How to use AI in recruiting responsibly: a working policy for recruiters

To use AI in recruiting responsibly, list every place AI touches your hiring process, sort each use by how close it comes to a decision about a person, keep a trained human making and explaining those decisions, check AI output against the source before relying on it, control what candidate data goes into which tool, and tell candidates what you use. Drafting a job ad is low risk; ranking or rejecting candidates is high risk and, in a growing number of places, regulated.

This page is a working method you can turn into a team policy. For what the laws say, see AI hiring laws by state, which is dated and linked to the statutes, and the EU AI Act for recruiting.

Map where AI already touches your hiring

Most teams use more AI than they realize, because it arrives inside tools they already had. Before writing any policy, list every use. Ask each recruiter and hiring manager, and check the release notes of your ATS, sourcing and scheduling tools.

Sort every use by risk

The question that matters is how directly the output affects whether a particular person moves forward. Three tiers are enough for most teams.

Be honest about tier 3. A "match score" that recruiters sort by is evaluation even if the vendor calls it a suggestion, because it decides who gets looked at first and who never gets looked at. The New York City Local Law 144 guide walks through how one law draws that line.

Keep a human decision where it counts

"Human in the loop" means little if the human approves every recommendation in two seconds. For tier 3 uses, a meaningful human review has four parts:

• Authority. The reviewer can overrule the tool without justifying themselves to it or to a manager.
• Information. They see the underlying evidence, such as the resume or the answer, not only the score.
• Time. The volume assigned to them allows real review. If one person is "reviewing" hundreds of auto-rejections a day, nobody is.
• Accountability. The decision is recorded under their name with a reason a candidate or regulator could understand.

A simple test: pick five candidates the tool screened out last month. Could the reviewer explain, from the record, why each was not progressed? If not, the tool made the decision.

Check AI output before you rely on it

Generative tools produce fluent text that can be wrong. In recruiting, the errors that do the most harm are the ones that sound plausible in a candidate's file.

Tools can make checking easier or harder. Interview Signal, for example, checks each evidence quote on a scorecard against the transcript, and leaves the score and the decision with the interviewer. Whatever you use, the standard is the same: nothing goes to a client or into a decision that you could not show came from the candidate.

Control what candidate data goes where

Candidate data is personal data. Before any tool receives it, answer these questions and write the answers down:

1. Is this tool approved by the organization for candidate data, or is it a personal account?
2. Where is the data stored, and in which country?
3. Does the vendor use inputs to train its models, and can that be switched off in the contract?
4. How long is the data kept, and can you delete a candidate's data on request?
5. Who at the vendor can access it, and is there a data processing agreement?
6. Does the tool record audio or video, and have candidates been told and, where required, asked for consent? The consent guide covers recording.

A rule most teams can adopt immediately: no resumes, transcripts or interview notes in personal AI accounts. Retention periods for notes are covered in how long to keep interview notes.

Test for bias, and keep testing

Any tool that screens or scores can produce different outcomes for different groups, even when nobody intended it. Federal anti-discrimination law applies to a selection procedure whether a person or software runs it. The Uniform Guidelines describe a rule of thumb for spotting adverse impact: a selection rate for any race, sex or ethnic group that is less than four-fifths of the rate for the group with the highest rate is generally regarded by federal enforcement agencies as evidence of adverse impact (29 C.F.R. § 1607.4(D)). It is a screening signal, not a legal safe harbor.

An invented example of the arithmetic:

Ask vendors for their own testing, including any independent bias audit, the date it was run and the data it used. In New York City, an independent bias audit is required before using a covered tool; the city's DCWP page sets out the requirements. Then test on your own outcomes, because a tool audited on another employer's applicants may behave differently on yours.

Tell candidates, and give them a route

Some jurisdictions require notice and, in some cases, consent. Where no rule applies, telling candidates is still what builds trust. Keep it plain:

How we use technology in hiring

We use [tool type, e.g. "software that transcribes interviews and
drafts a summary"] to help our interviewers take accurate notes.
Interviewers read every summary against the transcript and make
all hiring decisions themselves. The software does not score or
reject candidates.

We use [tool type, e.g. "an application system that sorts
applications by keywords from the job description"]. A recruiter
reviews every application that meets the minimum requirements.

If you would like an alternative, or have questions about how your
information is used, contact [name, email]. You can ask us to
delete your data at any time, subject to legal retention periods.

Only write what is true. A notice that says a human reviews every application, when a filter removes most of them before anyone looks, is worse than no notice.

Write it down: an AI register and a one-page policy

Keep one row per tool. It becomes the answer when a candidate, a client or a regulator asks what you use, and it is what most AI hiring rules effectively ask you to be able to produce.

The policy itself can fit on a page: the three tiers, which tools are approved for each, the rule about personal accounts, who approves a new tool, and who candidates contact. Review it when you add a tool, when a law changes, and at least once a year.