AI and recruitment: five top tips for protecting the integrity of your global hiring processes

Approach: The UK is pursuing a principles-based, “pro innovation” approach to AI regulation, meaning sectoral regulators (including the Information Commissioner’s Office (ICO) and Equality and Human Rights Commission (EHRC)) are responsible for AI regulation in line with set principles.

Legislation: In light of the above approach, there are currently no AI specific UK employment/recruitment laws, but employers must comply with existing laws on discrimination (Equality Act 2010) and data protection requirements (UK GDPR and Data Protection Act 2018) including transparency/fair processing obligations. The UK government has issued non-statutory guidance on Responsible AI in recruitment as well as the ICO’s AI tools in recruitment audit outcome report. Both documents emphasise transparency, fairness, testing, human oversight as well as clear governance and audit processes. 

Approach: The EU has taken a comprehensive approach to regulating AI under the EU AI Act - a risk-based framework regulating the development, placing on the market, putting into service and use of AI systems in the EU. International employers should note the EU AI Act’s extra territorial scope, which can apply for example where the output of the AI system is used within the EU, even if the employer is based outside it.

Legislation: Under the EU AI Act, AI systems used for recruitment or selection, in particular to place targeted job advertisements, to analyse and filter job applications, and to evaluate candidates are classed as “high risk”, triggering specific obligations under the Act. Obligations include: implementing technical and organisational measures to ensure proper use, human oversight, monitoring and reporting, and more. Employers should also ensure that they understand and comply with any obligations to inform and consult with workers and/or their representatives which could be applicable under both the EU AI Act and/or local laws, depending on the specific circumstances.  Automated decision-making in recruitment also raises significant issues under Article 22 of the EU GDPR, which restricts decisions based solely on automated  processing that produce legal or similarly significant effects on individuals. Employers using AI tools that filter or rank candidates without meaningful human intervention may fall within the scope of this provision, requiring them to implement suitable safeguards, provide information about the logic involved, and ensure individuals can obtain human review of such decisions.

Approach: Employers must navigate a patchwork of emerging laws as several states and cities now regulate automated decision tools in hiring through AI regulations and biometric laws. The framework underlying these laws generally focus on (i) transparency, and (ii) non-discrimination.

Legislation: Workplace automated solutions in the US find guidance and compliance mandates in AI regulations, employment laws, biometric laws and emerging litigation risks. The first comprehensive AI law in the US will take effect in Colorado, which focuses on elimination of employer bias through notice, appeal rights, disclosures, and risks assessments. Existing laws such as New York City’s Local Law 144 prohibits the use of automated employment decision tools unless they have undergone an independent bias audit and employers provide notice to candidates. California’s employment laws now regulate storage periods for algorithms’ underlying automated decision systems used in the workplace, and the state’s privacy laws require regular risk assessment reports. Illinois and Maryland impose requirements around video interview analytics, biometric data, and candidate consent, while states such as Delaware and Connecticut have safeguards around electronic monitoring. Federal regulators (EEOC, FTC) have also focused on algorithmic discrimination and transparency.

Approach: Regulatory models vary across these selected jurisdictions: China adopts a stringent, technology specific and hierarchical system; Japan relies predominantly on soft law guidance; and Singapore promotes a light touch, experimental and human centric framework.

Legislation: China has some of the world’s most comprehensive AI regulations, including rules governing algorithmic recommendation systems and generative AI. Much of the regulation in China has focused on the use of algorithms in AI technologies and generative AI – both of which are potentially relevant to AI use cases in recruitment. This has included a new governance framework for regulating algorithmic recommendation systems which came into force in 2022. Employment related AI is also subject to strict rules on data minimisation, consent, security assessments, and bias avoidance. Employers must ensure human oversight and clear disclosure where algorithms materially impact individuals.

Japan has no AI specific employment laws but regulates through guidance and industry codes of conduct (e.g., AI Guidelines for Business). Employers must still comply with existing labor and data protection laws, with expectations of transparency, fairness, privacy protection and appropriate governance.
 
Singapore relies on its voluntary Model AI Governance Framework, emphasising transparency, explainability, risk management, de biasing and human centred deployment. This sits alongside the Personal Data Protection Act and fairness requirements under the Workplace Fairness Act and Tripartite Guidelines on Fair Employment Practices.