AI Staffing Best Practices: A Checklist for Placements and Candidate Data

Keep a named consultant making every decision that affects a candidate, tell candidates when AI is involved, collect and keep only the data each step needs, log what the AI suggested and what the person decided, and never let a tool auto-reject. These five habits are the core of safe AI use in placements and cost almost nothing to start.

Most agencies' trouble starts with defaults rather than decisions: an applicant-tracking score that quietly becomes the shortlist, a notes tool that keeps recordings for ever, a chatbot that rejects after three answers. The checklist below follows a placement from first contact to deletion, with the human step, the notice, the retention rule and the log entry for each stage.

Follow me on Instagram@sagnikteaches

Start with an inventory of every place AI touches a candidate

Before changing any process, list every feature that reads, scores, summarises or messages a candidate, including the ones nobody switched on deliberately. Many applicant-tracking systems, job boards and meeting tools now carry some. Ask each consultant which AI accounts they use personally, too, with no blame attached, because a free account holding candidate CVs is the item most likely to be missing from the list. A filled-in extract looks like this.

Connect on LinkedInSagnik Bhattacharya

Two actions on inventory day pay for themselves. Switch off any feature you cannot explain, such as a score that gives no reason. And switch on logging wherever the tool offers it, because you cannot add a record of last month's decisions afterwards.

Subscribe on YouTube@sagnikteaches

Seven gates, and who decides at each one

A placement passes through points where something happens to the candidate. At each, one named person decides, the AI helps within limits, and a log line records what happened. The limits are the part agencies tend to leave unwritten.

The person has to be able to disagree with the tool, which means they can see why it said what it said and have the authority to overrule it. The GDPR's recital on automated decisions names "e-recruiting practices without any human intervention" as an example of the decisions it worries about, and lists the safeguards it expects: specific information to the person, human intervention, a chance to give their view and a way to challenge the outcome. The EU's AI rules ask deployers of high-risk systems for something similar: oversight by people with the competence, training and authority to do it. The gate table is a plain-language version of both.

Never auto-reject: what a safe screening step looks like

A six-consultant agency receives 120 applications in a week for eight warehouse and admin roles. The applicant-tracking system scores each out of 100. The old routine: consultants phone anyone scoring 70 or more (30 people), and the other 90 receive an automatic "unsuccessful" email. The new routine: the score only sorts the queue. Consultants read the top 30 as before, plus 15 records picked at random from the other 90, each read against the job spec.

In the first week, 3 of the 15 would have been shortlisted. Three in fifteen is 20%, which applied to 90 people suggests about 18 good candidates were being rejected unread. Fifteen is a small sample, so treat that as an order of magnitude: a standard 95% interval for 3 in 15 runs from about 7% to 45%, or roughly 6 to 41 of the 90. Either end is too many to throw away. When the consultants asked why those three scored low, the causes were mundane: a scanned PDF the parser read as blank, a licence listed under an abbreviation the job spec did not use, and a career gap that the scoring treated as a negative.

• Keep the random sample weekly. Fifteen records take a consultant about 20 minutes, and it is the cheapest bias and error check there is.
• Set a trigger. My starting threshold: if more than 1 in 10 of the sample would have been shortlisted, change the cut-off or the criteria before the next batch.
• Use reason codes. Rejection reasons chosen by the reviewer, for example S1 specific requirement not met, S2 unavailable, S3 duplicate, S4 withdrew, S5 other with a note, make later review possible and discourage "score too low" as a reason.
• Let AI draft, not send. A rejection message can be drafted by AI but is sent after a person has made the decision.

For the set-up detail of CV screening, see setup and safeguards for CV screening, and for a monthly test of fairness across groups, a bias test checklist for small agencies. Interviews run by AI have their own rules, covered in screening calls, bias rules and cost.

Gate five in practice: the summary that promoted a candidate

Client-ready summaries are where a helpful tool quietly adds things. The consultant's job at gate five is to trace every claim back to the CV or the interview notes. This before-and-after is typical, and the changes are illustrative.

Each slip is small, each sounds better than the truth, and each is the kind a client finds out about on the first shift. Give consultants a trace rule: every number, qualification, employer name and word of seniority in a summary must be found in the CV or notes before the summary leaves. Time it. On a 200-word summary the check takes about three minutes, and a candidate who has been oversold is far more expensive than that. The same rule belongs in the log, as the initials of whoever traced the claims. For a fuller treatment of writing summaries clients read, see candidate summaries for recruiters.

Telling candidates: notice wording that fits on a form

Put the notice where candidates actually look: the application form, the privacy notice, the first message of any chat or text, and the interview invitation. The GDPR's information duties ask for the existence of automated decision-making, meaningful information about the logic involved, the significance and likely consequences for the person, and either the period data will be kept or the criteria used to set it. If a chatbot or voice agent talks to candidates in the EU, the AI Act's transparency rules, which apply from 2 August 2026, require such systems to be built so that people are told they are dealing with an AI system, unless that is obvious. A paragraph that covers those points in plain words:

How we use AI
We use software that includes AI to help sort applications, write up interview notes and draft messages. A consultant reads your application and makes every decision about whether to put you forward. No application is rejected by software alone.
You can ask for a person to look at your application again, ask what information we hold about you, or ask us to delete it. We keep applications for [period] unless you ask us to keep you on file for longer. Contact [your name] at [contact route].

