AI in recruitment: what the EU, UK and US rules ask
How the EU AI Act, UK data protection law and US state laws treat AI in hiring, the pitfalls that catch employers out, and what to ask of any tool.
Using AI to recruit is legal in the EU, the UK and the US, but all three now expect the same things of an employer: a person makes the decision, candidates are told, and you can show the tool treats people fairly. The EU writes this down most strictly, the UK leans on data protection and equality law, and the US is a patchwork of state and city laws, with the courts filling the gaps.
This is a plain-English guide for talent and people leaders, not legal advice. Take anything you plan to rely on to your own lawyers.
The EU: recruitment AI is high-risk
The EU AI Act puts AI used to recruit or select people, including AI that places targeted job adverts and AI that analyses, filters or evaluates applications, in its high-risk category. Three dates matter.
From 2 February 2025, some practices are banned outright. The one that reaches hiring is AI that infers people’s emotions at work, which rules out tools that read emotion from a candidate’s face or voice.
From 2 August 2026, the transparency rules apply: people must be told when they are dealing with an AI system.
From 2 December 2027, the high-risk rules apply to recruitment AI. They were due in August 2026; the Digital Omnibus on AI moved them back. Most of the heavy lifting falls on the vendor, who must manage risk, govern training data, document the system and pass a conformity assessment. But the employer, as the deployer, has duties of its own: give oversight to people with the competence and authority to use it, use the tool as instructed, monitor it, keep its logs, and tell candidates and employee representatives that it is in use.
The UK: no AI law, but the law still applies
The UK has no AI-specific law for hiring. Two existing laws do the work.
Data protection is the first. The Data (Use and Access) Act 2025 replaced the old UK GDPR rule on automated decisions from 5 February 2026. Decisions made solely by a machine are now allowed more widely, but only with safeguards: the person must be told, be able to make their case, ask for a human to step in and challenge the decision. Decisions that rest on sensitive data, such as health or ethnicity, stay tightly restricted.
Equality law is the second. The Equality Act 2010 does not care whether a person or a model made the decision. If a tool disadvantages people with a protected characteristic and you cannot justify it, the employer is liable.
The regulator has already looked. In 2024 the ICO audited AI recruitment tool providers and made almost 300 recommendations. It found tools that let recruiters filter out candidates with certain protected characteristics, tools that inferred gender and ethnicity from a candidate’s name, and tools that kept far more personal information than they needed.
The US: state laws and the courts
There is no federal AI hiring law. Washington has signalled that it wants to limit state AI laws, but Congress has not passed anything that does, so the state and city laws stand.
More keep coming. US states introduced more than 1,500 AI-related bills in the first three months of 2026 alone, according to Warden. The ones that already reach hiring:
- New York City has required an independent bias audit, a published summary of it and notice to candidates for automated hiring tools since July 2023.
- Illinois has treated discrimination through AI in employment decisions as a civil rights violation since 1 January 2026. Employers must give notice, and using postcodes as a stand-in for a protected characteristic is banned.
- California’s civil rights rules have covered automated decision systems in hiring since 1 October 2025, with records kept for four years.
- Colorado rewrote its AI law in May 2026. From 1 January 2027 employers must tell people when AI materially influences a decision about them, explain it and offer human review.
The courts are moving faster than the legislators, and they are applying discrimination law that already exists. The EEOC’s case against iTutorGroup, settled in 2023, concerned software that automatically turned away older applicants. In Mobley v. Workday, a federal court in California has let discrimination claims proceed against the software vendor itself, as well as on behalf of applicants nationwide. The lesson for buyers is that the vendor and the employer can both be held to account for what a tool does.
Where the three agree
The detail differs from place to place: the same screening tool can need an independent audit in one jurisdiction and only a notice to candidates in another. Read side by side, though, the rules ask the same five things of an employer:
- A person with real authority makes the decision, and can see every candidate, not only the ones the machine let through.
- Candidates are told that AI is used, and what for.
- The tool is tested for fairness, and you can show the results.
- Decisions are recorded, so you can explain one after the fact.
- The AI scores only what is relevant to the job.
The pitfalls that catch employers out
A human in the loop who only sees the shortlist. If a score threshold decides who reaches a recruiter, the machine has made the decision, whoever signs it off. This is the pattern regulators and claimants look for first.
Scoring things a hiring decision should not rest on. Tone of voice, facial expression, writing style read as “fit” or enthusiasm: these are hard to justify, easy to bias, and in the EU emotion recognition at work is banned.
Proxies. A model that never sees ethnicity can still learn it from a postcode, a name or a school. Gaps in employment and graduation dates can stand in for age, disability or caring responsibilities.
Compliance badges with nothing behind them. “AI Act ready” on a vendor’s site means little without a named auditor, a published report and a clear account of what was tested.
Treating a vendor’s audit as the end of the job. Independent testing with realistic test data shows whether an AI treats people differently because of who they are. Whether outcomes differ across groups in your own hiring can only be measured on your own data.
Not telling candidates, or giving them no way to say no.
Records nobody can produce. If you cannot show why a candidate was ranked where they were, you cannot defend the decision.
What to do now
- Keep early questions to a role’s basic requirements, set by your team and the same for everyone.
- Make sure every application can still be read by a person, whatever its score.
- Tell candidates where AI is used, and let them opt out without penalty.
- Ask every vendor who audits their AI, what was tested and how recently, and get it in writing.
- Measure outcomes across groups in your own hiring, not only in the vendor’s test.
- Bring your legal and data protection teams in before you switch a tool on, not after.
- Keep track of the rules where you hire. Warden Watch, a free public tracker from Warden, follows employment AI laws and lawsuits across 25 jurisdictions.
Our questions to ask any AI hiring vendor go further on the last two.
How inploi works
We describe how the product works and leave it to your lawyers to judge it against the rules that apply to you.
Agents rank and recommend; they never reject. The score changes the order of the queue, not who is seen. Every application stays in the queue and can be read in full.
Personal details are removed before the Hiring Agent scores an application, and scoring uses only the criteria your team sets. Where a candidate answers by voice, the audio is used only to make a transcript. How someone sounds is never scored.
Every candidate is asked whether they are happy for AI to be used. They can say no and carry on, and neither answer helps or harms their application. If a candidate says no, the Hiring Agent does not score their application.
inploi’s use of AI, including the Hiring Agent and the Candidate Agent, is independently audited for fairness and accuracy by Warden. A full audit trail of every agent action is available in Studio. Whether outcomes differ across groups in your own hiring can only be measured on your own data, and we will work with your team on that audit.
Read how our AI works, question by question, on our AI security page, or download the one-page guide to the EU AI Act for your legal and procurement teams. More on trust in hiring.
