Contact
In hiring, legal defensibility generally refers to how well a process holds up when challenged: whether decisions can be explained, reproduced, and audited after the fact. For AI-driven hiring, that typically comes down to factors like consistent structured assessment, reproducible scoring, transparent explanations, human oversight, and thorough documentation. This article covers the principles, it is not legal advice, and specific obligations should always be reviewed with your legal team.
Compliance means meeting the rules as written today. Defensibility means being able to justify a specific hiring decision when a rejected candidate, a regulator, or a court asks why.
The distinction matters because challenges are specific. A regulator does not ask whether your vendor has a responsible AI page; they ask why candidate A scored lower than candidate B. If the answer is "the model decided," the process fails the test regardless of how many policies sit behind it.
Under the EU AI Act, AI systems used in recruitment are classified as high-risk. That classification brings concrete obligations: transparency, human oversight, accuracy maintained across the system's lifecycle, and documentation. Similar requirements are emerging elsewhere, including New York City's Local Law 144, which mandates bias audits for automated employment decision tools.
For TA leaders, the practical question is no longer "does our AI tool work?" It is "can we stand behind every decision it influenced?"
The EU AI Act places AI used in recruitment in its high-risk category, which triggers a set of core requirements:
Transparency. Article 13 requires high-risk systems to be transparent enough for the humans using them to interpret the output. A recruiter must be able to understand why a candidate received a given score, not just see the number.
Human oversight. High-risk systems require effective human oversight. In practice, this means the final hire or no-hire decision sits with a person, and that person has enough information to override the system when needed.
Accuracy. The regulation requires an appropriate level of accuracy maintained throughout the system's lifecycle. A tool that produces arbitrary or drifting scores is not just poor practice; it is a regulatory exposure.
Documentation. Organizations need records of how the system works, how it was validated, and how decisions were made.
One caution: no vendor can honestly claim blanket EU AI Act compliance, because the regulation is still being operationalized (as of writing) and obligations depend on how each organization deploys the tool.
The US has no single federal AI hiring law. Instead, a patchwork of state, city, and existing federal rules applies:
New York City Local Law 144 requires employers using automated employment decision tools to conduct annual independent bias audits, publish the results, and notify candidates that an automated tool is in use.
Illinois' Artificial Intelligence Video Interview Act requires employers to notify candidates when AI analyzes video interviews, explain how it works, and obtain consent before use.
Colorado's AI Act, taking effect in 2026, imposes duties on developers and deployers of high-risk AI systems, explicitly including systems used in employment decisions, with requirements around risk management, impact assessments, and candidate notification.
Federal anti-discrimination law applies regardless of technology. The EEOC has made clear that Title VII adverse impact analysis covers algorithmic tools: if an AI system disproportionately screens out candidates from a protected group, the employer is liable, whether or not the bias was intentional and whether or not a vendor built the tool.
The pattern across jurisdictions is consistent: notify candidates, audit for bias, keep humans accountable, and be able to explain decisions. A process built on those principles is positioned for the regulations that exist and the ones still coming.
A defensible decision must be reproducible. If the same candidate, giving the same answers, can receive different scores on different days, the process is arbitrary by definition – and arbitrary hiring is indefensible hiring.
This is where the architecture of an AI hiring tool matters. Large language models are probabilistic: recent research has shown that LLMs can produce meaningfully different rankings for identical candidate inputs across runs. A candidate's outcome should not depend on which server processed their application or what time of day the model ran.
Deterministic assessment models work differently. Same input, same output, every time. Models can be versioned and locked for the duration of a hiring cycle, so every candidate in a cohort is assessed under identical conditions.
When a decision is challenged, reproducibility is the difference between "here is the exact logic, run it yourself" and "the model was in a different state that day." Only one of those survives an audit.
Explainability is now table stakes in AI hiring vendor marketing; but not all explanations are equal.
When an LLM is used to score candidates, the explanation it produces is typically generated after the score. The model writes a reasonable-sounding narrative to justify a number it has already assigned. This is post-hoc plausibility: the explanation sounds right, but it may not reflect the actual scoring logic, because with probabilistic models there is no fixed logic to reflect.
A faithful explanation is different. It is the actual scoring logic, made readable. When assessment models score competency responses against explicit behavioral anchors with defined weightings, the explanation shown to a recruiter is the same logic that produced the score, not a story written afterward.
The legal implication is direct. If a rejected candidate challenges a decision, a plausible narrative is a liability – it may not match what the system actually did. A faithful explanation is evidence.
Questions to ask any vendor: Is the explanation generated by the same mechanism that generated the score? Are scoring weights explicit and documented? Can you show me the exact criteria a specific score was based on?
The EU AI Act requires human oversight for high-risk systems, but the principle runs deeper than regulation: only a human can be morally and legally accountable for a hiring decision. A machine cannot stand in a courtroom and explain intent.
A defensible process treats AI as augmentation, not automation. The distinction:
In practice, defensible human oversight means no automated rejections, recruiters who can see and understand the evidence behind every score, and a clear record of who decided what. Oversight that consists of a human rubber-stamping machine outputs they cannot interpret does not satisfy the requirement. The transparency and the oversight have to work together.
If a decision is challenged two years after the fact, documentation is what remains. A defensible audit trail covers:
Structured interviews make this dramatically easier. When every candidate answers the same competency-based questions assessed against the same criteria, comparisons are inherently documented. Unstructured processes, human or AI, leave gaps that are difficult to defend retroactively.
Data protection sits alongside this. GDPR requires data minimization, and candidates increasingly ask how their data is used; EU-based processing and storage, encryption in transit and at rest, and privacy by design should be standard, not premium features.
A practical checklist for vendor evaluation:
Vendors built for defensibility answer these questions with specifics. This is the approach platforms like Hubert take: deterministic assessment models trained against more than 100,000 expert human evaluations, explicit scoring weights, full audit trails, and the final decision always with the recruiter. Vendors retrofitting compliance answer with adjectives.
The commercial upside is worth naming: a defensible process is also a better one. If an algorithm cannot explain its scores, it probably cannot justify them either; and a process that consistently measures competency over noise produces stronger shortlists, not just safer ones.
Yes, in general. Neither the EU AI Act nor US laws ban AI in recruitment; they attach requirements around transparency, bias auditing, human oversight, and candidate notification. Organizations can generally use AI hiring tools legally, provided the tools and the deployment meet these obligations. How they apply to a specific case is a question for legal counsel.
It depends on where the LLM sits. Conversational AI that conducts the interview dialogue poses little defensibility risk. Using a probabilistic LLM to score candidates is harder to defend, because identical inputs can produce different outputs across runs and explanations are generated after the score rather than reflecting actual scoring logic.
Explainable AI produces a human-readable reason for its output. Defensible AI goes further: the explanation must be faithful to the actual scoring logic, the result must be reproducible, and the full decision history must be documented and auditable. Explainability is one component of defensibility, not a synonym for it.
The employer remains accountable for hiring decisions, which is why human oversight is central to defensibility. A well-designed process keeps the final decision with a recruiter, gives that recruiter interpretable evidence, and documents the boundary of responsibility between the vendor and the employer. Accountability cannot be delegated to a model.