AI in HR: A Practical Guide to Recruiting, Onboarding and L&D

AI in HR earns its keep in the work around decisions: drafting job descriptions, preparing structured interviews, building onboarding plans and learning paths, and answering policy questions. The picture changes the moment a tool ranks, filters or evaluates people: the EU AI Act lists recruitment and selection as high-risk, the GDPR restricts solely automated decisions about candidates, and New York City requires a bias audit before an automated tool screens applicants. This guide maps where AI helps an HR team, where the law draws its lines as of 4 November 2026, and how to roll AI out without handing hiring decisions to software.

This article is general information, not legal advice. Legal references were checked against the official texts on 4 November 2026. For decisions with legal consequences, talk to a qualified employment or data protection lawyer in your jurisdiction.

Where AI helps an HR team, and where it must not decide

The useful question is not "should HR use AI?" but "what does this tool do to a person?" Drafting a document about a role is one thing; scoring the people who apply for it is another. Sort every use case by that test:

Most of the value, and most of the safety, sits in the top half of that table. Trouble starts when a feature quietly moves a tool down it: a "smart match" score in the applicant tracking system, a sentiment widget in the interview platform, learning data that starts feeding promotion reviews. Drawing that line for each tool, and keeping it drawn as vendors ship new features, is the hard part of AI in HR. It runs through AI for HR: Recruiting, Onboarding and L&D, Done Compliantly, from the intake template for a new tool to vendor due diligence.

Recruiting with AI: job descriptions, sourcing, screening and interviews

Job descriptions and outreach

AI is very good at the first draft and at the second opinion. Feed it the hiring manager's real requirements, not last year's ad:

You are helping an HR team write a job description.
Role: [title]. Team: [team]. Location and remote policy: [policy].
Must-have requirements (agreed with the hiring manager): [list]
Nice-to-have: [list]. Pay range: [range, if you publish one]
1. Write the job description in plain English, under 450 words.
2. Keep only the must-have list as requirements; everything else goes under "Nice to have".
3. Flag wording that could put off qualified applicants (gendered terms, age-coded phrases
   such as "digital native", degree or years-of-experience requirements the inputs do not
   justify) and suggest neutral alternatives.
4. List any requirement you could not justify from the inputs.

Point 4 is the one that pays off: it surfaces requirements nobody can defend, which are also the ones most likely to filter out good candidates for no reason. For outreach, the model drafts and a recruiter edits and sends, in the AI tool your company has approved, because candidate data is personal data from the first message.

Sourcing and targeted job ads

Here the EU and New York City part ways. Annex III of the EU AI Act lists AI used "to place targeted job advertisements" as a high-risk recruitment use, next to filtering applications and evaluating candidates. New York City's FAQ on Local Law 144 says its audit and notice requirements do not cover scanning a resume bank, outreach to potential candidates or inviting applications, only assessing people who applied for a specific position and employees considered for promotion.

Sourcing also triggers GDPR Article 14: people whose data you collect from somewhere other than themselves must receive your privacy information within one month at the latest, or at the latest with your first message if you contact them (Article 14(3)).

Screening support without automated rejection

The safest useful pattern is evidence extraction: the AI lays out what each application says against your published criteria, and a recruiter decides.

Job criteria (each with what counts as evidence): [criteria list]
Application (name, photo, date of birth and address removed): [CV and answers]
For each criterion, quote the evidence from the application, or write "no evidence found".
Do not score, rank or recommend candidates.
Do not infer age, gender, ethnicity, health, disability or family status.

The last two lines carry the legal weight. GDPR recital 71 gives "e-recruiting practices without any human intervention" as an example of what Article 22 protects people from. Ranking and scoring people is also profiling, and under Article 6(3) of the AI Act an Annex III system "shall always be considered to be high-risk where the AI system performs profiling of natural persons." Whether a pure evidence summary is an exempt "preparatory task" is for the provider to assess and document (Article 6(4)); a match score is not a borderline case.

Interview preparation, and the line on emotion analysis

Structured interviews, with the same job-related questions and rating anchors for every candidate, are where AI saves recruiters the most time:

Using these job criteria: [list], write a structured interview kit.
For each criterion: two behavioral questions, one follow-up probe, and a 1-5 rating scale
with a one-line description of what a 1, a 3 and a 5 answer looks like.
Avoid questions about age, family plans, health, religion, nationality or other personal
circumstances. Add a short note on how interviewers should record evidence, not impressions.

