AI now shapes talent acquisition from end to end. It supports job ads, outreach, screening questions, candidate chatbots, ranking, matching, CV screening, scoring, and analysis. At the same time, hiring teams face sharper questions around privacy, transparency, oversight, and automated decision making.
The central issue is not only whether AI appears in hiring, but how organizations use it, document it, explain it, and govern it.
AI in hiring covers a wide range of uses.
On the candidate side, a major change appears in the rise of the AI-powered candidate. Candidates now apply in bulk with CVs that closely tailor themselves to job descriptions.
On the employer side, AI supports:
- job ads
- outreach
- screening questions
- candidate chatbots
- ranking and matching
- sourcing tools
- CV screening
- scoring
- analysis
- sifting through large application volumes
These uses shape who sees a role, who moves forward, and who gets rejected.
Automated decision making does not depend on AI alone. A traditional assessment can also trigger automated decision making if a human does not meaningfully take part in the decision.
Three tests help define it in recruitment:
1. A decision exists: a decision changes what happens next for a candidate.
2. The decision is significant: in hiring, that significance is clear because the outcome can mean progressing or not progressing.
3. The decision is solely automated: the key question is whether meaningful human involvement exists.
Human presence does not automatically equal human involvement. A human can sit somewhere in the process without meaningfully reviewing each candidate.
The distinction becomes clearer through examples:
- If scores go to a recruiter, and the recruiter reviews each candidate individually, that does not count as automated decision making.
- If a cut score automatically sifts candidates into progress and reject groups, that probably counts as automated decision making.
- If only top scores receive interviews and everyone else gets rejected unread, that also counts as automated decision making.
Consistency matters. If an organization uses automated decision making, it must apply it consistently and make review available at every stage, not just borderline ones.
The EU AI Act creates a standardized legal framework for the development, market placement, deployment, and use of AI systems across the EU.
It applies to:
- deployers, including employers
- tech vendors
- AI developers
- any AI system that affects people located within the EU
Employment sits in the high-risk category. The Act specifically targets AI systems used in:
- recruitment
- selection
- performance evaluation
- work-related relationship management
Employers using high-risk AI tools must establish strict governance. Key obligations include:
- using the tool according to the vendor’s instructions
- ensuring competent and trained oversight inside the organization
- making sure input data stays relevant
- monitoring the tool and reporting serious incidents
- keeping logs of use
- telling candidates when AI is in use, when it is used, and what recourse they have
The Act also includes a transparency obligation for AI disclosure around chatbots and voice AI systems. If someone engages with an AI system, the interaction must either be disclosed or exceptionally obvious.
Vendors carry major responsibility too. Their obligations include:
- risk management
- data governance
- technical documentation
- accuracy
- conformity with EU regulations
Most private sector employers do not need a fundamental rights impact assessment under the EU AI Act. A data privacy impact assessment still makes sense and usually sits with the privacy or compliance team.
Yes, it can.
Organizations outside the EU still need to consider the EU AI Act if they hire into the EU. A good practice approach also recommends working toward EU compliance even for hiring in the UK, since it can reduce headaches later.
Yes, some requirements move from August 2026 to December 2027.
That does **not** mean organizations can relax. The delay reflects the complexity of implementation and the number of moving parts organizations must bring together.
At the same time, other obligations stay live and enforced, including:
- transparency around interacting with AI systems
- AI literacy requirements
- prohibited uses such as emotion recognition at work and social scoring
The ICO introduces updated guidance that gives more clarity around when organizations can use automated decision making and what meaningful human involvement looks like.
A major change introduces **legitimate interest** as a basis for automated decision making. Before that, the main routes involved necessity for a contract or explicit consent.
This matters because forced consent creates problems in recruitment. If refusing automated decision making means a candidate cannot enter the process, consent does not feel fully free.
An organization that relies on legitimate interest must complete a **legitimate interests assessment** before using automated decision making. That documented process explains why the organization selects that basis.
