AI for HR: CV screening is where things go wrong
AI can support routine HR work, but screening and ranking candidates raises risks around fairness, privacy and explainability. Learn how to set boundaries, keep people responsible for decisions and inform candidates and staff.
AI can help HR draft job postings, schedule interviews, summarize documents and answer employees’ questions. These kinds of support can make work easier to organize, provided someone checks the output and you avoid entering personal data that is not needed.
Screening, ranking or rejecting candidates is where things can go wrong. Data may reflect existing bias, while the reason for an outcome can be hard to trace. Under the AI Act, AI used in recruitment and selection may qualify as high risk. Have the use assessed and keep the final decision with a person.
Where AI can support HR
Start with tasks where AI helps organize information or prepare a first draft, without making decisions about people on its own. For example, a language model can rewrite a job posting based on requirements HR has already set. An employee should check that the wording is accurate, clear and free from unintended exclusion.
Scheduling can also be a suitable use. A tool might collect available interview times or suggest an agenda. During onboarding, an internal assistant can answer routine questions, such as where employees can find a policy or form. A system can also summarize policy documents or draft an initial response to common staff questions.
That does not make the output automatically correct. Check summaries against the original policy and make clear when an answer is provisional. Employees should have a way to reach an HR colleague for personal or complex matters.
Why CV screening carries risk
A system that screens CVs or scores candidates may reproduce patterns from past hiring. If earlier decisions favored some groups, a model may apply those preferences again. Apparently neutral characteristics can also be connected to personal traits. The effects depend on the data, the system’s design and how people use its output; they cannot be determined from a product description alone.
A score can look objective even when it is unclear why one person ranks above another. The system may weigh education, experience, wording or some other feature. If that reasoning is not visible, it becomes harder to assess a candidate fairly, detect an error or explain why someone did not progress.
A person who simply follows a ranked list is not providing meaningful oversight. The reviewer needs to examine relevant information, spot concerns and set the result aside for a reason. If the system does not provide enough information to do that, it is not a sound basis for a hiring decision. Read more about what a high-risk AI system can mean.
Decisions, explanations and transparency
Decide in advance which tasks AI may and may not perform. You might allow a tool to draft a job posting while prohibiting it from rejecting or ranking candidates on its own. If AI supports an employee assessment, the person making the assessment needs to understand what information the system uses and what its limits are.
Tell candidates and employees in clear language when AI plays a role in a process that affects them. Explain what the tool does, how its output is used and who makes the decision. Say where someone can ask questions or request a review. The information that is appropriate depends on the use and context.
Explainability starts with a well-defined process. Keep a record of the information used, the checks performed and who was responsible for the decision, where that is necessary and appropriate. This helps HR review how a decision was reached and learn from mistakes. See when a person should approve for more on human oversight.
Privacy, staff assessment and other risks
A CV and an employee file contain personal data. Share only the information needed for the task. Remove irrelevant details, set clear retention periods and check who can access inputs and outputs. Do not put sensitive information or confidential staff details into an external tool until you have established how the data are processed, stored and potentially used.
The same care applies to employee monitoring and performance assessment. AI that tries to infer behavior, productivity or suitability can affect employees’ position in significant ways. A dashboard or score is not a neutral observation: the selected data and their interpretation may be incomplete. Consider whether the monitoring is truly needed, what boundaries apply and how employees can challenge a result or add context.
When preparing an assessment, consider the questions that also arise in a DPIA: which personal data are needed, what could go wrong, who may be affected and how can you limit the impact? A DPIA may be required in some situations; that depends on the processing. These guides to AI and the GDPR and DPIAs for AI can help structure the review.
Set a short policy and check the use
You do not need to begin with a long document. State in plain language which AI tools are allowed, what information employees may enter and which decisions must remain the responsibility of an authorized person. Assign someone to handle questions and incidents. Also assess whether the use may count as high risk under the AI Act; the classification depends on the specific purpose and use and should be reviewed by someone qualified.
Use this checklist as a starting point:
- Is the purpose of the AI use clear and limited?
- Does it support administration, or influence hiring, assessment or another decision about people?
- Are the data used necessary, appropriate and protected?
- Can an employee check and challenge the output and explain it clearly?
- Do candidates and employees know when AI is used and where to raise questions?
- Are retention periods, access and responsibilities documented?
- Has someone assessed whether a DPIA is needed and whether the use may be high risk?
Review the policy when the tool, data or workflow changes. A tool that initially only drafted text might later be connected to an employee file. That changes the risk. Include HR, privacy, information security and the people who use the system day to day in the review.
Have it reviewed legally
This article provides general information and is not legal advice. Ask a lawyer or data protection officer to assess what the rules mean for your specific use, data and workflow.