Use of AI in Recruitment and Hiring: Considerations for EU and US Companies
AI is transforming the recruitment landscape across the globe, enhancing processes such as resume screening and candidate engagement. This transformation occurs by:
- Using keyword searches to automatically rank and eliminate candidates from a pool of applicants with minimal human oversight;
- Performing recruitment tasks via chatbots that interact with candidates;
- Formulating skills and aptitude tests;
- Analyzing video interviews to assess a candidate’s suitability for a particular position.
In addition to maximizing efficiency, AI may also be used to make automated, substantive decisions related to recruitment, hiring, and performance through the use of predictive analytics that forecast a candidate’s success in a specific role.
Regulation of AI Use in the European Union and United States
The European Union has taken a united approach to AI regulation, with all EU member states currently governed by the EU Regulation on Artificial Intelligence (EU AI Regulation), which took effect on Aug. 1, 2024. The scope of the EU AI Regulation applies to all providers and deployers based in the EU, as well as those that place an AI system on the EU market or use the results of an AI system in the EU. This means that parties located outside the EU should be aware that the EU AI Regulation may apply to them as well.
The EU AI Regulation categorizes AI systems into different risk categories, with the applicable rules becoming stricter as the risk to health, safety, and fundamental rights increases. For example:
- Minimal regulation for spam filters;
- Limited regulation for chatbots;
- High regulation for use in recruitment;
- Unacceptable use of AI for social scoring and facial recognition.
HR tools are considered high-risk AI systems if they are used for recruiting or selecting candidates or provide the basis for HR employment-related decisions, such as promoting or terminating employment or monitoring and evaluating performance and behavior.
As of Feb. 2, 2025, the EU AI Regulation requires companies to eliminate “unacceptable” AI systems (as defined by the law) and to thoroughly and comprehensively train all employees using AI systems regarding compliant AI use under the regulation.
In contrast, the United States does not currently have uniform AI regulations at the federal level. Although the Biden administration tasked government agencies such as the Department of Labor and the Equal Employment Opportunity Commission with monitoring the use of AI tools and issuing guidance to enhance compliance with anti-discrimination and privacy laws, President Trump expressed support for deregulation in January 2025, issuing an executive order titled “Removing Barriers to American Leadership in Artificial Intelligence Issues.” As a result, federal agencies have removed all previously issued guidance on AI use.
In response to the executive order advocating for AI deregulation, regulations governing AI use have been introduced and passed at the state level. However, legislation passed does not always become legally binding. For instance, in February 2025, the Virginia legislature passed the High-Risk Artificial Intelligence Developer and Deployer Act, which would have required companies creating or using “high-risk” AI systems in employment to implement safeguards against algorithmic discrimination. However, the governor vetoed the Act on March 24, 2025, and it does not currently apply.
AI Use May Trigger Other Legal Violations
Beyond complying with laws like the EU AI Regulation, companies using AI in their recruiting and hiring processes must ensure that such use does not trigger violations of other laws. Key considerations include:
- Bias and Discrimination: Algorithms used by AI in recruitment may inadvertently perpetuate bias, leading to discrimination against candidates based on race, gender, age, or other protected characteristics. Discrimination is prohibited in the EU under Council Directive 2000/78/EC and in the US through numerous federal, state, and local anti-discrimination laws.
- Data Security and Ownership: Companies that enter personal data of potential candidates into an AI system have legal obligations to maintain data security and address considerations regarding data ownership. These obligations are governed by the EU General Data Protection Regulation (GDPR), effective since May 25, 2018, and more than 20 jurisdictions in the US have enacted laws imposing obligations on employers using AI to process candidate and employee data.
- Invasion of Privacy: Employers collecting candidate or employee data via AI tools may inadvertently invade privacy and should be mindful of applicable privacy laws, which may require consent before running certain searches.
Penalties for Non-Compliance
An EU employer violating discrimination, data security, and privacy laws risks significant damage awards and high administrative penalties from agencies like the European AI Office and national data protection authorities. Damage claims for individual breaches can vary between jurisdictions, and EU member states have autonomy in determining award sums. However, landmark judgments from the European Court of Justice (ECJ) emphasize the importance of issuing awards that correspond to the nature and extent of the violated rights.
Administrative fines for data security and privacy law violations under GDPR can reach up to the higher of EUR 20,000,000 or 4% of a company’s annual worldwide turnover for the preceding financial year. Under the EU AI Regulation, both EU and non-EU employers using AI systems in the EU can be fined up to the higher of EUR 35,000,000 or 7% of a company’s annual worldwide turnover. In the US, penalties vary by jurisdiction; for instance, in New York City, an employer may incur fines up to $500 for a first violation and between $500 and $1,500 per day for each subsequent violation.
Considerations for Employers
To minimize exposure, employers should consider the following steps:
- For the EU (including non-EU companies subject to EU laws):
- Eliminate AI use deemed “unacceptable” under the EU AI Regulation.
- Train employees to use AI in accordance with the EU AI Regulation, applicable data security and privacy laws, and company policies.
- Prepare for additional new requirements scheduled to take effect in August 2026.
- For the United States:
- Inform candidates when using AI in recruiting and hiring and obtain informed written consent prior to using AI for processing sensitive data.
- Provide an alternate method of screening should the candidate decline the use of AI.
- Use AI systems with clear parameters that can later be verified.
- Conduct periodic independent bias testing of AI systems and recruitment tools.
- Include human oversight in the decision-making process.
