HR is using AI for candidates.
Good.
And who checked whether it is legal, safe and fair?
This will become one of the biggest quiet topics inside companies.
Not AI in manufacturing.
Not AI in marketing.
AI in HR.
Why?
Because HR works with a very sensitive human context: CVs, education, work history, salary, performance, reviews, career progression and hiring decisions.
Now imagine that HR uses an external tool.
For sorting candidates. For evaluating CVs. For scoring applicants. For analyzing interview answers. For assessing employee performance.
And somewhere in the vendor presentation there is a small sentence:
Powered by AI.
The question is:
Who in the company knows exactly what that means?
The questions companies should ask
Before AI becomes part of HR decision-making, the company should be able to answer basic questions:
- What data is sent into the tool?
- Where is it stored?
- Is it used to train a model?
- Is profiling taking place?
- Does the candidate know that AI evaluates or influences the process?
- Can the company explain why a candidate was rejected?
- Who audited model bias?
- Who reviewed the supplier?
- Who carries responsibility?
This is no longer just an “HR helper”.
It is the intersection of GDPR, the AI Act, NIS2, employment law, ethics and reputational risk.
What the regulations ask
GDPR asks:
What personal data are you processing, and on what legal basis?
The AI Act asks:
Are you using AI for recruitment, evaluation or management of workers?
NIS2 asks:
Do you control your digital and supplier risks?
And management should ask an even simpler question:
Do we really want a tool we do not understand, have not audited, and only know through a vendor’s promise of compliance, to influence decisions about people?
The real risk
The biggest risk of HR AI will not be that the tool writes a bad text.
The risk is that a company starts making personnel decisions based on invisible scoring, unexplained recommendations and data flows nobody controls.
And when a candidate, employee, regulator, court or journalist asks:
Why did you decide this way?
The answer:
The system recommended it.
will not be enough.
AI in HR can be useful.
But only when it is governed.
Not when it is hidden inside an external tool that someone purchased as a modern HR solution.
Before deployment
Before deploying AI in HR, a company should know:
- which HR tools use AI,
- what data enters those tools,
- where the data is processed,
- whether profiling takes place,
- whether human oversight exists,
- whether the decision is explainable,
- whether the supplier was legally and security assessed,
- whether there is an audit trail.
These are not abstract compliance questions. They determine whether the company controls the process or simply trusts a black box.
Governance first
If HR uses AI without governance, it is not innovation.
It is a personnel risk with a nice user interface.