2026-08-26 · 5 min read

AI for HR and recruiting: screen and draft without exposing people

Where does AI actually help recruiters and HR teams?

In the text work that eats most of the day: summarizing long CVs, comparing candidates against a job spec, drafting balanced feedback, writing offer and rejection letters, preparing tailored interview questions. The tools are fast — the only question is what goes into the prompt.

  • Screening and summarizing — condensing CVs and matching them to role requirements.
  • Drafting — respectful rejections, offers, job descriptions.
  • Performance reviews — turning raw notes into structured, balanced feedback.
  • Policies and onboarding — first drafts of handbooks, checklists, training material.

Why is a CV a privacy problem?

Because it is a document made entirely of personal data: name, phone, address, education, work history — and often details the candidate volunteered, like health constraints or family circumstances. They sent it to you, not to an external AI vendor.

Which HR documents are riskiest to paste?

Almost everything that passes through the department. These five are the riskiest, because they combine identity with sensitive content:

  1. CVs and applications — full identity, contact details, work history, and sometimes sensitive details the candidate added.
  2. Performance reviews — professional judgment about an identified person; a leak harms both employee and employer.
  3. Disciplinary and termination files — legally charged content, often with health or family details.
  4. Salary and benefits tables — pay, IDs and bank details of the whole workforce in one file.
  5. Interview notes — raw impressions written on the assumption no one outside the company would ever read them.

What does the law expect from an employer here?

Candidate and employee records are personal-data processing in the fullest sense: the employer must have a legal basis, use the data only for its original purpose, and keep it secure. Sending an employee file to an AI vendor is a new disclosure that needs its own justification — the same logic covered in our guide to safe AI adoption for businesses.

How do you screen CVs with AI without exposing candidates?

Separate the skills from the identity. The tool needs the experience, education and competencies — not the name and phone number. Anonymization with consistent tokens keeps everything a professional assessment requires.

  1. Run the file through anonymization: the candidate becomes PERSON_001, past employers COMPANY_001, contact details are masked.
  2. Paste the clean copy together with the job spec and ask for a summary or comparison.
  3. Consistent tokens mean PERSON_001 on page one is the same PERSON_001 on page three — comparisons across candidates stay coherent.
  4. Clean metadata: a CV's Word file carries the author's name even after the visible text is cleaned.
  5. Keep a human in the loop — AI summarizes and organizes; it must not reject candidates on its own. The general list of what never belongs in a prompt is here.

Frequently asked questions

May I paste a CV into ChatGPT?

An identifiable CV is the candidate's personal data, and sending it to an external tool without a legal basis is a privacy problem. After anonymization — with the identity removed — you can safely use the tool for summarizing and comparing.

Is a performance review sensitive data?

It is personal data, and it often touches special categories — health, family status and more. Treat it as a document that must never leave the organization in identifiable form.

The candidate sent the CV voluntarily — isn't that consent?

They agreed to your company reviewing it for recruitment, not to it being passed to a third-party vendor. Use beyond the original purpose needs its own legal basis.

Does an ATS with built-in AI solve the problem?

It settles the contractual relationship with that one vendor, but it doesn't cover manual pastes by staff into public tools. The safe habit — anonymize before any external tool — applies either way.

How do we start applying this in the department?

One written rule: candidate or employee documents enter an AI tool only after cleaning. Train the team, provide an accessible cleaning tool — and keep the token mapping strictly inside the organization.