Some places add specific duties. A city law on automated employment decision tools, for example, covers employment agencies as well as employers, requires a bias audit within a year of using the tool, and requires notice to candidates 10 business days before use; an explainer for small staffing agencies walks through it. Check the rules wherever you recruit, and treat the paragraph above as the minimum rather than the whole of your duty.

A retention schedule you can apply by rule

The GDPR does not tell you how long to keep a CV. It tells you to decide, to say so and to keep to it. Some hiring-record rules set minimum periods, other regimes push for shorter ones, so agree the numbers with an adviser for the places you recruit in. The periods below are illustrative; the shape is what matters.

Two traps catch agencies. Deleting a record in the main system does not delete it from the transcription tool, the messaging tool or an export a consultant made last year, so ask each vendor what deletion covers, backups included. And scores and summaries about a candidate are information about that candidate, so assume a request to see them can arrive and keep them findable.

The audit log: what to record for each AI-assisted decision

A log is worth having only if it is quick to write. One line per decision, filled in by the person who made it, is enough. A filled-in illustration for the screening gate:

Use IDs, not names, in the log, record the tool version where the system shows one, and keep a separate column for overrides, because the override rate is your best measure of how far to trust the tool. If you ever deploy a system that falls under the EU's high-risk rules, deployers are expected to keep the logs the system generates for at least six months, where those logs are under their control, so a habit of logging now is useful preparation. Each month, pick ten log entries at random and trace each back to the candidate record. If the trail breaks, fix the habit before the next batch.

Rules for consultants: what goes into which AI tool

Consultants make most of the day-to-day data decisions, so give them a three-line rule they can remember. Business plans of the main assistants say they do not train on business content by default, which personal plans may not, so approved accounts should be business accounts. At November 2026 list prices, ChatGPT Business and Claude Team both start at two seats and about $20 a user a month on annual billing, which is $40 a month for the smallest team.

• Never in a free or personal AI account: candidate names, CVs, contact details, interview notes, client names with job details, anything sensitive such as health or disability information.
• Only in the agency's approved business accounts: CV text for summaries, interview transcripts, job-order details, shortlist notes.
• Fine anywhere: advert drafts with no client name, interview question lists, policy and template drafts, a rewritten rejection template with no personal details.

Add a no-blame rule for mistakes: anyone who pastes the wrong thing tells the owner the same day, and the owner logs it. Agencies that punish the slip find out about the next one from a candidate.

A monthly 30-minute review that catches drift

Drift is the vendor switching on a new feature, a consultant finding a shortcut, or a cut-off that suited last quarter's job mix and not this quarter's. Put six items on a monthly sheet and fill it in the same week every month.

1. The random sample of 15 below-the-line records, and how many would have been shortlisted.
2. Ten log entries traced back to their candidate records.
3. Requests for a person to look again, how many arrived, and how long each took to answer.
4. New features: anything the vendor switched on or announced, and whether it appears on the inventory.
5. Deletions: how many records the retention job removed, against how many it should have.
6. Near misses: data pasted into the wrong tool, a summary claim that was not in the CV, a message sent without approval.

A month's entry might read: sample 15, shortlisted 2 (13%, above the trigger, so criteria reviewed); log trace 10 of 10 complete; human-review requests 3, answered in 2, 3 and 6 working days; one new transcription summary feature, switched off pending review; 212 records deleted of 212 due; one near miss, a consultant pasted two CVs into a personal account and reported it that afternoon.

Client terms: what the contract should say about AI

Clients have views on AI in hiring, and some have duties of their own, so settle the ground rules in writing before the first placement rather than during a complaint. Five questions to put to each client when you agree terms: do they use AI on the CVs you send; do they allow AI on their job orders and company information; who keeps the record if a candidate challenges a decision; where does a candidate's request for a person to look again go; and do any hiring-tool laws apply to them that you should know about?

Then reflect the answers in your terms. A draft clause, for your adviser to review before you use it:

The Agency may use AI-assisted tools in sourcing, screening and preparing candidate materials. A named consultant makes every decision to put a candidate forward and checks AI-prepared summaries against the candidate's CV before they are sent. The Client will tell the Agency if it requires that AI is not used on its job orders. The Client will not use candidate materials supplied by the Agency to train AI models. Each party will tell the other promptly of any complaint, request for human review or data request relating to a shared candidate.

Clients differ, and that is fine. A client that bans AI on its job orders gets a manual process for those orders and a line on the inventory saying so. A client that asks for your AI policy gets the one-page version of this checklist. Having it ready tends to win the conversation rather than start it.

