AI can support sourcing and screening, but buying an AI tool does not settle your responsibilities as an employer. Start with what the tool actually does, which decisions it influences, and who can review its output.
The European Commission's AI Act overview identifies employment-related uses among the high-risk areas. Its current timeline distinguishes stand-alone high-risk systems, with obligations applying from December 2, 2027, from AI embedded in regulated products, with a later August 2, 2028 date. Classification, exceptions and responsibilities depend on the specific system and use. A recruitment chatbot, a candidate ranking system and a writing assistant need separate assessments.
Use these twelve steps to prepare a review with your legal, privacy and hiring teams. They are a practical procurement guide, not a certification checklist or a legal opinion about your particular deployment.
1. Inventory the tools and the decisions
List sourcing tools, resume parsers, interview agents, assessment platforms and internal models. For each, record its inputs, outputs, purpose, users and the hiring stage it affects. Include tools used informally by recruiters: copying a candidate profile into an assistant creates a data flow even without an ATS integration.
2. Assess scope for the actual use
Ask the provider how it classifies the system under the AI Act and why. Have your advisers check that reasoning against your deployment, including where the system and its outputs are used. Avoid assuming that every tool in an ATS has the same classification, or that a provider's overseas address settles the question.
3. Identify provider and employer responsibilities
Document which organisation supplies the system, which uses it, and whether customisation changes either role. Ask who owns updates, monitoring, documentation and incident escalation. A contract should make the operational responsibilities understandable to the people running the hiring process.
4. Map candidate data and processing purposes
Record what is collected, where it comes from, who receives it and why each field is needed. Distinguish an interview transcript from a derived score or an integrity flag. Check separately whether recordings or inferences involve sensitive data; do not assume that a recruitment purpose makes every input appropriate.
5. Review lawful basis and candidate information
Data protection remains a separate review. Agree the lawful basis for each purpose and the notice candidates receive. Consent is not automatically the safest or appropriate basis for recruitment processing; the ICO's lawful-basis guidance explains why purpose and circumstances matter. A screen saying that AI is used does not by itself complete this assessment.
6. Ask for relevant technical evidence
Request evidence that relates to the version and configuration you will use: what the tool measures, how it was evaluated, known limitations and the conditions that affect performance. A general accuracy percentage is less useful than a clear description of the task, test population, comparison method and types of error.
7. Design a usable human review step
Decide which outputs need review, what evidence a reviewer sees, and when they can seek clarification or change a recommendation. Give reviewers enough time and authority to act. A human clicking an approval button is different from someone assessing the underlying evidence; document the workflow you actually run.
8. Examine fairness and accessibility
Ask how the assessment handles accents, assistive technology, interrupted connections and candidates who need an alternative format. Decide how concerns reach a person and how an assessment can be revisited. Any demographic analysis also needs its own lawful data handling; do not collect sensitive attributes merely to populate an audit dashboard.
9. Agree records, access and retention
Specify which records you need to understand a decision and which users can access them. Set retention by purpose and applicable obligations with your privacy team, including any legal hold. There is no universal five-year GDPR retention period for candidate assessment records. Confirm deletion and export capabilities in the agreed service terms.
10. Review security and suppliers
Ask for the relevant hosting locations, subprocessors, access controls, incident contacts and transfer arrangements. Assess the evidence supplied rather than treating a badge as a substitute for it. Check whether the contract covers the features you are buying and whether the provider's answers apply to production or only to a demo.
11. Plan for changes and incidents
Decide how the hiring team learns about material model changes, how unexpected outputs are escalated, and when a workflow should pause for review. Keep examples of disputed or incomplete assessments so reviewers can distinguish a model limitation from a candidate's actual performance. Agree who decides that a changed tool is ready to use again.
12. Record the decision and outstanding work
Write down the reviewed use case, supporting evidence, responsible people, unresolved questions and conditions for launch. Ask the provider about any applicable conformity assessment and documentation obligations without assuming that every employment tool follows the same assessment route. Revisit the decision when the purpose, model or deployment changes.
How Recruo fits into this review
Recruo combines AI screening evidence with recruiter review. For Standard recruitment, finalists have passed the agreed technical and soft-skill assessment stages before introduction, with their expectations and availability confirmed. Recruo Pipeline provides active sourcing for 2 roles at $3,500 per month, with Recruo ATS and interview tools included. Candidate research, outreach and follow-ups are included; your team reviews interested candidates and runs assessments with the AI agent, note taker and voice assistant.
Human review is part of the workflow; it is not a claim of regulatory certification. Before a pilot, discuss the proposed assessment, data terms, retention, hosting, access and review responsibilities with us. Our security and privacy page describes the process and the questions to resolve for your engagement.