AI Hiring Compliance Lives With Privacy Teams — Most Haven't Noticed
Not legal advice. This article discusses legal and regulatory developments and is generated with AI assistance under human editorial review. It is provided for informational purposes only and does not constitute legal advice. Laws and regulations vary by jurisdiction and are subject to change. You should consult your own qualified legal counsel before taking or refraining from any action based on the content of this article. Read our AI Transparency statement.
The News
FTI Consulting published guidance on August 18, 2026, urging organisations to extend existing privacy rights response processes to cover AI-specific rights under emerging regulations. California's CCPA Article 11 regulations require employers using automated decisionmaking technology (ADMT) for 'significant decisions' — including hiring, compensation, and termination — to provide pre-use notices, opt-out mechanisms, and risk assessments by January 1, 2027. Colorado's ADMT Act and the EU AI Act impose similar transparency and human-review obligations. FTI argues that most organisations already operate privacy rights intake portals, governance structures, and automated workflows for GDPR and CCPA requests — they just haven't been configured for AI-specific rights like 'opt out of ADMT for significant decisions' or 'request human review of an automated decision.'
Why It Matters
TA leaders typically treat AI hiring compliance as a procurement or legal issue. But the operational mechanics — receiving an opt-out request, routing it to the right team, retrieving the decision records, documenting human review within 45 days — live with the privacy function. If your data subject access request (DSAR) process doesn't recognise AI-specific rights, you'll be building that workflow from scratch under regulatory pressure in 2027, when California, Colorado, and Connecticut all enforce overlapping ADMT obligations on employers using automated tools in hiring.
Taking Action
All action is situated in your corporate context. These are starting points, not prescriptions — choose what fits.
Connect
Who to talk with in your enterprise
Your data protection officer or privacy programme lead: ask whether your current DSAR intake process can handle AI-specific rights requests — opt-out from ADMT, correction of data used in an automated decision, human review of an adverse outcome. Your HRIS lead: confirm whether your ATS or HR platform integrates with your privacy rights management tool, so decision records can be retrieved automatically when a request lands.
Inspect
What to take a closer look at
Check your privacy rights intake form or portal. Can a requester submit an 'opt out of automated decisionmaking for employment decisions' request? If the form only offers access, deletion, and correction, you're missing the AI-specific rights that CCPA Article 11 and Colorado's ADMT Act both require from January 1, 2027.
Reflect
What to think about more deeply
If your privacy team can process a GDPR deletion request in 30 days but can't process an 'opt out of AI hiring decisions' request at all, which regulation do you actually take more seriously?