A single job ad can bring in a few hundred CVs. HR answers the same questions about leave and expenses every week. Interview notes sit in five different notebooks. A lot of this is exactly the kind of work AI does well: reading messy text, pulling out facts, drafting and summarising.
HR is also the area where European law is strictest about AI. A decision about who gets a job, a promotion or a dismissal affects someone’s livelihood, so GDPR and the EU AI Act limit how much of it a machine may decide. This post shows where AI helps with little risk, where to slow down and which guardrails to put in place. It is a practical guide, not legal advice.
Where AI helps with little risk
These uses save time without putting a machine between a person and a decision about them:
- Job ad drafts. The hiring manager writes a few notes, and AI turns them into an ad in your usual format and tone. Ask it to flag wording that may put some people off, such as hints about age or gendered language. A person edits and publishes.
- CV parsing into structured fields. Name, contact details, work history, languages, certificates and availability go straight into your applicant tracking system instead of being retyped. The recruiter still reads the application.
- Interview scheduling. Proposing slots, sending invitations and reminders, rebooking. This is mostly plain automation, with a little AI to understand replies such as “Thursday doesn’t work, how about next week?”
- Answers to employee questions. An assistant that answers questions about leave, expenses or benefits from your own policy documents and shows the source. We explain how this works in RAG explained.
- Onboarding. Checklists per role, reminders about missing documents, a first-week plan drafted from a template.
- Interview note summaries. The interviewer’s own notes turned into a structured summary, which the interviewer checks before it goes into the file.
- Translation. Contracts, safety instructions and onboarding material for foreign workers, with a person checking anything legally binding.
Most of the time saved in recruitment comes from plain structure, not AI: one record per candidate, documents with a status, automatic reminders. In the platform we built for Transfer International, a Slovak staffing agency, that meant candidate records, contracts generated from templates and signed electronically, and reports sent on a schedule. AI is useful on top of a foundation like that, not instead of it.
Where to be careful
The risk grows as AI moves from helping a person to deciding about one.
From assisting to deciding
- Job ad draft 1
- CV parsed into fields 2
- Missing must-haves flagged A person reviews each flag 3
- Candidates ranked by score 4
- Automatic rejection 5
← AI assists a person AI decides about a person →
The uses that need the most care:
- Screening, ranking and scoring candidates. A model that sorts 300 applications by “fit” shapes who gets an interview, even if a person makes the final call.
- Performance and behaviour monitoring. Scoring employees, allocating shifts or tasks based on behaviour or personal traits, or flagging people for dismissal.
- Anything that reads emotions. Video interview tools that claim to read enthusiasm or honesty from faces or voices. Using AI to infer emotions at work has been banned in the EU since February 2025, apart from medical or safety reasons.
Three practical problems sit behind the legal ones:
- Bias. Models learn patterns from data. If past hiring favoured one kind of profile, a model trained or tuned on those decisions will tend to repeat the preference, without anyone noticing.
- Opacity. When a candidate asks why they were rejected, “the model gave you 41 points” is not an answer you can defend.
- Silent errors. A CV in an unusual layout or another language gets parsed badly, and a strong candidate drops out of view without anyone seeing it happen.
Assist or decide
| AI assists | AI decides or ranks | |
|---|---|---|
| Examples | Ad drafts, CV parsing, scheduling, policy answers, note summaries | Screening, ranking, automatic rejection, performance scores |
| Who decides | A person, with AI preparing the material | The system shapes or makes the outcome |
| EU AI Act | Often not high-risk; check anything that analyses applications | High-risk: employment is listed in Annex III |
| GDPR Article 22 | Not triggered | Applies if no person meaningfully reviews the decision |
| What you need | Data rules and a check of the output | A human decision, bias testing, transparency, logs, an impact assessment |
| A good first project | Yes | No |
What the law says, in plain terms
This is a summary to help you find your way. For your own case, talk to your data protection officer or a lawyer.
GDPR: no decisions by machine alone
Article 22 of GDPR gives people the right not to be subject to a decision based solely on automated processing, including profiling, that has legal or similarly significant effects on them. Rejecting a job application is the textbook case: the recitals of GDPR name “e-recruiting practices without any human intervention” as an example.
There are exceptions: when the decision is necessary for a contract, allowed by law, or based on explicit consent. Consent is hard to rely on in hiring, because European regulators doubt it can be freely given when the other side holds the job. If you rely on a contract or on consent, people must still be able to get a person to look at the decision, give their view and contest it.
