Where AI in recruitment is safe to use, where screening tools create legal risk, and what Australian employers must formally disclose from 10 December 2026.
AI in recruitment works best on the admin around hiring: drafting job ads, scheduling interviews, writing up notes, keeping candidates informed and cleaning the ATS. It gets risky the moment software starts ranking or rejecting people, because from 10 December 2026 Australian businesses covered by the Privacy Act must disclose that kind of automated decision-making in their privacy policy, and discrimination law already applies to every shortlist.
TL;DR: Automate the admin freely, but keep a named person making and owning the shortlist decision, and write down how they reached it. The OAIC treats candidate-sorting software as generally in scope of the new APP 1.7 to 1.9 rule, even with routine human review. Update your privacy policy before 10 December and test any screening tool for bias before it touches a live role.
Where AI in recruitment pays off
Most of a recruiter’s week goes on writing, chasing and updating rather than judging people. That is where we would put AI first, because the legal exposure is close to zero.
Start with the job ad. ChatGPT, Claude or Copilot will turn a hiring manager’s rough notes into a job description in minutes; the value is in a second pass that strips out requirements not inherent to the role. Phrases like “digital native” and “recent graduate” are how an ad drifts onto the wrong side of the Age Discrimination Act.
AI search across LinkedIn, job boards and your own database surfaces people you knew about and forgot; treat it as a lead list and leave the filtering to a person. Booking links, reminders, status updates and rejection emails are pure admin.
Zoom AI Companion’s meeting summary and Google Meet’s “Take notes for me” let the interviewer listen instead of type. Tell candidates the interview is being recorded and get their agreement first.
ATS hygiene is where the line blurs. IT Brief reported in December 2025 that JobAdder’s Adder Intelligence release includes Smart Sync, which recommends updates to messy candidate records. Its Smart Summary goes further and recommends how strong a candidate’s match is. That is exactly where admin ends and decision begins.
The 10 December rule, applied to a shortlist
From 10 December 2026, APP 1.7 to 1.9 require a covered organisation that has arranged for a computer program to make, or substantially and directly help make, decisions that could significantly affect someone’s rights or interests to say so in its privacy policy, listing the kinds of personal information and decisions involved. The OAIC released a fact sheet, flowchart and updated APP 1 guidelines on 30 September 2026; our AI regulation guide covers the wider picture.
Recruitment is not a grey area. The OAIC’s APP 1.7-1.9 fact sheet lists “recruitment software used to sort through candidate profiles and make hiring decisions” among decisions generally in scope. Its worked example is a graduate engineering hire: a job board that shows the ad mostly to young men, then an AI video-interview tool that scores applicants on voice, facial geometry, eye movement and body language and ranks a shortlist for HR. The OAIC says both are in scope.
The fact sheet closes the obvious escape routes. Procuring third-party software, configuring an off-the-shelf product and relying on advisory outputs are all listed as ways you may have “arranged for” a program, and its first example is a plain spreadsheet formula that ranks people. Human review does not settle it either. A decision can be in scope even where the output “is subject to human review”, and machine learning or generative AI outputs used in significant decisions “would generally fall within scope” unless “subject to extensive human oversight and control.”
The pay-review example shows what that means. Where managers interrogate the outputs, check the underlying evidence and document why they departed from the recommendation, the OAIC says this “could indicate” the AI was not substantially related to the decision. We would build a hiring workflow to that standard, knowing it is a judgement call rather than a safe harbour. Where you are unsure, the OAIC’s advice is to be cautious and disclose.
Who the Privacy Act covers in hiring
Start with the employee records exemption. The OAIC’s guidance on the exemption says it “will not apply to the collection of personal information about prospective employees who are subsequently not employed by an organisation, such as unsuccessful job applicants.” It is also unlikely to apply to recruitment firms working under contract to an employer, so agencies should assume it does not help them.
Then the small business exemption. It still stands for most businesses with annual turnover of A$3 million or less, but the OAIC’s small business guidance lists exceptions. Three matter for recruiters: turnover above A$3 million in any financial year since 2002, being related to a larger covered company, or trading in personal information (including disclosing it for a benefit) without consent. An agency paid to put candidate profiles in front of clients should check that last test, and its client agreements, which can require Privacy Act compliance anyway.
Biased screening is a discrimination problem first
Privacy is the new obligation. Discrimination is the old one, and in our view the bigger exposure, because it attaches to the outcome rather than the paperwork.
Section 14(1) of the Sex Discrimination Act 1984 makes it unlawful for an employer to discriminate “in the arrangements made for the purpose of determining who should be offered employment.” Section 18 of the Age Discrimination Act 2004 uses the same words, and section 24 covers employment agencies. We would treat a screening tool as one of those arrangements. It does not need to see gender or birth year to discriminate, because indirect discrimination covers a “condition, requirement or practice” that is not reasonable in the circumstances and disadvantages a group, which is how a model trained on a skewed hiring history behaves. The Fair Work Ombudsman adds that an employer cannot take adverse action, including not hiring someone, against a prospective employee because of attributes such as age, sex or disability.
