Security and compliance
AI recruitment with control where it matters
AIcruiters is built so recruitment teams keep control over an autonomous sourcing agent. You set which actions need approval, every ranking shows its evidence, access to candidate data and its retention are restricted per workflow, and uncertain cases go to a person. Hosting, security and data processing details are discussed in a technical and privacy review.
What can go wrong when AI is used in recruitment?
The risks are concrete. A model can rank people on criteria that have nothing to do with the job. Candidate data can be collected, kept or shared beyond what the purpose requires. Messages can go out that nobody checked. And when something goes wrong, nobody can explain why a candidate was selected or skipped.
Good compliance in AI recruitment is therefore less about a label and more about design: who approves what, what the recruiter can see, what data the agent touches and what happens when it is unsure. The sections below describe how AIcruiters handles each of those questions.
Which controls are built into AIcruiters?
Approval rules
Your team decides which actions run automatically and which need a person: search strategy, candidate selection, outreach and handover. See human-in-the-loop control.
Explainable matching
Every ranking shows the matching evidence, missing requirements and risk factors, so a recruiter can see why a candidate was selected and challenge it. See candidate ranking.
Data control
Access to candidate data, how it is used and how long it is kept are restricted within each workflow.
Exception handling
Low-confidence cases and unexpected outcomes are sent to a recruiter instead of being processed automatically.
What is the recruiter responsible for?
AIcruiters does not decide who is hired. The agent finds, ranks and approaches candidates within your rules. People remain responsible for the judgements that affect candidates.
- Setting job-related criteria and approving search strategies
- Reviewing rankings, especially flagged and low-confidence cases
- Approving outreach where your rules require it
- Every conversation, interview, assessment and hiring decision
- Search strategy
Senior Backend Engineer
Approved · Eva · 09:41 - Outreach
25 personal messages
ApproveEdit - Low confidence
Joris V.
Sent to recruiter
How does the technical and privacy review work?
Before AIcruiters runs on live vacancies, we go through the setup with your recruitment lead and, where relevant, your IT, security or privacy officer. Specific hosting, security and compliance details are discussed there rather than summarised on a web page.
- 01
Map the workflow
Which vacancies, which steps the agent performs and where approval points sit.
- 02
Data sources and categories
Which talent sources are used, which candidate data is processed and for which purpose.
- 03
Access and retention
Who in your team sees what, and how long candidate data is kept per workflow.
- 04
Hosting, security and processing roles
Where data is processed, which security measures apply and how responsibilities between your organisation and AIcruiters are set out.
- 05
Integration and handover
Whether your ATS gets a direct integration, a structured handover or another setup, assessed per ATS.
How does the EU AI Act apply to AI sourcing?
The AI Act (Regulation (EU) 2024/1689) lists AI systems intended for recruitment or selection, in particular to analyse and filter applications and to evaluate candidates, as high-risk in Annex III, point 4. Following the Digital Omnibus on AI (Regulation (EU) 2026/1744, in force since 27 July 2026), the obligations for these Annex III high-risk systems apply, according to the current timeline, from 2 December 2027.
Those obligations include risk management, data governance, record-keeping, transparency and human oversight (Article 14). Organisations that use such systems, the deployers, have their own duties, such as using the system according to its instructions and assigning oversight to competent people. Whether and how a specific setup falls under these rules depends on the use case, so treat this as orientation rather than legal advice. Our guide to the EU AI Act in recruitment goes into more detail.
What does the GDPR require when you source candidates?
Sourcing processes personal data of people who did not apply. A few GDPR principles matter most here. Purpose limitation and data minimisation (Article 5) mean you only process what the vacancy requires. Storage limitation means you do not keep profiles indefinitely. Article 14 requires you to inform people whose data you obtained from other sources, at the latest when you first contact them if you use the data for that. Article 22 gives people the right not to be subject to decisions based solely on automated processing that significantly affect them.
Approval rules, visible evidence and per-workflow retention are designed to support those principles, but the legal basis, privacy notice and any data protection impact assessment remain choices your organisation makes. Our guide to GDPR and candidate sourcing explains them in practical terms.
Questions about security and compliance
How is candidate data handled?
Access, usage, storage and retention follow the agreed workflow and applicable privacy requirements. Specific hosting, security and compliance details are discussed during the technical review.
How do you prevent biased candidate selection?
Rankings are based on predefined job-related criteria, and the supporting evidence stays visible, so recruiters can identify, challenge and correct questionable outcomes.
What happens when the agent is uncertain?
Low-confidence matches, conflicting information and unexpected situations are routed to a recruiter for review instead of being processed automatically.
Is AIcruiters GDPR compliant?
Compliance depends on how a system is used, not only on the software. We go through data sources, purposes, retention and processing roles with you in the privacy review, so your organisation can make its own assessment.
Who is involved in the review?
Typically your recruitment lead, and depending on your organisation an IT or security contact and your privacy officer.
Bring your security and privacy questions
Book a demo on a real vacancy and put your compliance questions on the agenda. We plan the technical and privacy review from there.