AI in HR Compliance Checklist: Human-in-the-Loop & Vendor Tips

Introduction

You already know: AI in recruiting operates within a tight legal framework. GDPR Art. 22 and the EU AI Act set clear boundaries — you can find all the details in Part 1 of this guide. 

The real question is: how do you use AI in HR anyway — efficiently, legally compliant, and without a nagging feeling of doubt? This article delivers the answer: concrete processes, a checklist, and practical tips for working with AI HR vendors.

The 4 Most Common Mistakes When Deploying AI in HR

Before we get to the solutions, let's look at the mistakes we see most often in practice.

Mistake 1 — The "Click-to-Approve" Trap: 

HR staff only formally confirm AI decisions without actually reviewing their substance. What looks like human oversight isn't. This mistake is by far the most common — and the most dangerous, because it's so easy to miss.

Mistake 2 — Lack of Transparency: 

Candidates receive vague hints like "modern technology" instead of concrete information about which AI HR tool is being used and why. This does not sufficiently fulfill the obligation to inform.

Mistake 3 — Vendor Blindness: 

Companies rely on the vendor's assurances without verifying them independently. The result: there's no DPA in place, data locations are unclear, and bias testing never happened. The liability still falls on you.

Mistake 4 — Lack of Risk Assessment: 

There's no systematic analysis of the discrimination risks posed by the specific AI HR system. A Data Protection Impact Assessment (DPIA) is mandatory for high-risk processing — and yet it's routinely skipped.

Human-in-the-Loop: What Genuine Human Oversight Really Means

The central compliance mechanism for deploying recruiting AI is the human-in-the-loop principle (HitL). But most companies get it wrong.

The 5 Requirements for an Effective Review

1. Subject-Matter Expertise: 

The person reviewing must be able to substantively evaluate the AI HR recommendation. Without recruiting expertise, you can't really judge an AI suggestion.

2. Full Data Access: 

They must see the complete application — not just the AI summary. Anyone who only sees the AI HR tool's ranking isn't reviewing anything.

3. Real Decision-Making Power: 

They can and may deviate from the AI recommendation — without pressure to justify it. If the system is built so that deviations are cumbersome, that's not human-in-the-loop, it's a facade.

4. Sufficient Time: 

Clicking through 200 applications in 20 minutes isn't a review. Human oversight requires capacity — this must be factored into process planning.

5. Understanding of the AI Logic: 

The person reviewing should at least roughly understand the criteria the system uses to score candidates — only then can they recognize where the AI might be wrong.

Keep in mind: A "four-eyes principle," where a second person merely reconfirms the AI's decision, isn't enough. You need a genuine, substantive evaluation of the original application.

Transparency Obligations: What Candidates Need to Know

When AI is used in HR, candidates have extensive information rights. Ignoring these isn't just legally risky — it also signals a poor company culture.

You need to communicate the following: whether and at what stage recruiting AI is used, what it's used for (pre-selection, skill matching, interview analysis), what data is processed, how AI recommendations factor into the decision, that a human review takes place — and what rights candidates have (access, objection, human review).

Where should you communicate this? The most proven combination: a note in the job posting, detailed information in the privacy policy for candidates, and a targeted notice before every AI-supported step in the process. Plain language is a must — legalese won't protect you if candidates couldn't actually understand the information.

Deploying Recruiting AI in a Compliant Way: 5 Steps

Step 1: Clarify the Legal Basis

• Define precisely what you want to use the AI HR tool for
• Check the legal basis (typically Art. 6(1)(b) or (f) GDPR)
• Conduct a DPIA — mandatory for high-risk processing

Step 2: Vendor Due Diligence

• Request evidence of GDPR and AI Act compliance
• Check whether the tool meets high-risk requirements
• Sign a DPA — there's no way around it

Step 3: Establish Human-in-the-Loop

• Document human review processes in writing
• Train your HR team on how to work with the AI HR system
• Allocate time capacity for thorough review

Step 4: Establish Transparency

• Actively inform candidates about the use of recruiting AI
• Update your privacy policy and job postings
• Prepare processes for handling access requests

Step 5: Document and Monitor

• Document all AI HR decisions and human reviews
• Conduct regular risk reviews
• Test the AI for bias and adjust processes when laws change

Want to know whether your AI HR process is already compliant? In a free demo, we'll show you exactly where your company stands — and what's missing.

Vendor Management: Your Responsibility Doesn't End at Signing

A common misconception: once you've signed a DPA, you're done. You're not.

As the employer, you remain the GDPR-responsible controller for candidate data — regardless of who provides the tool. The vendor is the processor. Violations fall primarily on you.

You should therefore continuously request and verify the following from your vendor: current evidence of GDPR compliance, information about the AI logic and bias testing, details on subprocessors and data locations, and clear processes for data subject rights. Vendors that refuse or stall on these points are a risk — no matter how well the tool otherwise performs.

Conclusion

AI in HR and recruiting offers real efficiency gains. Implemented correctly, AI HR tools can even reduce discrimination by minimizing unconscious human bias. But only if the deployment is legally sound.

The good news: the five steps in this guide give you a solid foundation. Genuine human oversight, clear transparency, careful vendor management — these are the building blocks that turn recruiting AI from a risk into an advantage.

Compliance isn't a one-time project. Laws change, AI systems keep evolving. Understanding this as an ongoing process is what keeps you safe in the long run.

Don't want to set this up alone? With heyData, you get structured support — from DPIAs to DPA management to ongoing compliance monitoring.