AI can also tidy interviewer notes into a summary, provided candidates know about any recording and the tool summarizes rather than scores. Emotion reading must stay off. Article 5(1)(f) of the AI Act has prohibited AI that infers emotions "in the areas of workplace and education institutions" since 2 February 2025, except for medical or safety reasons, and the Commission's guidelines on prohibited practices say the notion of workplace "should also be understood to apply to candidates during the selection and hiring process." Article 99(3) sets fines of up to €35 million or 7% of worldwide annual turnover, whichever is higher, for breaches of Article 5.

Onboarding: plans, checklists and an HR helpdesk that cites your policies

Onboarding is mostly coordination, which suits AI well. Start with a plan that has owners:

Create a 30-60-90 day onboarding plan for [role] joining [team].
Inputs: role profile [paste], team tools and rituals [list], mandatory trainings [list],
people the new hire must meet [list].
For each phase: goals, tasks, the owner of each task (manager, buddy, HR, IT) and one
check-in question for the manager. Mark anything that depends on missing information
as [to confirm].

The second high-value use is an HR helpdesk that answers questions about leave, benefits, expenses or tools from your own policies. Three rules keep it trustworthy:

• Ground every answer in approved policy documents, and show which document and version it used. "I don't know, here is who to ask" is a correct answer.
• Route sensitive topics to people. Grievances, harassment, health, performance and anything about a specific colleague go to a named HR contact, never to the bot.
• Say it is an AI. Article 50(1) of the AI Act, applicable since 2 August 2026, requires providers to design such systems so that people know they are dealing with an AI, unless that is obvious. If you build the helpdesk yourself on a model API, that duty may well be yours.

Track the questions it could not answer: they are your next documentation fixes.

L&D: learning paths, skill gaps and the AI literacy duty

For learning and development, AI is a fast analyst: give it a role's skill profile, a self-assessment and your course catalog, and it drafts a learning path the employee and manager then edit. Two boundaries matter.

First, keep learning data out of decisions it was not collected for. Annex III point 4(b) covers AI used for decisions on promotion or termination, "to allocate tasks based on individual behaviour or personal traits or characteristics" or "to monitor and evaluate the performance and behaviour" of workers. A learning-path generator is not that, until its scores start feeding promotion or performance reviews; repurposing a tool that way can make you its provider under Article 25(1)(c).

Second, HR usually owns the AI literacy duty. Since Regulation (EU) 2026/1744 replaced Article 4 of the AI Act on 27 July 2026, providers and deployers must "take measures to support the development of AI literacy" of their staff and of others operating AI on their behalf, without having to guarantee "any specific level of AI literacy of any individual." Scale training to risk: recruiters who review AI-assisted shortlists need far more than people using a writing assistant, and the high-risk rules require human overseers with "the necessary competence, training and authority" (Article 26(2)). For the budget case, The ROI of AI Upskilling shows how to measure what training returns.

Where the law draws lines

EU AI Act: recruitment and worker management are high-risk

Annex III point 4 makes two groups of employment uses high-risk: AI for "the recruitment or selection of natural persons, in particular to place targeted job advertisements, to analyse and filter job applications, and to evaluate candidates", and AI for the work-relationship decisions quoted in the L&D section. The Commission's own example is "CV-sorting software for recruitment." The dates after Regulation (EU) 2026/1744 (the "Digital Omnibus on AI", in force since 27 July 2026):

From 2 December 2027, an employer using a high-risk HR system is a deployer and, under Article 26, must:

1. use it according to the provider's instructions for use (26(1));
2. assign oversight to people with "the necessary competence, training and authority, as well as the necessary support" (26(2));
3. keep input data under its control relevant and sufficiently representative (26(4));
4. monitor it, and suspend it and inform the provider and the market surveillance authority if it presents a risk (26(5));
5. keep the logs under its control for at least six months, unless other law provides otherwise (26(6));
6. inform workers' representatives and the affected workers before using it at the workplace (26(7));
7. use the provider's information for its GDPR impact assessment (26(9));
8. tell people they are subject to it when it makes, or assists in making, decisions about them (26(11)).

Two traps deserve a line each. A general-purpose chatbot asked to rank a pile of CVs is a repurposed system, and Article 25(1)(c) can make you its provider. And the amended Article 111(2) covers high-risk systems placed on the market or put into service before the application date only if their design changes significantly from that date, which depends on facts only the provider knows: get its position in writing. The wider deployer picture is in our EU AI Act compliance guide for businesses, and mapping roles, risk tiers and GDPR duties system by system is the core of AI Data Privacy and EU AI Act Compliance for Professionals.

