Generative AI can save time in HR work, but it does not automatically turn a weak process into a good one. A tool such as ChatGPT can help with drafting, structuring and exploring ideas. It does not know the organisation’s full context, can produce incorrect information and should not decide who receives an interview, a promotion or a disciplinary measure.
The useful question is not “How can we introduce AI into every HR activity?” It is “Which specific task can it support, what data will we use and who will verify the result?” The distinction between a writing assistant and a system that influences someone’s career is essential.
This article provides a practical framework for HR and recruitment teams. It does not replace the legal, security or data protection assessment required for a specific tool and use case.
1. Start with the task, not the tool
Before selecting an application, describe the problem in plain language. You may want to reduce the time needed for the first draft of a job advertisement, organise questions for an interview or turn an internal policy into a document that is easier to read.
For every use, define:
- the expected result;
- the data entering the system;
- the person who verifies the output;
- the consequence of an error;
- how the approved version will be recorded;
- the available alternative if the tool does not work correctly.
The greater the possible effect on a person, the stronger the control should be. A poorly worded draft can be corrected before publication. Incorrect candidate filtering can exclude people before a recruiter reviews their experience.
2. Where generative AI can be a useful assistant
Lower-risk uses usually share three characteristics: they do not require personal data, they do not make a decision on their own and the output can be checked easily.
Practical examples include:
- a first structure for a job advertisement, based on approved information about the role;
- draft questions for a structured interview, followed by team review;
- rewriting a document in clearer or more accessible language;
- a preliminary translation that will be reviewed by a competent person;
- organising ideas for onboarding or internal communication;
- summarising public documents or internal material that contains no personal or confidential information;
- creating a checklist or email template, followed by validation of the tone, facts and links.
The tool provides a draft, not an approved version. A person remains responsible for accuracy, tone, accessibility, consistency and compliance with the organisation’s policies.
3. Where risk rises quickly
Risk increases when a system analyses people, makes predictions or influences access to employment. This includes CV filtering and ranking, candidate assessment, recommendations about who advances, video or voice analysis, performance monitoring and recommendations about promotion or termination.
In the European Union, the AI Act lists certain systems used for targeted job advertisements, analysing and filtering applications or evaluating candidates among high-risk uses. Under the official timeline available on 24 October 2026, the rules for these systems in employment are due to apply from 2 December 2027. Other obligations and prohibitions already apply. For example, using AI to infer a person’s emotions in the workplace is prohibited, with limited medical or safety exceptions.
The GDPR already applies whenever personal data is processed. People also have protection from certain decisions based solely on automated processing that produce legal or similarly significant effects. The European Data Protection Board uses the automatic rejection of a job applicant as a relevant example.
Before using a system in such a context, involve data protection, security, legal and the people who understand the recruitment process. Assess the exact use, rather than relying only on the vendor’s product description.
4. Do not put personal data into an unapproved tool
A public account or an informally tested tool should not receive CVs, interview notes, salary information, performance reviews, health data, disciplinary information, identifiers or other candidate and employee data.
Before personal data is used, the organisation should know at least:
- who provides the service and who processes the data;
- where the information is stored and who can access it;
- whether data or conversations are used to train or improve models;
- which retention period applies and how data can be deleted;
- which subprocessors are involved;
- which legal basis and notices are required;
- whether a data protection impact assessment is needed;
- which security, audit and incident-response measures are in place.
GDPR principles require lawfulness, fairness, transparency, purpose limitation and data minimisation. Information being present in a CV does not mean it can automatically be transferred to any tool for any purpose.
5. Human oversight must be able to change the outcome
“Human in the loop” does not simply mean that a person presses the final button. Oversight is meaningful when the reviewer understands what the system does, can challenge its output and has the authority to change it.
In a recruitment process, this means:
- defining criteria before candidates are assessed;
- applying the same review rule to people at the same stage;
- accessing the information behind a recommendation;
- verifying claims and summaries produced by AI;
- being able to stop the use of the system;
- documenting exceptions, errors and decisions;
- providing a clear route for candidates to request information or challenge an outcome.
A recruiter who automatically accepts every recommendation does not provide meaningful oversight. The reviewer’s role is to apply professional judgement, notice missing context and correct outputs that cannot be verified or are unfair.
6. Questions before buying an AI tool for HR
A convincing demonstration is not enough. Ask the vendor for verifiable answers about the product and your use case:
- Which decision does the system support, and what should it not do?
- Which data does it use and where does that data come from?
- How are accuracy, errors and differences between relevant groups measured?
- Can the organisation explain to a candidate how the system was used?
- Can a reviewer see, challenge and change a recommendation?
- Which logs, versions and evidence can be retained for audit?
- How are security, incidents, deletion and data export handled?
- What happens when the vendor changes the model or a feature?
- Which obligations belong to the vendor and which remain with the client?
- Can the system be stopped without blocking the HR process?
Test the product on representative scenarios before launch and repeat the assessment after material updates. Monitoring should cover operational performance and the effects on candidates or employees.
7. A simple internal rule for the HR team
An organisation can begin with a short framework:
- inventory the AI tools used officially and informally;
- classify uses according to their possible effect on people;
- define approved tools and data;
- assign an owner to every use;
- define human review before an output is used;
- update privacy notices and documents where necessary;
- keep records of training, tests, incidents and changes;
- periodically review whether the benefit justifies the risk and cost.
The AI Act includes obligations concerning the development of skills for people who use AI systems. For an HR team, learning should reflect the tools and real activities involved: which data may be used, how to verify an output, where errors arise and when use should stop or be escalated.
AI can help HR teams draft, organise and compare information. Responsibility for the process, the relationship with people and decisions affecting their careers remains with the organisation. A well-designed use case has a limited purpose, controlled data, human verification and a clear way to stop.
If you want to build a recruitment process with well-calibrated roles, explicit criteria and consistent assessments, explore our Talent Acquisition service or contact the HR Agile team. For information about how we manage data on this website, see our Privacy Policy.
