AI Hallucinations, Bias, and Data Breaches: The Recruitment Risks Most HR Teams Are Ignoring
Not legal advice. This article discusses legal and regulatory developments and is generated with AI assistance under human editorial review. It is provided for informational purposes only and does not constitute legal advice. Laws and regulations vary by jurisdiction and are subject to change. You should consult your own qualified legal counsel before taking or refraining from any action based on the content of this article. Read our AI Transparency statement.
The News
International law firm Bedell Cristin has published new guidance for HR professionals on the legal risks of using AI in recruitment, identifying three areas where employers are most exposed: AI hallucinations leading to negligent decisions, poorly configured screening tools producing discriminatory outcomes, and data protection breaches from feeding confidential candidate information into public AI platforms.
On bias, the firm warns that AI tools trained to prioritise candidates based on narrow criteria can produce indirectly discriminatory outcomes. A tool that over-weights where a candidate has worked or trained, for instance, may systematically disadvantage qualified candidates whose experience was gained in different jurisdictions. 'Regular bias audits should be carried out on AI hiring tools,' the guidance states, 'and organisations should ensure that candidates receive clear privacy information in advance.'
On data protection, the key distinction is between internally controlled enterprise AI systems and public-facing third-party platforms. The latter 'is more likely to create confidentiality and data breach risk if used without appropriate control,' the firm notes. Organisations have a legal duty to ensure that employees acting on their behalf process personal data lawfully, fairly, and transparently when using AI tools.
Why It Matters
This guidance lands at a moment when AI use in recruitment is accelerating faster than governance frameworks. The Guernsey Office of the Data Protection Authority recently published 'Ten-step practical AI guidance' to help organisations use AI responsibly with personal data, and the Jersey Office of the Information Commissioner has identified artificial intelligence as one of its strategic priorities for 2026–2028. Regulators are paying attention.
For TA leaders, the message is clear: vendor promises of AI safety don't transfer legal liability. If an AI screening tool produces biased shortlists, if a recruiter feeds CVs into a public AI platform without consent, or if AI-generated communications contain factual errors — the employer carries the consequence. Governance cannot be delegated to the vendor.
Taking Action
All action is situated in your corporate context. These are starting points, not prescriptions — choose what fits.
Connect
Who to talk with in your enterprise
Your data protection officer or privacy counsel — ask them to review which AI tools in your recruitment stack are enterprise-controlled versus public-facing, and establish a clear policy about which types of candidate data may be processed by each. The line between 'internal efficiency tool' and 'public platform' is where breaches happen.
Your head of recruitment operations — work with them to create a recruiter-facing AI usage policy that covers what tools are approved, what data can be input, and what verification steps are required before relying on AI-generated content in candidate communications or hiring decisions.
Your diversity and inclusion lead — partner with them to schedule regular bias audits on AI screening and assessment tools. Frame it as protecting the organisation's DEI investment — biased AI tools can undo years of inclusive hiring progress in a single recruitment cycle.
Inspect
What to take a closer look at
Run a simple audit this week: ask every recruiter on your team to list every AI tool they use in their daily workflow — including the ones IT didn't officially provision. The gap between the officially approved stack and actual usage is often where the greatest data protection and bias risk sits. Specific tool to look at: your ATS's audit log or activity trail — can you see whether recruiters are copying candidate data into external AI tools? If the logs don't capture this, the visibility gap itself is a governance issue.
Reflect
What to think about more deeply
The most interesting question isn't 'Which AI tools are safe for recruitment?' — it's 'If an AI-generated hiring decision harmed a real candidate tomorrow, could we trace exactly how it happened, who was accountable at each step, and what we'd change?' If the answer is no, what is the cost of continuing to operate without that capability?