AI for HR and Recruiting
Recruitment is the single most regulated AI application in professional services, and several of the rules are already in force rather than approaching.
Everywhere else in AI the compliance conversation is about 2027. In hiring, several obligations are already live, they differ by jurisdiction, and they attach to the tool as much as to the employer.
AI for HR and recruiting covers candidate sourcing and matching, application processing and operations, interview scheduling, assessment analytics, workforce and attrition modelling, and the bias auditing, notice and record-keeping obligations attaching to automated employment decision tools.
What already applies, jurisdiction by jurisdiction
This is not a forecast. These obligations are in force or dated, they differ materially, and they apply according to where your candidates and employees are rather than where your HR team sits.
- New York City. Automated employment decision tools require an annual independent bias audit, publication of the results, and notice to candidates before use.
- Illinois. From 1 January 2026, notice is required where AI is used in employment decisions, discriminatory use is prohibited, and zip codes may not be used as proxies for protected classes.
- California. Employment regulations effective 1 October 2025 make evidence of anti-bias testing — or its absence — relevant to discrimination claims and defences, and extend retention of automated decision system data to four years, including training data.
- Colorado. The state AI Act was postponed to 30 June 2026, requiring impact assessments and disclosures for high-risk systems, which includes employment.
- European Union. Recruitment, selection, promotion, termination, task allocation and worker monitoring are high-risk under Annex III, with obligations from 2 December 2027 following the Omnibus agreement.
The four-year retention rule quietly changes your architecture
California's requirement to retain automated decision system data for four years, expressly including training datasets, is easy to read past and hard to comply with retrospectively. It means the data that trained a screening model, the inputs it saw and the outputs it produced must be retained and retrievable for far longer than most ML systems are designed to hold anything. Building that in at the start costs little; adding it after two years of operation is frequently impossible because the data was never kept. See AI governance frameworks.
Screening, and how to build it so it survives an audit
Test outcomes, not inputs
Removing protected characteristics from the feature set proves nothing. Education, employment gaps, postcodes, names and language patterns all correlate with protected groups, and the only way to know the effect is to measure selection rates across groups at each stage.
Rank rather than reject
A system that orders candidates for a recruiter to review is a materially different proposition from one that filters candidates out unseen. The second concentrates the exposure and removes the human involvement that several of these regimes assume.
Build the audit trail as a feature
Which candidates were assessed, what the model saw, what it output and what the human decided — retained, queryable and retained long enough. Where an annual independent audit is required, this is what the auditor asks for.
Job description language is a lower-risk starting point
Analysing postings for language that correlates with narrower applicant pools improves outcomes without making any selection decision at all, and it is a genuinely useful place to start.
Where the safe value is while the screening question is settled
| Application | Regulatory weight | Note |
|---|---|---|
| Sourcing and search across candidate pools | Lower | Finding candidates is different from selecting them; document the distinction |
| Interview scheduling and coordination | Low | Pure operations; substantial time saving in high-volume hiring |
| Application data extraction | Low | CV parsing into structured fields; do not let parsing become scoring |
| Job description analysis | Low | Improves the pool without deciding on anyone |
| Candidate communication | Low | Status updates and FAQ; escalate anything about a decision |
| Screening and ranking | High | Bias audit, notice and record-keeping obligations attach |
| Automated rejection | Highest | Concentrates exposure and removes the human step the rules assume |
| Emotion or affect inference in interviews | Prohibited in the EU workplace | Do not build it |
Attrition modelling is the HR application nobody argues about
Predicting which employees are at risk of leaving, and why, uses data you already hold, informs a retention conversation rather than a selection decision, and sits outside the automated employment decision tool regimes in most readings. It is also more commercially valuable in most organisations than faster screening, because replacing a skilled employee costs far more than a slow hiring process does. It is our usual recommendation when a client arrives asking for screening.
How an engagement runs
The jurisdictional position first, because it determines what may be built at all.
Compliance position
Where your candidates and employees are, which regimes apply, and what each requires.
Data assessment
Hiring history, outcome data, and whether group-level analysis is even possible with what you hold.
Build
Sourcing and operations, attrition modelling, or screening with audit trail and outcome testing built in.
Testing
Selection rates across groups at every stage, with the results documented as an artefact rather than a slide.
Operation
Scheduled outcome testing, retention of decision data to the longest applicable period, annual audit support.
What you receive
The operational time back, and anything regulated built to survive inspection.