“Automated” doesn’t only mean AI. A plain rule that rejects everyone without a driving licence is also an automated decision.
Human review also has to be real. European data protection guidance says the reviewer must have the authority and competence to change the outcome and must actually consider the data. A recruiter who approves a list of AI rejections in bulk without opening them is not doing a human review.
Beyond Article 22, the usual rules apply. Tell candidates in your privacy notice that AI is used and how. Keep their data only as long as you need it. And expect to run a data protection impact assessment (DPIA) for any system that systematically evaluates people. Our guide to AI, GDPR and the EU AI Act covers these rules in more detail.
EU AI Act: employment is high-risk
The EU AI Act sorts AI systems by risk. Its Annex III lists employment among the high-risk areas. That covers AI intended for:
- recruitment and selection, in particular placing targeted job ads, analysing and filtering applications and evaluating candidates
- decisions on working conditions, promotion or termination
- allocating tasks based on individual behaviour or personal traits
- monitoring and evaluating the performance and behaviour of workers
There is an exception for systems that only do a narrow procedural or preparatory task and don’t materially influence the decision. It never applies to systems that profile people. Don’t assume your tool qualifies without checking.
Most of the heavy obligations fall on the provider, the company that builds the system and puts it on the market: risk management, data quality, technical documentation, conformity assessment. As an employer using such a system, you are a deployer, and you must:
- use it according to its instructions
- give oversight to people with the competence, training and authority to do it
- make sure the data you put in is relevant to the purpose
- keep the logs it produces for at least six months
- inform workers’ representatives and affected staff before using it at work
- tell people when it is used in decisions about them
If you build a high-risk tool for your own use, you can be both provider and deployer.
On timing: the AI Act entered into force in August 2024. The ban on emotion recognition at work has applied since February 2025, as has the duty to build AI literacy among staff who use AI. The high-risk obligations were originally due from August 2026. A 2026 amendment, known as the digital omnibus, moved them to 2 December 2027 for stand-alone high-risk systems, which include employment uses. These dates have moved before, so check the current status before you plan around them.
A safer hiring flow
Here is how a recruitment agency could handle 300 applications for warehouse jobs without letting a machine decide:
AI prepares, people decide
- Application arrives CV in any format or language
- AI parses the CV Fields into the ATS, no score
- Rules flag must-haves Forklift licence missing? Flag, don’t reject
- Recruiter reviews every application Original CV next to the fields
- Person decides the shortlist Reasons recorded
- Interview
What makes this flow safer:
- The AI extracts facts; it doesn’t score. The recruiter sees the original CV next to the extracted fields, so parsing errors are visible.
- Must-have checks flag rather than reject. A missing forklift licence might be a gap in the CV, not a missing licence.
- The order is neutral. The recruiter works through the list sorted by something like the date received, not by an AI score.
- Reasons are recorded. The recruiter notes why someone was shortlisted or not. That record is what you show a candidate who asks, or a regulator.
The time saving is still real. Nobody retypes CVs, translations happen automatically, and the recruiter spends their time reading applications instead of copying them. The decision stays with a person. For more on designing review steps that are fast and genuine, see human in the loop.
Guardrails to put in place
Guardrails for AI in HR
- A person makes every decision about a candidate or employee And can overrule the AI easily
- AI prepares and flags; it doesn’t score or reject Unless you have done the legal and technical work a high-risk system needs
- No sensitive traits Don’t ask a model to guess age, gender, origin or health; keep photos and birth dates out of AI processing
- Tested on real past applications Check extraction errors, including CVs in other languages and layouts
- People are told A privacy notice for candidates, information for staff and their representatives
- A DPIA before launch With your data protection officer, if you have one
- Logs of the AI output and the human decision Kept for an agreed period
- Approved tools only A data processing agreement, clear retention, no CVs in personal chat accounts
When you buy an HR tool with AI features, ask the vendor directly. Do they consider it high-risk under the AI Act? What documentation and bias testing can they show you? How does a person review and override its output? A vague answer tells you something too.
What to do next
Start with the admin, not the decisions. CV parsing into your applicant tracking system, interview scheduling and a policy assistant for staff save hours every week and carry little legal risk. Once those work and you understand how your data behaves, you can look at more sensitive uses, with proper legal advice and a human decision at the end of every step that affects a person.
We build applicant tracking and recruitment software and HR systems that keep candidate and employee records in one place, with AI where it saves time and people where decisions are made.