The best-known warning is still Amazon’s. Reuters reported in 2018 that an experimental Amazon resume-rating engine, trained on ten years of mostly male applications, penalised resumes containing the word “women’s”. Recruiters never relied on its rankings alone, the report said, and Amazon still disbanded the team. A scoring feature switched on in an afternoon deserves at least that much suspicion.
What to automate and what to keep
| Task | AI fit | Risk level | What to do |
|---|---|---|---|
| Job description and ad drafting | Strong | Low | Use freely; remove age-coded or non-essential requirements |
| Sourcing and talent search | Strong | Low to medium | Treat results as leads; widen searches that return a narrow pool |
| Interview scheduling and reminders | Strong | Low | Automate fully |
| Status updates and rejection emails | Strong | Low | Automate the sending; a person decides who is rejected |
| Interview transcription and notes | Strong | Medium | Get consent to record; interviewer checks the summary |
| ATS clean-up and deduplication | Strong | Low | Automate, with spot checks |
| Resume screening and ranking | Moderate | High | Disclose in your privacy policy; test for bias; a named person reviews every low-ranked or rejected candidate |
| Video interview scoring | Weak | High | Avoid scoring voice, face or body language; if used, disclose and keep the decision human |
| Final shortlist and offer | Poor | High | Human decision, with written reasons |
How we would set it up
I have spent more than 15 years leading technology and digital transformation programs for organisations including NSW Government, UNSW Sydney and Telstra, and the controls that hold up are the ones built into the daily workflow, not a policy nobody opens.
Map every place software touches a candidate, including features that arrived uninvited in an ATS update, and mark which ones influence who progresses. For those, update your privacy policy to name the information used (resume content, assessment answers, interview recordings) and the decisions supported (shortlisting, interview selection). Ask each vendor in writing how its feature scores candidates (the OAIC says providers should supply that information), and our AI vendor checklist has the questions. Then have the recruiter record in the ATS why each shortlisted and rejected candidate landed where they did.
That last step is the one we see skipped, and it is what turns “a human looked at it” into evidence. Our AI policy template already includes a clause that AI may prepare a hiring shortlist but does not make the decision. If you are connecting AI agents to your ATS or inbox, work through our AI agent security checklist first.
If you want this mapped against your own hiring process, our AI Quick-Win Audit is a flat $2,950, ten-business-day engagement. It maps one or two high-friction workflows, ranks the opportunities with estimated time and dollar impact, and includes a live working demonstration of one of them in your own tools.
This article is general information, not legal advice.
Getting AI in recruitment right before 10 December
AI in recruitment earns its keep on work candidates never see. The National AI Centre’s Guidance for AI Adoption makes “maintain human control” one of its six essential practices, and hiring is where that principle has the clearest legal backing. Put a person on the shortlist, make them write down their reasons, and update the privacy policy before 10 December.
To build the automated parts, see our process automation service, or book a free 30-minute fit call for the AI Quick-Win Audit. The audit fee is credited in full toward any project of $10,000 or more commissioned within three months. You can also contact us directly.
Frequently Asked Questions
Does the 10 December 2026 privacy rule apply to AI resume screening?
Very likely, if your business is covered by the Privacy Act. The OAIC lists recruitment software that sorts candidate profiles and makes hiring decisions as generally in scope of APP 1.7 to 1.9, so your privacy policy will need to describe the information it uses and the decisions it supports.
If a recruiter reviews the AI shortlist, do we still need to disclose it?
Probably. The OAIC says human review alone does not take a decision out of scope; AI outputs used in significant decisions generally fall within it unless subject to extensive human oversight and control. If in doubt, it recommends disclosing.
Are job applicants covered by the employee records exemption?
Not unsuccessful ones. The OAIC says the exemption does not cover future employment relationships, so it does not apply to information about applicants you never hire; only once someone is employed do their pre-employment records become exempt. It is also unlikely to apply to recruitment agencies acting for an employer.
Is my small recruitment agency exempt from the Privacy Act?
Not necessarily. The A$3 million turnover exemption still exists, but it falls away if you have exceeded that turnover in any year since 2002, are related to a covered company, or disclose personal information for a benefit without consent. Client contracts can also require compliance regardless.
Can an AI screening tool break anti-discrimination law?
Yes. The Sex Discrimination Act and Age Discrimination Act make it unlawful to discriminate in the arrangements for deciding who is offered a job, and the Fair Work Act protects prospective employees from adverse action, such as not being hired, because of attributes like age, sex or disability. A tool that unreasonably disadvantages a group can create that liability even if it never sees a protected attribute.