AI for Recruitment Agencies: Re-Engaging Your Candidate Database

AI can help a recruitment agency re-engage past candidates by finding records that meet a documented contact rule, drafting relevant check-in messages and organising replies. A recruiter must verify the record, approve outreach and honour objections. Check the original notice, lawful basis, retention period and channel rules before uploading data or sending anything.

Do not treat the presence of a CV in your CRM as permission for a campaign. The Information Commissioner's Office (ICO) distinguishes the reason for retaining candidate information from the rules for sending vacancy adverts. Its draft recruitment and selection guidance (the consultation has closed, the final version is still to come, and the ICO has put it under review after the Data (Use and Access) Act) says an agency should not rely on consent to consider someone for multiple or future roles, because that consent would not be specific, granular and informed; agencies are most likely to rely on legitimate interests instead. The answer for your records still depends on the original purpose and what candidates were told. Ask a qualified data-protection adviser to review your own basis and contact channels.

Follow me on Instagram@sagnikteaches

Separate a useful candidate pool from a forgotten archive

The practical starting point is a record audit, not a writing prompt. Your CRM may combine people who registered for future opportunities, applicants for one vacancy, candidates supplied by a client, former temporary workers and contacts imported during a system change. Those records cannot safely receive the same message. Export only the fields needed for review: candidate ID, source, original collection date, stated purpose, privacy-notice version, contact channel, contact preference, last meaningful interaction, last verification date, relevant role family, suppression status and retention review date.

Connect on LinkedInSagnik Bhattacharya

Give each record one of four operational states. Eligible for review means the documented purpose and contact rule appear to fit, though a recruiter still has to approve the contact. Needs clarification covers missing notice history or ambiguous permissions. Suppressed covers objections, opt-outs and channel blocks. Retention review covers records whose purpose may have expired. These are workflow labels, not legal conclusions. A person with access to the original notice and advice on applicable law decides the result.

Subscribe on YouTube@sagnikteaches

For example, an illustrative record says “applied for warehouse supervisor vacancy”, has no note about future roles and shows no conversation for four years. AI may put it in the clarification queue because the evidence is incomplete. It must not invent a consent date or send “we thought you might be interested” merely because the email address still works. In contrast, an illustrative candidate who asked last month to hear about comparable shift-management jobs may be ready for a human review of a specific opening.

Write the rule in plain language before you automate it. A possible internal rule is: “No outreach unless the contact purpose is documented, the record is within our approved retention period, the person has not objected, the chosen channel is permitted, and a recruiter has confirmed that the role is relevant.” Your adviser should adapt that wording to the law and notices governing your records. The ICO's draft recruitment and selection guidance is particularly useful because it discusses candidate reuse, objections and the responsibilities of agencies.

Give AI a narrow job in the first database pass

Use AI to highlight data-quality questions that a deterministic CRM filter cannot explain conveniently. Examples include conflicting role labels, two records apparently belonging to the same person, a missing contact preference, a salary note that appears older than the CV, or a free-text note that suggests the candidate asked not to be contacted. Do not ask the model to produce a single “best candidates” score. This is a re-engagement exercise, not a selection decision. If you later want AI to screen applicants, the safeguards belong in a separate AI screening workflow.

Start with a small, reviewed export and remove fields that do not help the task. An identification code can be enough during the audit. Keep names, direct contact details, health information, family circumstances and other sensitive notes outside the drafting context unless there is a justified need and an approved processing arrangement. Before connecting a third-party AI service to a CRM, check the data-processing agreement, where records are stored, who can access them, how long prompts and outputs remain, whether data is used to train models, deletion options and the route for handling access or erasure requests.

An illustrative duplicate illustrates why review matters. Record 1048 has “senior bookkeeper, available”, while record 2071 has the same email address and a later note, “accepted permanent role; contact only about part-time work”. A model might merge them and carry forward the older availability. A recruiter should check the source and date of each field, preserve the later restriction, and record the merge. For a more detailed field-cleaning process, the candidate-records tutorial addresses duplicates and follow-up inside the recruitment CRM.

Use an instruction that makes uncertainty visible rather than asking for a verdict. For example:

Review these candidate records for re-engagement preparation.
Use only the supplied fields. Do not infer consent, availability,
protected characteristics or job suitability. For each record,
return: ID, missing evidence, conflicting fields, possible duplicate ID,
and the question a recruiter must answer. If evidence is absent,
write "unknown". Do not draft or send a message.