GDPR: Article 22, transparency and the DPIA

The AI Act's later dates do not delay the GDPR, which has applied to every CV since 25 May 2018:

• Article 22 gives people "the right not to be subject to a decision based solely on automated processing, including profiling," with legal or similarly significant effects. Its exceptions (contract, law, explicit consent) come with safeguards; for contract and consent, at least the right to obtain human intervention, to express a point of view and to contest the decision (Article 22(3)).
• Meaningful review. The WP29 guidelines on automated decision-making, endorsed by the European Data Protection Board, warn against "fabricating human involvement": oversight must be "meaningful, rather than just a token gesture," carried out by "someone who has the authority and competence to change the decision."
• Transparency. Such decisions require "meaningful information about the logic involved" and their envisaged consequences (Articles 13(2)(f), 14(2)(g) and 15(1)(h)).
• The DPIA. Article 35(3)(a) requires one for systematic and extensive automated evaluation on which significant decisions are based. The WP29 DPIA guidelines say processing that meets two of their nine criteria needs one in most cases, and list employees among vulnerable data subjects. AI screening usually meets several.

Avoid consent as the lawful basis: the EDPB considers it "problematic for employers to process personal data of current or future employees on the basis of consent as it is unlikely to be freely given." And check national law, because Article 88 lets Member States set more specific rules on employee data, including recruitment, by law or collective agreement.

New York City: Local Law 144 bias audits and notices

New York City's law on automated employment decision tools (AEDTs) took effect on 1 January 2023 and has been enforced since 5 July 2023. According to the FAQ of the city's Department of Consumer and Worker Protection:

• An AEDT uses machine learning, statistical modeling, data analytics or artificial intelligence, helps make employment decisions and "substantially assists or replaces discretionary decision-making." Screening counts.
• It needs a bias audit by an independent auditor from the past year, with selection or scoring rates and impact ratios across sex, race/ethnicity and intersectional categories. Imputed or inferred demographic data cannot be used.
• Employers publish the audit summary and the date they began using the tool, and notify candidates and employees who live in the city 10 business days before use, naming the qualifications or characteristics assessed and how to request a reasonable accommodation.
• The employer, not the vendor, is responsible. The law requires no specific action on the results, but anti-discrimination laws still apply.

United Kingdom: new automated decision rules since February 2026

Section 80 of the Data (Use and Access) Act 2025 replaced Article 22 of the UK GDPR with Articles 22A to 22D, fully in force since 5 February 2026. A "significant decision" with no meaningful human involvement is now permitted with safeguards (information, representations, human intervention and the right to contest, Article 22C), while Article 22B restricts some, notably those based on special-category data.

The ICO's report Recruitment rewired (31 March 2026), drawn from more than 30 employers, found that "many employers engaging in automated recruitment are likely relying on solely automated decisions." Announcing it, the ICO said it expects employers to monitor for bias, including by "considering monthly bias reviews", to tell candidates when automated decision-making is used and how it works, and to explain how to challenge a decision and request a human review.

Bias testing and human review that hold up

Bias testing is not a certificate from a vendor; it is a routine your team runs on its own funnel. Compute each group's selection rate at each stage (screened in, interviewed, offered), where you lawfully hold the data. An illustrative example:

Then work through the checks:

1. Use the four-fifths rule as a trigger. The US Uniform Guidelines on Employee Selection Procedures treat a selection rate below four-fifths (80%) of the highest group's rate as evidence of adverse impact, and smaller differences can still count (29 CFR 1607.4(D)). Group B's 0.65 calls for an investigation, not a verdict: which criterion drives the gap, and is it job-related?
2. Run paired tests. Submit the same application twice, changing only the name, a career break or the university. Any change in the output shows the tool reacting to a proxy.
3. Audit the reviewers, not just the model. Track how often reviewers overturn the tool; zero overrides signals rubber-stamping, not accuracy. The ICO also expects human involvement to be applied consistently to all candidates within a hiring stage.
4. Handle sensitive data deliberately. Testing by ethnicity or disability needs special-category data. The new Article 4a of the AI Act lets deployers of high-risk systems process it exceptionally, where strictly necessary for bias detection and correction, with safeguards such as pseudonymization, access controls, no sharing with other parties and deletion once the bias is corrected. It creates no obligation to do so; involve your data protection officer first.
5. Re-test after every change to the model, the criteria or the job family, and date the results.

