AI Tools for Recruiting Agencies: The Legal Limits
The line is between helping you work and making the decision. Sourcing, scheduling and drafting sit on one side; screening, scoring and ranking sit on the other. The rules moved twice this year in opposite directions, including an EU deadline most guides still get wrong.
AI tools for recruiting agencies are useful for sourcing, scheduling, note-taking and drafting, and legally constrained the moment they start ranking, scoring or filtering candidates. That line, between helping you work and making the decision, is where every current rule lands. Get it right and most of the tooling is fine. Get it wrong and you are running an automated employment decision tool without knowing it.
The rules moved twice this year, in opposite directions, and a lot of recruiting content written six months ago is now wrong about both. Worth ten minutes to get straight.
Where the line sits, job by job
Task | Regulatory weight | Practical read |
|---|---|---|
Sourcing and search | Low | Finding candidates is not deciding about them |
Interview scheduling and reminders | None | Pure admin, automate freely |
Interview notes and summaries | Low, consent applies | Recording rules vary by jurisdiction, tell people |
Drafting job descriptions | Low | Check for language that narrows the pool |
Drafting outreach and rejections | Low | The decision is yours, the prose is drafted |
CV screening and shortlisting | High | This is a decision tool in most rules |
Scoring or ranking candidates | High | The clearest case, and the most regulated |
Video or voice assessment scoring | High | Highest scrutiny, and disability discrimination exposure |
The bottom three rows are the ones to be careful with. Everything above them is where the actual time savings live anyway, which is a happier coincidence than it sounds.
The United States: three different regimes
New York City, Local Law 144. In force since 2023 and enforced by the Department of Consumer and Worker Protection since July 2023. If you use an automated employment decision tool for hiring or promotion in NYC, or for a remote role tied to a NYC office, you must commission an independent bias audit annually, publish a summary of the results publicly, and give candidates at least ten business days' notice before the tool is used on them. Penalties run from $500 for a first violation to $1,500 per day for continuing ones. The DCWP's own FAQ is the primary source worth reading rather than a summary.
Illinois, HB 3773. Effective 1 January 2026. It prohibits using AI in a way that discriminates on protected characteristics across recruitment, hiring, promotion, discipline and discharge, requires notice to applicants and employees when AI is used in those decisions, and specifically prohibits using zip code as a proxy for a protected class. No bias audit requirement, no impact assessment: enforcement runs through civil rights investigations rather than a compliance filing.
Colorado, the one that got smaller. The Colorado AI Act was repealed and replaced by SB 26-189, signed on 14 May 2026, before the original ever took effect. The replacement drops the bias audit and risk assessment requirements and is not scheduled to apply until January 2027. If you built a compliance plan against the original Colorado act, it is now aimed at a law that does not exist.
Note the pattern: notice obligations are becoming near-universal, audit obligations are not. Telling candidates that AI is involved is the cheapest compliance you will ever do and it is required in more places every year.
The EU: the deadline moved, and most guides have not caught up
Recruitment and candidate evaluation systems are classified as high-risk under Annex III of the EU AI Act. That has not changed. What changed is when the obligations bite.
Under the Digital Omnibus on AI, published in the Official Journal on 24 July 2026 and in force from 27 July, the application date for stand-alone Annex III high-risk obligations moved from 2 August 2026 to 2 December 2027, with AI embedded in regulated products under Annex I moving to 2 August 2028. Gibson Dunn's analysis and Pinsent Masons' write-up both walk through the detail.
Two things this does not change, and they are the ones that apply to you today. The Article 50 transparency rules stayed where they were. So did the Article 4 AI literacy duty, which obliges providers and deployers to make sure the people operating these systems actually understand them. A deferral on conformity assessment is not a deferral on telling people, or on training your consultants.
If you are checking your own exposure, the high-risk deadline explainer covers the classification test itself.
What to actually do this quarter
Five things, in order of how much protection they buy per hour spent.
Write down which of your tools touch the bottom three rows of that table. Most agencies discover at least one they had not thought of, usually inside an applicant tracking system they did not choose.
Add a notice line to your candidate communications. One sentence saying AI is used to assist with screening or scheduling, and that a person makes the decision. This is now required in several places and harmless everywhere.
Keep a human decision record. For every shortlist, who decided and on what basis. If a tool ever gets challenged, this is the document that matters.
Ask your ATS vendor two questions in writing. Does the product perform automated employment decisions as defined in NYC Local Law 144, and has a bias audit been performed? File the answer. How to vet an AI vendor covers what else to ask while you have their attention.
Put it in your usage policy. Consultants will use assistants whether or not you approve them, and an unwritten policy is one nobody follows. Writing an AI usage policy is a one-afternoon job.
The other side of the desk
Worth remembering that your candidates now use the same tools. A CV written with an assistant is not evidence of anything, and screening for AI-written applications will mostly filter out people who write badly under pressure. Spotting an AI generated resume is about verification rather than exclusion, which is the more useful framing.
For the wider view, where AI actually pays in a small services business has the general case.
This is general information rather than legal advice, and employment law is jurisdictional. Where a specific placement is high value or high risk, ask a lawyer in the relevant jurisdiction.
FAQ
Can recruiting agencies use AI to screen CVs? Yes, with conditions that depend on jurisdiction. In New York City, screening tools trigger an annual independent bias audit, public results and ten business days' candidate notice. In Illinois, notice is required and discriminatory outcomes are prohibited.
Do I have to tell candidates I am using AI? Increasingly yes, and it is good practice regardless. Illinois requires notice, NYC requires ten business days' advance notice for automated employment decision tools, and the EU AI Act's transparency rules are unaffected by the recent deferral.
When do EU AI Act rules apply to recruitment tools? Stand-alone Annex III high-risk obligations now apply from 2 December 2027, moved from 2 August 2026 by the Digital Omnibus on AI that entered into force on 27 July 2026. Transparency and AI literacy duties were not deferred.
Is using AI to write job descriptions regulated? Not as a decision tool, no. It is still worth reviewing the output for language that narrows your applicant pool, which is a discrimination exposure regardless of who wrote the words.
What is an automated employment decision tool? Broadly, a computational process that substantially assists or replaces discretionary decision making about hiring or promotion. The exact definition varies by law, which is why the vendor question in writing matters.
How did this land?
About the author
Senior Editor, AI & Product
Cecilia leads the Swarmz editorial desk. She has spent a decade turning complex AI and product topics into writing people actually finish, and she owns the blog's quality bar.