Illustrative output for record 1048 might say: “Contact preference: unknown. Possible duplicate: 2071. Availability conflict: older record says available; newer record says part-time only. Human question: Which record is current?” That is useful because it tells staff what to inspect. A response that says “safe to contact” without citing the recorded basis should be rejected. Keep the original records, the model's suggestion and the human correction together so the same error does not recur.

Build a contact rule around purpose, channel and objection

Privacy rules differ by jurisdiction and by whether you are sending a service update, a vacancy advert or broader marketing. Under the UK GDPR, you need a lawful basis for processing candidate information and must be clear about the purpose. The ICO notes that sending vacancy adverts directly to candidates can be direct marketing, and that an objection to that use must be honoured, including profiling to select who receives the advert. It draws a practical line for social media too: a vacancy posted to everyone who follows your page is not direct marketing, but a private message about the role to a chosen person is. A channel may also have separate electronic-marketing rules. Agencies subject to state privacy rules should check the applicable notice, opt-out and retention duties; there is no single rule that safely covers every database.

This is where “we have consent” can be misleading. A tick box collected for one thing may not support a different purpose, while consent is not necessarily the correct lawful basis for ordinary recruitment processing. The same guidance points out that submitting an application is not, by itself, express consent, and that the imbalance of power between candidate and recruiter makes consent unlikely to be appropriate at most stages of recruitment. Do not change a database field from “consent unknown” to “legitimate interests yes” by automation. Document the assessment, provide the required information and check the expectations created when the data was first collected.

Maintain a suppression list separate from the active contact pool. If someone objects to vacancy marketing, record the minimum identifier needed to prevent another campaign from reaching them. Deleting their active profile without retaining an appropriate suppression marker can cause an imported copy to be messaged later. The ICO's agency example uses precisely this distinction. If someone requests erasure of other records, route that request through your established rights process; suppression and retention may have different grounds. AI can label a reply “possible objection”, but a person should confirm the meaning and apply it promptly.

A practical counterexample is an illustrative reply: “I'm settled where I am; please only contact me about contract work after the summer.” This is not the same as “never contact me again”. Record the channel, timing and role restriction exactly, and ask for clarification where needed. Do not let a model translate it into a broad yes or no. Another reply, “Remove me from your list”, should go to the objection or opt-out workflow immediately. The agency should not wait for a recruiter to return from leave before stopping a scheduled follow-up.

Draft messages that give the candidate a reason to reply

Once a human has marked a small segment as contactable, AI can prepare concise drafts. Give it only verified facts: the broad role category, confirmed skill or credential, the last conversation topic, and the reason for a fresh check-in. Ask for a neutral subject line and two versions: one for a specific vacancy and one to update preferences when you have no suitable vacancy. Keep the message honest about how you know the person, and give a simple route to change preferences or stop relevant messages. A recruiter must check both the candidate facts and the actual vacancy details before sending.

Consider an illustrative candidate who previously discussed part-time payroll work and whose preferences were confirmed recently. An unhelpful AI draft might open, “We have the perfect full-time leadership opportunity for you.” It contradicts the recorded preference and makes an unsupported promise. A corrected version would read: “Hello [first name], when we last spoke you were interested in part-time payroll assignments. Are you still open to that type of work? If so, I can share the hours and scope of a current assignment. If your preferences have changed, a short reply is enough for me to update them.” This asks for confirmation before treating stale data as current.

For a dormant but appropriately contactable person, a check-in is often safer than pretending a record is fresh. An illustrative draft could say: “Hello [first name], you asked us to keep you in mind for technical support roles. We are reviewing who would like to hear about new opportunities. Are that role type and your preferred contact method still right? You can tell us to stop vacancy messages at any time.” The recruiter should compare the phrase “you asked us” with the actual record. If the record does not support it, rewrite the opening to state only what is known or do not send.

Prompt the model with a clear constraint: “Write a message under 110 words. Do not infer availability, salary expectations or permission. Use only the verified fields supplied. Include one question about current preferences and a plain route to stop vacancy messages. Mark any missing fact in square brackets for human review.” The square brackets matter: a draft that says “[last contact date missing]” is safer than a fluent but false recollection. You can adapt the outreach techniques in recruiter prompts for intake and outreach, but keep the data basis and human approval specific to this database campaign.

A 240-record pilot with a visible review trail

Here is an illustrative worked example, not a claim about a real agency. A six-person recruitment agency has 240 records tagged “operations candidates” and wants to reopen conversations before trying a wider database. The team spends two hours checking its notices and retention schedule with its adviser, then exports the fields needed for a controlled review. The manager sets a pilot rule: only records with a documented future-role purpose, no objection, a current contact channel and a recruiter-confirmed role fit may proceed.

