1. Use of AI in Recruitment and Hiring

AI is transforming the recruitment landscape across the globe, making processes such as resume screening and candidate engagement more efficient by:

• using keyword searches to automatically rank and eliminate candidates from a pool of applicants with minimal human oversight; 
   
• performing recruitment tasks via chatbots that interact with candidates;
   
• formulating skills and aptitude tests; and
   
• analyzing video interviews to assess a candidate’s suitability for a particular position.

In addition to maximizing efficiency, AI may also be used to make automated, substantive decisions related to recruitment, hiring, and performance through the use of predictive analytics that forecast a candidate’s success in a specific role.

2. Regulation of AI Use in the European Union and United States

The European Union has taken a united approach to AI regulation, and all EU member states are currently governed by the EU Regulation on Artificial Intelligence (EU AI Regulation), which took effect on Aug. 1, 2024. The EU AI Regulation’s scope applies to all providers and deployers based in the EU, as well as those that place an AI system on the EU market or use the results of an AI system in the EU. Parties located outside the EU should therefore be aware that the EU AI Regulation may apply to them, as well.

The EU AI Regulation categorizes AI systems into different risk categories, with the applicable rules becoming stricter as the risk to health, safety, and fundamental rights increases (for example, “minimal” regulation for spam filters; “limited” regulation for chatbots; “high” regulation for use in recruitment; and “unacceptable” use of AI for social scoring and facial recognition). HR tools are considered high-risk AI systems if they (1) are used for recruiting or selecting candidates; and/or (2) provide the basis for HR employment-related decisions, e.g., promoting or terminating employment or monitoring and evaluating performance and behavior.

As of Feb. 2, 2025, the EU AI Regulation requires companies to eliminate “unacceptable” AI systems (as defined by the law) and to thoroughly and comprehensively train all employees using AI systems with respect to compliant AI use under the regulation. 

In contrast to the EU, the United States does not currently have uniform AI regulations on a federal level. Though the Biden administration had tasked government agencies such as the Department of Labor and the Equal Employment Opportunity Commission with monitoring the use of AI tools and issuing guidance to enhance compliance with anti-discrimination and privacy laws, in January 2025, President Trump expressed his support for deregulation, issuing an executive order entitled “Removing Barriers to American Leadership in Artificial Intelligence Issues.” Federal agencies have since removed all previously issued guidance on AI use.

In response to the executive order advocating for AI deregulation, regulations governing the use of AI have been introduced and passed on the state level. However, legislation passed does not always become legally binding. For example, in February 2025, the Virginia legislature passed the High-Risk Artificial Intelligence Developer and Deployer Act, which would have required companies creating or using “high-risk” AI systems in employment as well as other areas to implement safeguards against “algorithmic discrimination” for such systems. However, the governor vetoed the Act on March 24, 2025, and so the Act does not currently apply.

3. AI Use May Trigger Other Legal Violations

Aside from complying with laws such as the EU AI Regulation, which specifically regulates the use of AI, companies using AI in their recruiting and hiring processes should be careful such use does not trigger a violation of other laws. For example:

• Bias and Discrimination: Algorithms used by AI in recruitment and hiring may inadvertently perpetuate bias, leading to discrimination against candidates based on race, gender, age, or other protected characteristics. Discrimination is prohibited in the EU under Council Directive 2000/78/EC, which bans discrimination in employment, education, and public safety, as well in the United States via more than one hundred federal, state, and local anti-discrimination laws.
   
• Data Security and Ownership: Companies that enter the personal data of potential candidates into an AI system have certain legal obligations with respect to maintaining the security of such data, as well as considerations with respect to the ownership of such data. Such obligations are governed by the EU General Data Protection Regulation (GDPR), which took effect on May 25, 2018. In the United States, more than 20 jurisdictions have passed laws imposing obligations on employers that use AI to collect and process candidate and employee data.
   
• Invasion of Privacy: Employers that collect candidate and/or employee data via AI tools may inadvertently be invading the privacy of such candidates and employees, and should be mindful of applicable privacy laws, which may require the company to obtain consent from the candidate or employee prior to running certain searches.

4. Penalties for Non-Compliance

An EU employer that violates the above discrimination, data security, and privacy laws risks significant (yet lower than U.S.) damage awards, as well as high administrative penalties from agencies such as the European AI Office and national data protection authorities.

Damages claims for individual breaches can vary significantly between jurisdictions, and EU member states retain national autonomy in determining award sums. However, European Court of Justice (ECJ) landmark judgments emphasize the importance of issuing awards that correspond to the nature and extent of the EU-protected rights violated.

Certain European nations, such as Estonia, Hungary, Ireland, Sweden, Austria, and Finland, have established statutory or customary upper limits on awardable damages to employees in the event a company fails to comply with applicable anti-discrimination regulations, with such damages ranging from the payment of EUR 500 to 104 weeks’ pay. In contrast, in Poland, Germany, and the Netherlands, damages are not formally limited, although in practice the awards are relatively low compared to the United States. The national laws of some European countries, such as UK, provide for punitive damages, which would further increase the sum of damages awarded.

In addition to the above, administrative fines for data security and privacy law violations under GDPR may reach up to the higher of EUR 20,000,000, or 4% of a company’s annual worldwide turnover for the preceding financial year.

Under the EU AI Regulation, both an EU employer and a non-EU employer using the results of an AI system in the EU can be fined up to the higher of EUR 35,000,000 or 7% of a company’s annual worldwide turnover for the preceding financial year. In the United States, penalties range depending on the jurisdiction. In New York City, for example, an employer may incur a fine of up to $500 for a first violation, and between $500 and $1,500 per day for each subsequent or continuing violation.

5. Considerations for Employers

To minimize exposure, employers should consider taking the following steps:

• For the EU (including non-EU companies subject to EU laws as provided above):

• For the United States:

Thilo Ullrich and Dorothee von Einem also contributed to this article.