If you place people with employers in the EU

AI used in recruitment sits on the high-risk list in Annex III of the EU's AI Act. The deadline for stand-alone high-risk systems of that kind has moved: the official EU AI Act implementation timeline, updated after the 2026 Digital Omnibus amendment, now shows those rules applying from 2 December 2027 rather than 2 August 2026. Check the current date on the official text before you plan around it. Duties for the organisation using such a system include assigning oversight to people with the competence, training and authority to do it, keeping the system's logs for at least six months where it controls them, and telling the people affected that the system is in use. Separately, AI that infers emotions in the workplace has been banned since 2 February 2025, with narrow medical and safety exceptions. Treat candidate interviews as covered until an adviser tells you otherwise, which in practice means no mood-scoring of candidates or temps from voice or video.

The gates, notice and log above already match most of that, which is the point of building them now. Dates in this area have moved once and may move again, so ask an adviser which duties apply to your agency and when, and check the date before you plan around it.

When a candidate asks for a person to look again

Write the process before the first request. Log it, give it to a consultant who did not make the original decision, and answer within a stated number of working days. Five working days is my suggestion, not a rule. Reply in the candidate's terms, with no jargon, and say what happens next. A short template:

Hi [first name],

Thank you for asking us to look at your application again. [Consultant name], who was not involved the first time, has read your CV against the role requirements. [Outcome in one sentence, for example: we are putting you forward for the Tuesday interview / we have kept your details on file for similar roles because the shift pattern did not match this one.]

If you would like to see the information we hold about you, or have it deleted, reply to this message and we will deal with it.

[your name]

A request like this is also the best free test of your process. If nobody can say who made the original decision, which tool scored the application or what the reason was, the log and the gates are not doing their job yet, and that is worth finding out from one candidate's request rather than from a complaint.

Questions agencies ask about AI in placements

Can consultants use AI to write rejection emails?

Yes, as drafts. A person decides first, then reads and edits the draft before it goes. Keep the wording neutral, offer a way to ask for a second look, and avoid detailed reasons that the system generated but nobody verified, because an invented reason is an accuracy problem as well as a courtesy one. Log the reason code the consultant chose, not the model's wording.

What if a client wants us to use its own AI screening tool?

Treat it as the client's tool but your responsibility for the candidates you hand over. Ask who decides, what notice candidates receive, where the data is stored and who answers requests for a person to look again. Record the answers in the contract and on your inventory, and keep your own human gate before any candidate is submitted.

Do we need a data protection impact assessment for AI tools?

Often, where the GDPR applies. It calls for one when processing, in particular using new technologies, is likely to result in a high risk to people, and a government guide on AI in recruitment says recruitment AI involves high-risk processing and tells organisations to consider one. Ask your adviser, and use your inventory and gate table as the first draft.

Do these habits matter for an agency with six consultants?

Yes. Data-protection rules apply whatever your size, anti-discrimination law reaches agencies as well as employers, and some AI-specific rules cover small firms too, such as a city law on automated hiring tools that applies to employment agencies. The habits are cheap at six consultants and expensive to retrofit at sixty, so start now.

Further reads

• AI Staffing Tools for Skill Assessment: What to Test and Trust — Test candidates fairly and check the results are valid.
• AI Staffing Tools for Employee Engagement: Keep Temps on Assignment — Check-in cadence that keeps temps on assignment.
• AI Agents for Recruitment Agencies: Sourcing, Screening and Review Points — Where sourcing and screening agents need a human review point.
• How Staffing Agencies Automate Candidate Follow-Up With AI — Automate candidate follow-up without losing the human decision points.
• How to Evaluate the AI Features in Your Recruitment Software — Judge the AI features in the ATS you already have.
• AI for Staffing Companies: Client Onboarding and Job Order Intake — Gate one in detail: capturing job orders cleanly.
• Free AI Tool for Recruitment: What a Small Agency Gets for Nothing — What free AI plans and notetakers cover for a small recruitment agency, where free limits and candidate-data risks bite, and when paying makes sense.
• Resume Formatting AI Tools for Recruiters: Check Nothing Was Altered — Which AI CV formatters reflow and which rewrite, what each costs per CV, and a step-by-step check that nothing in the candidate's CV was altered.
• AI Staffing Tools for Workforce Planning: Forecast Client Demand — Turn two years of placement history into a seasonal demand forecast and a bench target, using a spreadsheet and AI for the clean-up and cross-check.
• AI Tools and AI Development: The Complete 2026 Guide — the AI hub, including every tutorial in the AI-for-business series.

Sources: the text of GDPR Articles 13 and 22 and Recital 71, the EU AI Act (Articles 5, 26 and 50 and Annex III) and the official EU AI Act implementation timeline, a 2024 government guide to responsible AI in recruitment, a city agency's page on its automated employment decision tool law, and the ChatGPT Business and Claude Team pricing pages.