The first pass assigns 110 records to manual clarification because the source or notice is missing, 40 to retention review because the dates are outside the approved window, and 15 to suppression because an objection or opt-out is recorded. That leaves 75 records for individual review, not 75 automatic sends. Two recruiters inspect them and find 12 with stale availability, 8 with a role mismatch and 5 duplicate or conflicting profiles. They approve 50 tailored messages. These figures are illustrative arithmetic: 110 + 40 + 15 + 75 = 240, and 75 - 12 - 8 - 5 = 50.

The agency sends those 50 after the privacy and channel checks. Suppose 16 people reply: 7 want to discuss work, 5 update preferences, 3 ask for no more vacancy messages and 1 says the address belongs to someone else. The team logs all 16 outcomes against candidate IDs, suppresses the three objections, quarantines the wrong-address record and has a recruiter confirm the seven expressions of interest. “Seven interested” is a conversation metric, not seven suitable candidates. The pilot's first success measure is whether the data and outreach process worked without incorrect contact, not how many placements it created.

Count the staff time honestly. The illustrative agency spends two hours on rule review, three hours cleaning and classifying the export, four hours verifying the 75 records, two hours approving drafts and one hour handling the first reply batch. That is 12 staff hours before follow-up calls. A model may shorten the drafting stage, but it does not remove the legal check, record review or reply handling. If a campaign creates more correction work than useful conversations, narrow the segment or fix the CRM before scaling.

Handle replies as record updates, not a marketing score

AI can sort replies into provisional queues: interest, preference update, no-contact request, bounced address, ambiguous response and human conversation needed. This can help a recruiter clear an inbox. The classification should carry the actual text snippet and a confidence or uncertainty note, and a person should review anything that changes contact permissions. Never allow a model's interpretation of a friendly “thanks” to set an affirmative preference or consent field. Conversely, an explicit objection must not be buried in a low-priority queue.

An illustrative case: a candidate writes, “Please don't send me permanent positions, but I can consider three-day contracts.” The correct CRM update is a restriction on permanent-role alerts plus a note to verify their contract preferences. “Unsubscribed from everything” would lose an opportunity; “interested in all contracts” would overstate permission. The recruiter can reply: “Thanks, [first name]. I have updated your record to stop permanent-role messages. Would you like us to contact you about three-day contract assignments, and by which channel?” That asks the candidate to define the boundary.

Another illustrative mistake is a bounced message followed by AI finding a new personal email on a public profile. Do not treat public availability as authorisation to switch channels. Quarantine the failed address and use a documented, permissible route if you need to reconnect. The ICO cautions against uses of candidate information people would not reasonably expect, and its draft guidance says recruiters should not search candidates' personal social media profiles, even public ones. The same principle applies when a recruiter tries to enrich a CV with social posts, inferred personal traits or an AI-generated “likely to move” score. Those shortcuts create a new data use, not a simple follow-up.

If candidates respond with updated CVs, keep those documents in the normal recruitment system and verify permissions for any new AI processing. You may use AI to summarise an updated CV for a recruiter's review, but the candidate's own corrections must take priority over an older model summary. The staffing follow-up tutorial covers the ongoing conversation after someone has actively re-engaged; this campaign's main risk lies earlier, in deciding whom you may contact and what you may accurately say.

Keep re-engagement away from automatic rejection

A campaign filter asks, “Should this person receive this relevant message under our documented contact rule?” It should not answer, “Is this person good enough for a client?” AI-generated scores can be especially misleading on old records because skills, availability and preferences change. A person excluded by a stale label may never get a chance to update it. Treat a missing skill in a CV as “not recorded”, not “does not have it”. Review the actual role requirements and speak to the candidate before making a selection judgement.

The ICO's recruitment automation update stresses meaningful human involvement where automated decisions affect candidates. This is more than clicking approve on a ranked list. Reviewers need the authority and information to disagree, and the process should apply consistently. Re-engagement can avoid much of this complexity by using AI for administrative preparation and message drafting, while leaving suitability, shortlisting and rejection to trained recruiters. If you later add screening, assess that use separately with your adviser.

For example, an illustrative model may rank a candidate lower because their CV lists an older software version. The recruiter knows that the current role asks for transferable process knowledge and that the candidate completed a newer course after the CV was written. A silent auto-reject would have failed before the candidate could correct the record. A better use of AI is to ask, “Which skill claims are dated or missing evidence?” and let the recruiter decide whether a conversation is worthwhile. See the recruitment business development tutorial for agency growth work that does not require ranking people.

