or vice versa) doubles the manual work. A tool that does both in one pass at time of submission is less to manage and harder to skip.
How long does it actually take to roll out a house style?
Most of the time is defining the template, not deploying it. Once the standard exists, applying it automatically to every CV is near-instant. The ongoing cost isn't formatting time, it's remembering to enforce it, which is exactly what automation removes.
Does this apply outside the UK?
Yes. The data protection exposure is sharpest under UK and EU GDPR, but Australia's Privacy Act and New Zealand's Privacy Act 2020 carry similar obligations around candidate PII. The formatting-consistency problem isn't jurisdiction-specific at all: any agency with more than one recruiter runs into it.
If either of these sounds familiar (recruiters improvising with AI tools they shouldn't be, or CVs that don't look like they came from the same firm), both come from the same gap: no standard step between "candidate CV received" and "client-ready document." Try Distill free and see what a consistent, compliant CV workflow looks like without adding process overhead.