AI and Recruitment: The 3 Rules to Follow

You have a CV database. You use (or are thinking about using) AI to search it. You’re wondering: am I compliant?

Good news: yes, you can be. Three simple rules to follow. And contrary to what you hear, it’s not complicated.

The context: why law gets involved

When you store a CV, you store personal data. When you use AI to analyze that CV and decide whether to call the candidate, you’re processing personal data.

In Europe (GDPR), there are rules for this. Not to annoy you. To protect both candidates AND you.

Rule 1: You need a good reason to keep CVs

This is the rule often broken unknowingly.

Concretely: Keeping CVs indefinitely “just in case” isn’t legal. You need a reason — a “legal basis.”

Reasons that work:

You have an active application. The candidate applied for an opening? You can keep their CV while processing the application. Makes sense.
You have their agreement (but it’s complicated). They said “yes, keep my CV.” Problem: is consent given 2 years ago still valid? Legally, it’s murky. It works better with regular opt-in processes.
You have documented legitimate interest. “I keep these CVs because I recruit regularly” — that’s valid. But you need to have written it, and there’s a time limit (usually 2 years).

Simple best practice: Keep CVs maximum 2 years after rejection. After that, delete them. Easy to explain, easy to defend.

Rule 2: AI can help, but can’t decide alone

This is where many wonder: can my AI automatically reject a candidate?

Answer: no.

What’s allowed:

AI ranks candidates by relevance ✓
AI suggests the best profiles ✓
AI helps you find candidates ✓

What’s not allowed:

AI automatically rejects without human input ✗
AI decides to call or not without you reviewing ✗

In practice: You use RelaSync to find the best candidates. You, the recruiter, decide who to call. AI helps. It doesn’t decide.

That’s the difference between a tool and a thinking machine.

Rule 3: Bias matters

AI models learn from history. If your hiring history has bias (you hired mostly men in tech, for example), AI can learn and repeat that bias.

What can happen:

AI penalizes CVs mentioning parenthood (gender bias)
AI favors certain schools because your past hires favored them
AI penalizes senior profiles (age bias)

How you protect yourself:

Choose a tool where vendors explain how they manage bias. RelaSync trains models with diversity in mind.
Check regularly. Look at your shortlist. Mostly men? Mostly from one school? That’s a signal.
Never let AI decide alone. You, the recruiter, see the human behind the CV. AI only sees patterns. Stay vigilant.

Concrete best practices

Here’s what you must do (honestly, it’s simple):

✓ Document your legal basis. “I keep CVs for 2 years so I can recruit quickly” — write this down somewhere.

✓ Limit retention duration. 2 years max for rejections. After, you delete.

✓ Inform candidates. In your privacy policy: “We use AI to analyze CVs.” One sentence. That’s it.

✓ Stay human in decisions. AI suggests. You decide. Always.

✓ Audit regularly. Once per quarter: am I treating candidates fairly? Or does my AI have bias?

✓ Train your team. Recruiters need to know candidates have rights (right to access their data, right to deletion, etc.).

Candidate rights (to respect)

Candidates can ask you to:

See all data you have about them
Correct inaccurate info
Delete their data
Object to you contacting them

You must respond quickly. It’s not a burdensome obligation — it’s normal.

Verdict

Using AI for recruiting is completely legal. You just need three things:

A legitimate reason to keep CVs (and a time limit)
A human who decides (not the machine)
Vigilance about bias

If you do this, you’re fine. And frankly, it’s better for your candidates too: they know how you use their data. Everyone wins.