Building the test set, reading subgroup results and turning findings into vendor questions is covered step by step in AI for HR: Recruiting, Onboarding and L&D, Done Compliantly.

A rollout checklist for an HR team

Map

• Inventory every AI feature in your applicant tracking, HR information and learning systems, including features switched on by vendor updates.
• Classify each one: drafting and planning, evidence extraction, ranking or evaluation (Annex III), or prohibited.
• Switch off emotion analysis and any automatic rejection without human review.

Decide

• Ask vendors for the intended purpose and instructions for use, their documented Article 6(4) assessment if they claim a tool is not high-risk, bias results by group, log export, data location and retention, override features and their incident process; for New York City roles, the current bias audit summary.
• Run the DPIA with your data protection officer, choose a lawful basis other than consent, and set retention periods for applicant data and AI outputs.
• Prepare candidate notices and plan employee consultation where national law requires it.

Pilot

• Start with one role family and human review on every decision.
• Define success first: time to shortlist, hiring-manager satisfaction, candidate experience and selection-rate ratios.
• Train reviewers on the tool's limits and on what meaningful review looks like.

Run

• Review bias and override data on a fixed cadence (the ICO suggests considering monthly reviews) and re-test after updates.
• Tell candidates in plain language what the AI does, what it does not do and how to ask for a human review.

The tools are the easy part. Recruiters who fear being replaced can end up ignoring the tool or over-trusting it, and both break the human review the law relies on. Leading a team through that shift is the subject of Manager in the AI Era: Leading Your Team Through the AI Transformation.

Frequently Asked Questions (FAQ)

Is using AI to write job descriptions high-risk under the EU AI Act? Not by itself: drafting a job description changes a document, not a decision about a person. Annex III does list AI used to place targeted job advertisements, filter applications and evaluate candidates, so a tool that targets the ad or ranks the replies falls under it.

When do the EU AI Act's high-risk rules apply to recruitment AI? From 2 December 2027 for Annex III systems, which include recruitment, selection and worker management; Regulation (EU) 2026/1744 moved the date from 2 August 2026. The ban on emotion recognition in the workplace has applied since 2 February 2025, and the GDPR applies today.

Can AI reject job applicants automatically? In the EU, Article 22 GDPR gives candidates the right not to be subject to solely automated decisions with legal or similarly significant effects, and its exceptions come with safeguards such as human intervention and the right to contest. In the UK, such decisions have been permitted with mandatory safeguards since 5 February 2026. In both, a meaningful human review of rejections is the safer design.

What does New York City's Local Law 144 require? An independent bias audit from the past year for any automated employment decision tool used to assess candidates or employees for promotion, a public summary of its results, and a notice to New York City residents 10 business days before use.

Can we use AI to analyze emotions in video interviews? Not in the EU. Article 5(1)(f) of the AI Act prohibits AI that infers emotions in the workplace, except for medical or safety reasons, and the Commission's guidelines apply this to candidates in recruitment. Transcripts and summaries of what candidates said, assessed by people, are a different category, still subject to the GDPR.

Conclusion

AI in HR pays off where it prepares the work: job descriptions, interview kits, onboarding plans, learning paths and policy answers grounded in your own documents. It becomes regulated territory the moment it ranks, filters or evaluates people: high-risk under the EU AI Act from 2 December 2027, already bound by the GDPR's rules on automated decisions, audited in New York City and subject to new safeguards in the UK. Inventory the tools, keep a meaningful human on every decision about a person, test your own funnel for bias and tell candidates what the AI does.

Sources

Checked on 4 November 2026. This article is general information, not legal advice.

• Regulation (EU) 2024/1689 (Artificial Intelligence Act), Official Journal of the European Union, 12 July 2024
• Regulation (EU) 2026/1744 (Digital Omnibus on AI), Official Journal of the European Union, 24 July 2026
• Regulation (EU) 2016/679 (General Data Protection Regulation), Official Journal of the European Union, 4 May 2016
• Endorsed WP29 guidelines, including WP251rev.01 on automated decision-making and WP248 rev.01 on DPIAs, European Data Protection Board
• Automated Employment Decision Tools: Frequently Asked Questions, NYC Department of Consumer and Worker Protection
• Recruitment rewired, Information Commissioner's Office, 31 March 2026
• Also cited: Commission Guidelines on prohibited AI practices, C(2025) 5052 final, paragraph (254); EDPB Guidelines 05/2020 on consent, paragraph 21; Data (Use and Access) Act 2025, section 80; 29 CFR 1607.4(D)