69% of HR teams now use AI in recruiting. Most have no audit trail. Here’s why that’s about to matter.
SHRM’s 2025 Talent Trends survey — 2,040 HR professionals surveyed — found that 69% now use AI to support recruiting, up from 51% the year before. At the same time, Pew Research found that 66% of Americans would not want to apply for a job where AI helps make hiring decisions. That Pew finding is from 2023. By 2026, AI adoption has only accelerated — candidate trust hasn’t.
The gap isn’t a perception problem you fix with a landing page. It’s a governance problem, and it’s sitting in the middle of most companies’ hiring stacks right now.
Why recruiters are going all-in
The business case isn’t subtle. The same SHRM survey found that 89% of HR professionals using AI in recruiting say it saves time or increases efficiency. That’s hard to argue with when a team of three is filling 50 roles a quarter.
44% now use AI to screen resumes, 66% to write job descriptions. The teams doing this are sourcing faster, reaching passive candidates earlier, and spending less time on the administrative side. Whether the technology is doing what it claims is a separate question. The adoption momentum is real.
Why candidates are checking out
The trust gap has been visible for years. Pew Research found that 66% of Americans would not want to apply if AI helped make hiring decisions. That data is from 2023 — but adoption has only accelerated since, and candidate sentiment hasn’t moved in the other direction.
Gartner’s 2025 survey found only 26% of job applicants trust AI to fairly evaluate them. A Greenhouse report found 70% of hiring managers trust AI to make better decisions, while only 8% of job seekers call the process fair. 38% have already withdrawn from a hiring process specifically because it involved an AI interview.
Three things drive this. Candidates worry their data is used in ways they can’t see. They assume pattern-matching rather than judgment. And most critically, they have no idea what to do if they think the screening was wrong. There’s usually no one to ask, no rationale to read, no path to contest the outcome.
When candidates start gaming the AI
Here’s something most governance frameworks haven’t caught up with yet, and most HR professionals are only now starting to talk about openly.
Candidates have figured out how the screening works — and they’re working around it. One tactic that’s become widespread: pasting the full job description into a resume in white text. Invisible to a human reader, fully visible to an ATS or AI scanner. The system finds every keyword match, scores the candidate at or near 100%, and flags them as a top applicant. The recruiter sees a strong match, books the interview, and discovers in the room that the candidate can’t name the tools they listed as “expert level.”
The interview stage isn’t immune either. With AI tools that transcribe questions in real time and feed answers through earpieces or a second screen, some candidates are running AI-assisted interviews while the recruiter is running AI-assisted screening. At a certain point, the AI is evaluating the AI’s output. Nobody’s assessing the actual person.
This isn’t a fringe edge case. HR forums, hiring managers across sectors, and talent acquisition leads in tech and financial services are all reporting versions of this. It’s one reason some teams are bringing back structured in-person components for senior roles — not because they distrust remote hiring, but because the signal from AI-screened, AI-coached remote interviews has degraded enough that they can’t tell the difference between a strong candidate and a well-prompted one.
The deeper problem: AI screening was supposed to make it easier to find great candidates. In an environment where both sides are optimizing with AI tools, it’s getting harder, not easier, to find someone who can actually do the job.
Governance doesn’t solve this directly. But it creates the conditions for catching it: logged decisions, documented criteria, human review at defined checkpoints, and — critically — outcome tracking. Did the high-scoring candidate actually perform well six months in? Without that loop, the whole system is flying blind.
The governance gap nobody’s closing
Most companies using AI in hiring have built no decision trail. There’s no record of what the system scored, why it ranked someone low, or whether any human actually reviewed the output before the rejection email went out.
This is becoming a legal problem, not just an ethical one.
Under Regulation (EU) 2024/1689 — the EU AI Act — AI systems used for screening, filtering, ranking, or evaluating candidates can fall under Annex III high-risk use cases, particularly when they influence employment decisions in meaningful ways. This covers resume screening tools, automated interview scoring, and candidate ranking engines. When a system qualifies, mandatory requirements apply: risk management documentation, bias testing, human oversight, logging, and candidate explanation rights. Article 86 gives any candidate the right to a plain-language explanation of how an AI-assisted decision affected them.
The Digital Omnibus agreement, reached provisionally in May 2026, introduced a split timeline: stand-alone high-risk AI systems under Annex III — most recruitment and screening tools — must comply by December 2, 2027. AI embedded in regulated products under Annex I has until August 2, 2028. The direction hasn’t changed. The deferral is not permission to wait.
NYC Local Law 144 has been in force since 2023, requiring annual independent bias audits for automated employment decision tools used in New York City. Penalties start at $500 per violation and escalate daily.
