Applying AI in recruitment is one of the most complex use cases from an ethical and legal standpoint. Done well, it saves the HR team a huge amount of time and allows more applications to be processed. Done poorly, it can reproduce discriminatory biases and breach data protection regulations. The difference between both outcomes often lies not in the tool chosen, but in how it is integrated into the existing workflow. For small and medium-sized businesses without a dedicated HR department, this distinction matters even more: the same AI feature that speeds up a process at a large company can create legal exposure if applied without the right controls at a smaller one.
The applications that make sense
Initial CV screening: for vacancies with hundreds of applications, an automated first filter that removes candidates who clearly do not meet basic requirements (specific qualifications, minimum experience, location, languages) is legitimate and saves time. The key: filters must be objective and documentable. A practical way to document this is to define the exclusion criteria in writing before running the filter, so the decision logic is recorded independently of the AI output. For a small retail company hiring seasonal staff, this might mean filtering only by contract type availability and location; for a professional services firm, it might include a specific qualification or language level.
CV summary and analysis: AI can generate structured summaries of each CV received, highlighting elements relevant to the role. The human recruiter still makes the decision, but with information already processed. The prompt used to generate these summaries should be tied directly to the job description, not to a generic template, so the output genuinely reflects the requirements of each vacancy rather than producing boilerplate output that misses role-specific nuances.
Interview preparation: using the CV and job description, AI can suggest relevant questions and areas to explore. It helps the interviewer to be better prepared. This is one of the safest and most immediately useful applications for SMEs, because it involves no automated decision about the candidate — it simply helps the interviewer cover relevant ground systematically. A useful practice is to ask the AI to generate both competency-based questions and clarifying questions about any gaps or ambiguities in the CV.
Automated candidate communication: automatic acknowledgement emails, process status updates, rejection notifications. Improves the candidate experience without adding extra work for the team. Personalising these automated messages with the specific role name and the next expected step in the process makes a meaningful difference to how candidates perceive the company, even when the message itself is generated automatically.
A simple AI-assisted screening workflow for SMEs
For a company starting from scratch with AI in recruitment, a realistic and auditable workflow might follow these steps:
- Define must-have criteria in a written document before posting the vacancy.
- Use AI to filter CVs against those criteria, with a human reviewing all borderline cases.
- Generate structured CV summaries for all candidates who pass the initial filter.
- Use AI to prepare tailored interview questions for shortlisted candidates.
- Conduct all interviews with a human in the decision-making role at every stage.
- Keep records of which AI tools were used and what criteria were applied at each step — this is essential both for legal compliance and for improving the process over time.
The risks to avoid
Automated decisions about people: AI must not make the final hiring decision. The GDPR prohibits automated decisions that have significant legal effects on individuals without human intervention. This is not just a legal formality — it also protects the company from poor hiring decisions driven by algorithmic errors or incomplete data. Even when AI scores or ranks candidates, a human must review and confirm every shortlisting or rejection before it takes effect.
Biases in models: models trained on historical data can reproduce discriminatory biases (gender, age, origin). Using AI in recruitment requires active bias analysis and correction mechanisms. A practical check is to review the output of any automated filter against protected characteristics: if a filter systematically removes candidates from a particular group, the criteria need to be reexamined before continuing. This is especially relevant when using general-purpose AI tools not specifically designed for recruitment contexts.
Transparency with candidates: candidates have the right to know if their application has been processed using AI and what criteria have been used. A short, plain-language note in the job posting — stating that AI-assisted tools are used for initial screening and describing the main criteria applied — satisfies this requirement and also signals that the company manages the process responsibly.
The EU AI Act: beyond the GDPR, the EU AI Act classifies recruitment AI systems as high-risk applications, which means they are subject to additional obligations including conformity assessments, logging of system activity, and clear human oversight requirements. Companies using third-party AI recruitment tools should verify whether those tools meet EU AI Act compliance requirements, since the legal responsibility does not rest solely with the tool provider — the organisation using it also carries accountability.
For AI implementations in HR processes, always with human supervision and full traceability of decisions made. Traceability means being able to reconstruct, at any point, which criteria were applied, which tool was used, and who made the final call — not just for legal compliance, but because it allows the company to identify what is and is not working and to improve the process with each new vacancy.