Measure contact quality before enlarging the segment

Keep a compact campaign log: candidate ID, source and notice version, contact-rule decision, reviewer and date, message version, send channel, reply category, correction, suppression action and next review date. Restrict access to staff who need it. You should be able to reconstruct why a person received a message without asking an AI system to remember. The log also makes it possible to show when a model suggestion was overruled and whether a recurring data defect needs a CRM fix.

Review a sample of approved and rejected records each week during the pilot. Check whether an objection slipped through, whether the opening accurately reflects the last contact, whether message variants differ only for relevant reasons, and whether a candidate can easily correct the record. Track wrong-person messages, complaints, opt-outs, preference updates, substantive replies and recruiter time. A high open rate is weak evidence if the campaign annoys people or relies on stale data. Compare like-for-like segments before assuming AI caused any change.

Set a stop condition in advance. For an illustrative 50-message pilot, a single wrong-person message should pause the list-matching process until the cause is found; an objection sent a second message should pause scheduling and suppression synchronisation. These are suggested internal safety thresholds, not legal thresholds. A low reply count alone may call for a clearer role brief, better timing or a more relevant segment. It does not justify collecting more personal data without a purpose.

The sustainable pattern is modest: document the right to hold and contact each group, let AI surface questions and prepare truthful drafts, have recruiters approve each contact, then record what the candidate actually says. Review the process with a qualified adviser whenever old data, new channels or automated selection are involved. The database becomes more useful as its evidence and preferences improve, not as the model grows more confident.

Candidate database questions before you send

Does a past application give us permission to contact someone about any later job?

No. Check what you told the person when you collected their details, the purpose and lawful basis recorded for keeping them, how long you said you would keep them, and the channel rules that apply. A past application is not a perpetual invitation to send vacancy alerts. Ask your data-protection adviser to review ambiguous legacy records before outreach.

Can AI decide which dormant candidates should never be contacted again?

AI can help flag missing fields, stale dates and apparent duplicates for a recruiter to inspect. It should not silently delete, suppress or reject people based on a guessed suitability score. Apply documented retention and suppression rules, retain an audit trail, and give a person authority to correct the record.

Should we paste an entire CV into a general chatbot to personalise a message?

Use the minimum data needed. A role category, confirmed skills, contact preference and last verified date may be enough to draft a useful message. Before any personal data goes to an AI service, check its contract, access controls, retention, training settings and permitted use. Keep sensitive or irrelevant CV details out of the prompt.

Further reads

• AI CV Screening for Recruitment Agencies: Setup and Safeguards — Separate outreach from the higher-risk job of screening applications.
• How Recruiters Use AI to Write Candidate Summaries Clients Read — Turn verified candidate notes into useful client summaries.
• AI Note Taker for Recruiters: Candidate Consent and Tool Choice — Set ground rules before recording candidate conversations.
• AI in Recruitment and Hiring: A Bias Test Checklist for Small Agencies — Check whether an AI-assisted selection step treats people fairly.
• AI Sourcing Tools for Recruiters: Seat Costs and Consent Rules Compared — Five sourcing tools priced for three recruiters, with data sources, consent handling and a one-live-search trial you can run in a week.
• AI Talent Recruiting Software: Manatal, Loxo or Bullhorn Amplify? — Manatal from $15 a user, Loxo from $149, Bullhorn from $99 on its small-agency plans: what each costs a five-person agency and what the AI does.
• AI Agents for Recruitment Agencies: Sourcing, Screening and Review Points — What an AI agent can take off a recruiter's desk, the four points where a person must check its work, and what agent credits cost per role.
• AI Boolean Search Generator for Recruiters: Prompts and Checks — How to brief an AI for a Boolean search string, what a hiring manager should review, and how to test the string on three sites and log false positives.
• ICO AI Recruitment Report: A Checklist for UK Recruitment Agencies — An agency-facing checklist that turns the ICO recruitment findings into evidence, owners and review points.
• AI Tools and AI Development: The Complete 2026 Guide — the AI hub, including every tutorial in the AI-for-business series.

Sources: Information Commissioner's Office, Employment practices and data protection: recruitment and selection (draft guidance, consultation closed); Information Commissioner's Office, Recruitment rewired: an update on the ICO's work on the fair and responsible use of automation in recruitment. Checked November 2026.