AI in HR: Recruiting, Screening, and the Law You Cannot Ignore

Most enterprise AI use cases carry commercial risk. Hiring carries legal risk — because the output is a decision about a person’s livelihood, and that decision has been regulated since long before anyone said “AI.” It is also, awkwardly, one of the easiest places to switch a model on without telling anyone.

So this one is worth doing in the right order: what the tools actually do, then the floor you have to clear.

Where AI is actually used in hiring

Sourcing. Matching open roles to candidate profiles and surfacing people who would not have applied. Low risk — it widens the funnel rather than narrowing it — and it’s where the clearest value sits.

Resume screening. Ranking or filtering applicants against a role. This is where the volume is: a posting can draw thousands of applications and no team reads them all. It is also where essentially all of the legal exposure is.

Assessments. Structured skills tests, work samples, and coding exercises scored automatically. Defensible when the assessment measures the actual job, which is a real constraint, not a formality.

Interview support. Transcription, note-taking, and summarizing — genuinely useful. Inferring personality or “culture fit” from facial expression or vocal tone is a different thing wearing the same coat, and it has repeatedly failed to hold up to scrutiny.

Administration. Scheduling, follow-ups, candidate questions. Boring, safe, and probably the highest ROI per unit of risk in the whole list.

The compliance floor

This is not optional and not vendor-managed. Under U.S. law, the employer is liable for discriminatory outcomes, whether the tool was built in-house or bought.

NYC Local Law 144. If you use an automated employment decision tool on a candidate for a job in New York City, you must: commission an annual independent bias audit, publish a summary of its results, and give candidates at least 10 business days’ notice that the tool is being used. Penalties run $500 for a first violation and up to $1,500 for each subsequent violation — assessed per day, per candidate, which is how a quiet compliance gap becomes a large number.

The EEOC and the four-fifths rule. Federal anti-discrimination law reaches AI screening through disparate impact. The practical test: compare selection rates across groups: if a group’s rate is less than 80% (four-fifths) of the highest group’s rate, that is evidence of adverse impact and the employer must show the tool is job-related and consistent with business necessity. Note the trap: the model never has to see race or gender to fail this. It can learn a proxy — a postcode, a school, a gap in employment history — and reproduce the pattern faithfully.

The EU AI Act. Recruitment and employee-selection systems are classified high-risk, with obligations applying from 2 August 2026 — risk management, data governance, technical documentation, logging, human oversight, and conformity assessment. If you hire in the EU, that’s a program, not a checkbox.

And a widening U.S. patchwork. Illinois HB 3773 (effective January 2026) amended its Human Rights Act to cover AI in employment decisions; Colorado’s SB 205 (February 2026) imposes duties on developers and deployers of high-risk AI systems. Expect this list to keep growing rather than converge.

Why hiring models drift toward bias

Not through malice — through arithmetic. A screening model is trained on your past hiring decisions, so its target variable is “who did we hire and keep before?” If those decisions carried bias, the model’s job is to reproduce it, and it will do so at scale, consistently, and with a veneer of objectivity that makes it harder to challenge than a biased human.

That’s the uncomfortable inversion: automation doesn’t neutralize a biased process, it industrializes it. The mitigation isn’t a fairness setting in a vendor dashboard: it’s auditing outcomes on your own candidate population, on a schedule, and being willing to turn the thing off.

The honest recommendation

The split that survives both scrutiny and a bias audit:

• Let AI widen and organize. Sourcing, scheduling, transcription, summarizing, surfacing candidates a keyword filter would miss. Low risk, real time savings.
• Don’t let AI reject. Keep a human making the negative decision. Rank and recommend if you must, but auto-rejection is where the liability lives, and the accuracy of these systems does not justify it.
• Audit outcomes, not intentions. Run the four-fifths comparison on real data, keep the records, and check whether the model is using proxies for protected traits.
• Tell candidates. Required in NYC, and increasingly elsewhere. It’s also the thing you’d want if you were the applicant.

AI in hiring is legitimately useful for the administrative crush that keeps recruiters from doing the human part of the job. It is not ready to be the one deciding who is worth talking to — and unlike most enterprise AI, that isn’t just our judgment: the regulators have written it down.

For the broader picture on AI governance, see our AI safety and policy coverage; for how these systems fail under adversarial pressure, LLM security and red teaming covers the technical side.