The ICO also makes clear that any human involved must be meaningful.
Organizations must:
- tell candidates that automated decision making is in use
- give candidates a chance to state their view
- allow candidates to object
- provide access to human review to contest the decision
No.
AI and automated decision making are separate questions.
A traditional psychometric assessment can still support automated decision making if an organization sets a cutoff and automatically rejects anyone below it without meaningful human involvement.
The technology does not define the issue. The decision process does.
That depends on two things:
- what the assessment measures
- how the organization uses it
Sova assessments include both AI and non-AI assessments. The compliance question turns on use, not only on the tool itself.
Good practice includes:
- clear explanation of what the assessment measures
- clear explanation of what data points it generates
- technical manuals that explain psychometric properties
- the norm group
- reliability and validity
- group differences information
Organizations also need a clear governance framework for how a score becomes a decision, whether that decision uses automation, and what human interpretation occurs if the process does not automate the decision.
Organizations need to explain decisions in human terms.
A strong explanation covers:
- what the candidate did
- what the result means
- why the result relates, or does not relate, to the role
- what the role needs based on job analysis
It does not need to include overly technical detail such as logs or algorithmic nuts and bolts.
At the same time, organizations need the technical records:
- input and output logs
- records of anyone who reviews scoring or weighting setup
- evidence that logs remain available for subject access requests
Documentation alone does not solve the issue. Organizations also need a good assurance process.
That includes:
- regular auditing
- accuracy checks
- consistency checks
- review of cut scores
- monitoring for drift
- retraining where needed
This matters because model and rank drift can appear, especially when providers update models. A candidate ranked in the top 20% today should not suddenly fall elsewhere without explanation or review.
Post-campaign review also matters. Teams need to check how candidates move through the funnel, whether the tool performs as expected, and whether changes appear across different campaigns or populations.
AI readiness means the ability of people and organizations to use AI for appropriate work with:
- sound judgment
- safe data practices
- accountable human oversight
It involves more than tool access or self-reported confidence.
AI readiness also connects to AI literacy under the EU AI Act. Article 4 requires developers, vendors, and employers to take measures that support AI literacy among staff and other people operating the system on their behalf. Those measures must take account of:
- knowledge
- experience
- training
- context of use
- people affected
The six core competencies include:
- AI foundations
- application use cases
- bias, ethics, and risk
- data quality and governance
- output interpretation and evaluation
- human oversight and collaboration
People often confuse AI foundations with the other areas. Understanding what AI is, what it is not, and what it can and cannot do supports the rest.
Three essential questions stand out:
1. Can the tool reject someone without a person looking at them?
2. What adverse impact data exists by protected characteristic, and how often does the vendor test it?
3. Who owns the data, and who acts as controller?
Other important questions include:
- where the data hosts
- whether the vendor can explain the system in plain language
- whether the organization can override decisions
A good vendor explains the system clearly and simply. A poor one hides behind vague claims such as “unbiased AI” or “GDPR certified” without substance.
A strong starting point is to map every point in the hiring process where a candidate receives a rejection.
For each rejection point, document:
- the stage in the process
- the tool in use
- the output the tool produces
- who or what decides that output
- whether the candidate can challenge it
That creates a clearer process, stronger governance, and a better position for regulatory scrutiny.
Good practice and regulation now move much closer together. Organizations that already use strong oversight, clear documentation, candidate transparency, and regular review stand in a better position to adapt to AI privacy rules and automated decision making requirements.
In talent acquisition, the key themes remain clear:
- meaningful human oversight
- transparent candidate communication
- documented governance
- responsible use of AI
- ongoing review of tools, scores, and decisions
AI in hiring now requires more than adoption. It requires evidence, clarity, and accountability.
Sova is a talent assessment platform that provides the right tools to evaluate candidates faster, fairer and more accurately than ever.
.webp)
.webp)
.webp)
.webp)
.webp)
.webp)