Skills-based hiring as a trust bridge
One structural response is changing what the AI evaluates in the first place. Skills are 5x more predictive of job success than degrees. Skills-based criteria can reduce reliance on weak proxies like educational credentials — but only if those criteria are structured, documented, and consistently applied. The method doesn’t fix bias automatically. It removes one common source of it if implementation is serious.
Companies using structured skills-based assessment report an 89% improvement in employee retention compared to credential-weighted approaches.
85% of employers say they use skills-based hiring. Harvard Business School and Burning Glass research puts the net effect of removing degree requirements at 0.14% incremental increase in non-degree hires — meaning most companies remove the credential requirement from the job posting but leave their ATS filtering logic exactly as it was.
Real skills-based hiring changes what the AI evaluates. And when evaluation is based on demonstrated competency rather than keyword proximity, it’s also harder to game with white-text tricks or AI-generated answers, because the assessment requires evidence of actual work.
What an audit-ready HRTech architecture actually needs
Most HR teams know they should have governance on their AI tools. Fewer know what that concretely means architecturally. Here’s what it takes to build a system that holds up under regulatory scrutiny and candidate appeals:
- Data lineage. Every piece of candidate data used in a scoring or ranking decision needs a traceable origin: where it came from, when it was collected, whether the candidate consented, and what transformations it went through before the model saw it.
- Decision logs. Every AI recommendation needs to be logged with a timestamp, the model version, the input features used, and the output. These logs are what Article 86 of the EU AI Act and NYC Local Law 144 both require.
- Explainable recommendations. The system should produce a readable rationale alongside any score — not “score: 72” but “scored lower on X, Y not assessed.” Explainability is both a trust signal for candidates and a requirement under GDPR’s automated decision-making provisions.
- Human override with logging. The AI recommends. A human decides. That decision — including any deviation from the AI output — gets logged. This is the feedback loop that makes the model better over time.
- Bias and performance monitoring. Disparate impact metrics need to be tracked continuously, not just at initial deployment. Critically: outcome tracking — did the high-scoring candidate actually perform well? — is the only way to detect whether the model is degrading due to gaming or data drift.
- Access control. Who can query candidate data, who can adjust scoring logic, who can see rejection rationale — each needs to be role-scoped, logged, and auditable.
None of this requires rebuilding from scratch. But it does require an architecture review and a governance layer built on top of existing tooling.
If your product uses AI in hiring, you already need an audit
Regulation (EU) 2024/1689 applies to any system that influences employment decisions, regardless of where the vendor is headquartered. The obligations differ depending on your role in the supply chain.
If you’re a provider — building and placing an AI hiring tool on the market — you carry the full set of obligations: risk management system, technical documentation, conformity assessment, bias evaluation, post-market monitoring, and registration in the EU AI database.
If you’re a deployer — an employer or HR team using a third-party AI screening tool — your obligations are narrower but real: genuine human oversight, transparency notices to affected candidates, records of AI-influenced decisions, and a fundamental rights impact assessment if you’re using the tool at scale.
Most companies are both. An employer building a proprietary scoring tool is a provider. That same employer using a vendor’s ATS for a different part of the process is a deployer. Most HR legal teams haven’t mapped that boundary yet.
The December 2, 2027 deadline for stand-alone Annex III systems gives more runway than the original date. It doesn’t change what needs to get done.
Building AI hiring tools candidates actually trust
Four things consistently separate tools candidates trust from ones they don’t.
Transparency before the process starts. Candidates don’t need to understand the model. They need to know what factors it uses and what it rules out, before they apply. A short plain-language explanation changes the psychological dynamic considerably.
Explainable outputs. Every recommendation should have a readable rationale attached. Not “score: 67” but “scored lower on X because Y.” This satisfies Article 86 of the EU AI Act and reduces the likelihood of a candidate feeling they were dismissed by a black box.
A real appeal path. Most companies have no answer to “who do I talk to about this?” That gap creates legal exposure and erodes trust in ways that accumulate quietly.
Human override by design. The AI recommends. A person decides. That decision gets logged. This is how the system gets more accurate over time, not just how it satisfies regulators.
The HR teams going all-in on AI aren’t wrong. The candidates walking away aren’t wrong either. The companies in trouble are the ones that adopted the efficiency layer without building the accountability layer underneath it — and are now finding out, through degraded signal quality and incoming regulation, that those two things were never actually optional.
An AI audit starts with a systems inventory: every AI component in your hiring stack, what decisions it influences, what data it uses, whether any of it is documented. From there: data flows, decision point mapping, log architecture, explainability mechanisms, human oversight design, and a risk roadmap that tells you what needs to change first.
That’s a concrete technical engagement, not a compliance exercise in the abstract. Allmatics runs this kind of audit for companies building or operating AI in regulated contexts. If you want to understand what your hiring AI is actually doing and where your exposure sits, that’s where we start.