The questions recruiters ask
- Am I allowed to screen resumes with AI?. Yes, as long as you inform candidates and don't let the AI reject anyone on its own.
- What do I tell candidates?. That AI is involved in processing their application, at which stage, and how to exercise their rights.
- How do I justify a decision?. An evaluation that can't be explained is hard to defend when a candidate challenges it.
The principles to follow
- Inform. Candidates need to know AI is involved. At Delectus, every call, every text exchange and every interview run by an agent is announced as automated.
- Keep the decision human. The GDPR restricts fully automated decisions. The tool ranks and evaluates; the recruiter makes the call.
- Explain. Every ranking and every score rests on elements quoted from the resume or the interview.
- Minimize data. Only process what serves the hiring process, and keep it for a defined period.
AI in recruiting: who does what
Obligations are shared between the hiring company and the tool's vendor. This table sums up the main points; it doesn't replace advice from your legal counsel.
| Topic | Hiring company | AI tool vendor |
|---|---|---|
| Informing candidates | Informs candidates about the use of AI and their rights | Provides the documentation needed to do so |
| Purpose and criteria | Defines the role and the evaluation criteria | Applies only the criteria provided |
| Decision | Makes the decision, through an authorized person | Explains rankings and evaluations |
| Data | Sets retention periods, responds to candidate requests | Hosts and secures the data under the contract |
| Documentation | Keeps the record of processing, carries out the impact assessment if needed | Documents how the tool works and its limits |
What the GDPR requires in recruiting
With or without AI, processing applications falls under the GDPR. These obligations existed long before AI tools and apply to them in the same way.
- Inform candidates about how their data is used and about their rights
- Collect only the information needed to evaluate the application
- Set a retention period, then delete or anonymize
- Secure access to candidate data
- Respond to requests for access, correction and erasure
What the French Labor Code says about hiring methods
Even before the GDPR and the AI Act, the French Labor Code regulates hiring. Information requested from a candidate can only be used to assess their ability to do the job and their professional skills, and it must have a direct and necessary link to the position offered.
Candidates must also be told, before they're used, which recruitment methods and techniques are applied to them, and those methods must be relevant to their purpose. An AI tool is a recruitment technique. Its use has to be disclosed, and it has to focus on the job.
Automated decisions: what Article 22 of the GDPR says
The GDPR gives everyone the right not to be subject to a decision based solely on automated processing when it produces legal effects concerning them or similarly significantly affects them. Rejecting a candidate falls into that category.
So an AI can rank and summarize, but a person must genuinely review the applications and make the decision. A rubber-stamp approval, with no real review, isn't enough. That's why Delectus never rejects a candidate on its own and backs every evaluation with elements the recruiter can check.
The AI Act and recruiting
The EU regulation on artificial intelligence classifies AI systems used to recruit and select candidates as high-risk. Among other things, it requires human oversight, transparency and documentation of the system.
Those requirements shaped the design of Delectus. Every result can be explained, and every automated step leaves the recruiter free to review, correct or set aside what the AI suggests.
Informing candidates: a sample notice
“Your application is processed by [company] for the [job title] position. Artificial intelligence tools help us analyze applications and prepare interviews. Decisions are made by our team. Your data is kept for [period], and you can exercise your rights of access, correction and erasure at [contact].”
Adapted to your situation and approved by your legal counsel, a notice like this goes in the job posting or on the application page.
SMS and voice agents: disclosing the AI from the first message
When an AI contacts a candidate, the disclosure has to come before the conversation, not after. At Delectus, the prescreening agent's first message, sent by text or WhatsApp, states that it's an AI and asks for the candidate's consent to the processing of their data. The voice agent also introduces itself as an AI at the very start of the call.
Both agents ask only the posting's questions, which are about the job. Every conversation produces a transcript and a summary that the recruiter reads before deciding what comes next. The candidate can end the conversation at any time.
Recorded and transcribed interviews: what to plan for
When a video interview is transcribed and recorded in Delectus, the agent's presence is announced to both sides from the start. The recording and the transcript are application data like any other. They're covered by your candidate notice and follow your retention periods.
The analysis looks at the content of the answers, against the role's criteria. Candidates' faces, tone of voice and appearance are not analyzed.
Where the data lives
Candidate data is hosted in the European Union and isn't used to train any model. Retention periods follow your rules, and data is deleted when they expire.
Best practices before using AI to hire
Before rolling out an AI tool in your hiring, check where the data is hosted and whether it's used to train models. Then document the use: the stage it covers, the decisions it prepares and the oversight in place. Update your record of processing activities and, if needed, carry out an impact assessment. Finally, train recruiters to read the AI's output with a critical eye and to question it.
Questions to ask an AI recruiting vendor
Before choosing a tool, ask the vendor these questions and get the answers in writing.
- Where is the data hosted, and which subprocessors does it pass through?
- Are resumes and interviews used to train models?
- How does the tool explain a ranking or an evaluation?
- Does the tool analyze things unrelated to the job, like faces or tone of voice?
- How is data deleted at the end of the retention period?
- What documentation does the vendor provide for your record of processing and your impact assessment?
Informing employee representatives
In French companies with a works council (CSE), introducing new technologies or new ways of processing data may require informing it, or even consulting it. The EU AI Act also requires informing workers' representatives before a high-risk system is put into service in the workplace. Check with your legal counsel before rolling it out.
Frequently asked questions
Does the GDPR allow AI in recruiting?
Yes, as long as its principles are respected. Candidates are informed, the purpose is clear, data is limited and kept for a defined period, and no decision with a significant effect relies solely on automated processing without safeguards.
Does the AI Act ban AI in recruiting?
No. It classifies it as high-risk and regulates it, with human oversight, transparency and documentation. Some practices, however, are banned, such as emotion recognition in the workplace.
Does Delectus analyze candidates' faces or voices?
No. Delectus analyzes neither faces, nor tone of voice, nor appearance. Evaluations are based on the content of the answers, against the role's criteria.
Can a candidate challenge an evaluation?
Yes. They can exercise their rights with the hiring company. Because evaluations are backed by quotes, a recruiter can review them point by point.
What can a candidate ask about a decision made with AI?
They can request access to their data and information about the logic of the processing. That's a good reason to choose an AI whose evaluations can be explained.
Do you need an impact assessment to use AI in recruiting?
A data protection impact assessment (DPIA) is often recommended when processing systematically evaluates people. Your data protection officer can tell you whether one is required in your case.
Do candidates need to be told an AI is analyzing their resume?
Yes. The French Labor Code requires informing candidates of the recruitment methods used, and the GDPR requires informing them about the processing of their data. The notice goes in the job posting or on the application page.
Can you reject a candidate based on an AI score alone?
No. That kind of decision must be made by a person who genuinely reviews the application. The score or ranking is only a decision aid.