Jurisdictional compliance position
Which regimes apply to your hiring footprint and what each obliges you to do.
Sourcing and search
Across candidate pools, with the sourcing-versus-selection distinction documented.
Application operations
Parsing, scheduling and candidate communication, with decisions kept with people.
Outcome testing harness
Selection rates by group at every stage, run on a schedule and retained.
Audit trail
What the model saw, what it output and what the human decided, retained to the longest applicable period.
Attrition modelling
Retention risk with reasons, informing conversations rather than decisions.
Is this the right starting point?
Worth being direct. There are situations in HR and recruiting where custom AI work is the wrong spend, and those are listed rather than buried.
Worth doing if
- You hire across multiple jurisdictions and have no map of which AI rules apply.
- Interview scheduling and application processing consume recruiter time at volume.
- You use a screening tool and cannot produce the bias audit evidence required.
- Attrition is expensive and unmodelled.
- Job postings are written without analysis of who they attract.
Do something else if
- You want automated rejection without a human reviewing the decision.
- You want emotion or affect inference from interviews.
- Hiring outcome data cannot support group-level analysis and there is no route to collecting it.
- There is no appetite for the record retention that several of these regimes require.
Frequently asked questions
Marked up with FAQPage schema so these answers can surface directly in search results and inside AI assistant responses.
Which rules apply to us?
It depends on where your candidates and employees are, not where your HR function sits, and the answer is usually several at once. New York City requires an annual independent bias audit with published results and candidate notice. Illinois requires notice and prohibits zip codes as proxies from 1 January 2026. California's regulations from 1 October 2025 make anti-bias testing evidence relevant to claims and extend automated decision data retention to four years. Colorado's Act arrives 30 June 2026. In the EU, hiring AI is high-risk under Annex III from 2 December 2027. Mapping your footprint against these is the first piece of work, and it takes days rather than weeks.
Our model does not use protected characteristics. Is that enough?
No, and this is the most persistent misunderstanding in HR technology. Education history, employment gaps, postcodes, names, language patterns and hobbies all correlate with protected groups, so a model with an entirely clean input list can produce materially different selection rates. Both the regulatory regimes and the litigation risk look at outcomes. The only way to know is to measure selection rates across groups at each stage of your process, which requires demographic data you may not currently collect — that is a project in itself and it comes before the model, not after.
Can we automate rejections?
You can build it and we would advise against it in most configurations. Automated rejection concentrates your exposure in exactly the decision these regimes scrutinise, and it removes the human involvement that several of them assume is present. Ranking candidates for a recruiter to review achieves most of the throughput benefit with a fraction of the risk, and it keeps a person accountable for the decision. If volume genuinely requires filtering, the threshold, its justification and its measured effect across groups all need documenting before it runs.
What should we build instead of screening?
Attrition modelling, usually. It uses data you already hold, it informs a retention conversation rather than a selection decision, it sits outside the automated employment decision tool regimes in most readings, and replacing a skilled employee costs far more than a slow hiring process does. Beyond that, scheduling, application parsing and candidate communication are pure operational savings with no meaningful regulatory weight. We suggest these routinely to clients who arrive asking for screening, and a fair number of them find the alternative worth more.
What does the four-year retention rule actually require?
California requires retention of automated decision system data for four years, expressly including the datasets used to train the system. In practice that means the training data, the inputs the model saw for each candidate, its outputs, and the resulting decision must all be retained and retrievable for far longer than machine learning systems are usually designed to keep anything. It is easy to read past and effectively impossible to satisfy retrospectively, because the data will not have been kept. Designing for it upfront costs very little; discovering it in year three costs a great deal.
Related verticals
Organisations in HR and recruiting usually share data, buyers or regulators with these. All fourteen are listed on the Professional Services page.
AI for Staffing and Recruitment Agencies
Database reactivation, matching and fill-rate analytics — with the obligations that attach to the provider, not just the employer.
Read more →AI for BPO and Contact Centres
Agent assistance, quality analytics and process automation — with deflection claims separated from assistance evidence.
Read more →AI for Law Firms and Legal Teams
Document review, precedent retrieval and constrained drafting — built around the verification step the sanctions cases turn on.
Read more →Tell us what the problem looks like.
Thirty minutes, no charge, no deck. We will tell you whether this is an AI problem, a data problem, or a process problem — and we will say when the honest answer is to buy something rather than build it.