This article summarises publicly available guidance from regulators and official sources. It is general educational information only and does not constitute legal or professional advice. Requirements vary by jurisdiction. Consult your regional authority or a qualified professional for advice specific to your situation.
AI tools that screen resumes, score video interviews, rank applicants by fit, or flag candidates for rejection are legal to use in Australia, but they come with disclosure, data handling, and discrimination obligations that most small businesses are not meeting. The obligations are not complex, but they require HR teams to update their standard job listing privacy notices, review how AI vendor data is handled, and from December 2026, add automated decision-making disclosures to their privacy policy. This guide covers what you need to do at each stage of an AI-assisted hiring process.
In short: AI recruitment tools are legal in Australia. Privacy Act obligations include informing candidates that AI is being used and where their data goes. Anti-discrimination law applies to AI outputs. From December 2026, APP 1.7 requires privacy policy disclosure of automated decision-making — this is a transparency requirement, not a right for candidates to demand human review, which APP 1.7 does not create. See the OAIC's guidance at oaic.gov.au. Last verified: June 2026 | Next review: September 2026.
Types of AI recruitment tools and what they do
The AI recruitment tools used by Australian businesses fall into four categories. Applicant tracking systems with AI ranking (tools like Workable, Lever, and Greenhouse) score and rank resumes against a role description. Video interview AI tools (such as HireVue and Vervoe) assess responses, facial cues, or language patterns in recorded interviews. Skills and psychometric assessment platforms (such as Pymetrics and Criteria Corp) measure cognitive ability, personality traits, and role fit using algorithmic scoring. And sourcing tools use AI to identify passive candidates from LinkedIn or job boards.
Each type carries different risk profiles. Resume ranking tools risk amplifying historical hiring biases if the AI was trained on past hiring data. Video assessment tools carry additional risk because they assess subjective traits like communication style, which can produce discriminatory outcomes against people from non-English-speaking backgrounds, people with accents, or people with certain disabilities. Psychometric AI tools have come under significant scrutiny internationally for producing outcomes that correlate with race and disability status.
What candidates must be told
Under APP 5 of the Privacy Act, when personal information is collected from a job applicant, the OAIC's guidance outlines that businesses are expected to take reasonable steps to notify applicants of the purposes for which the information is being collected and how it will be used. If AI is used to process, score, or rank that application, the OAIC's guidance indicates that AI use should be disclosed. This applies at the initial collection point. Typically the job listing or application form. See the OAIC's APP 5 guidance at oaic.gov.au.
| What candidates must know | Where to disclose |
|---|---|
| That AI is being used to process or assess their application | Job listing or application form privacy notice |
| What the AI tool does (e.g., resume scoring, video assessment, skills ranking) | Privacy notice or candidate FAQ |
| What personal information the AI uses | Privacy notice |
| Where data is stored (particularly if overseas) | Privacy notice |
| How long data is retained | Privacy notice |
| That you use automated decision-making and the types of decisions involved (from December 2026) | Privacy policy |
Most recruitment privacy notices used by Australian SMBs were written before AI tools were part of the hiring process. They describe human review of applications and say nothing about algorithmic processing. Updating these notices to reflect actual practice is a straightforward compliance step that can be completed in an afternoon.
Where candidate data goes and why it matters
AI recruitment tools are almost universally operated by overseas vendors. When a candidate submits an application through your careers page and their resume is processed by an AI screening tool, that data typically travels to servers in the United States, the European Union, or both. APP 8 of the Privacy Act requires you to take reasonable steps to ensure the overseas recipient handles that data in accordance with Australian Privacy Principles.
In practice, this means reviewing the AI vendor's privacy policy, confirming the jurisdiction of their data storage, and checking whether their data processing agreement commits them to handling data in accordance with Australian standards. Most enterprise-tier recruitment tools have data processing agreements that satisfy this requirement. Consumer-grade or startup AI tools may not. If you cannot confirm equivalent protection, you remain liable for how the vendor handles the data.
Quick check: Ask your AI recruitment vendor three questions before signing up. Where is candidate data stored? Does your data processing agreement commit you to APP-equivalent standards? Do you use candidate data to train your AI models? Their answers determine whether your APP 8 obligation is satisfied and whether you need to disclose training data use in your candidate privacy notice.
Anti-discrimination risk from AI bias
AI tools trained on biased historical hiring data produce biased outputs. If an AI resume screener was trained on data where most successful hires came from a particular university, attended schools in a particular postcode, or were of a particular demographic, the tool will score future candidates accordingly. The discriminatory pattern is in the training data, but the legal risk is with you.
Australian discrimination law is outcome-based. A candidate rejected by your AI screening tool who can show they were treated less favourably because of a protected attribute (age, sex, race, disability, pregnancy, religion, or others protected by federal and state law) has a potential claim. The fact that an AI made the decision is not a defence. The Australian Human Rights Commission's guidance on AI and human rights explicitly addresses this risk.
Managing this risk requires: reviewing vendor documentation on how their AI was trained and whether it has been audited for bias; ensuring human review is mandatory before any candidate is rejected based solely on an AI score; and auditing your AI-assisted hiring outcomes periodically for demographic patterns. If you find patterns, investigate before continuing to use the tool.
The December 2026 automated decision-making requirements
From December 2026, your privacy policy must disclose when you use automated decision-making that significantly affects an individual's rights or interests. Hiring and candidate shortlisting qualify as decisions that significantly affect individuals. If your AI tool filters, ranks, or rejects applicants before a human reviews them, that is ADM under the new rules and must be disclosed.
The disclosure must state that you use ADM in recruitment and describe the types of decisions made and the data used. APP 1.7 does not create a legal right for candidates to demand human review of an automated decision, unlike the EU's GDPR. Many employers choose to offer a human review option for hiring decisions anyway, as good practice and to reduce discrimination-complaint risk, but doing so is a business decision, not a legal obligation under APP 1.7.
What a compliant AI hiring process looks like
- Job listing stage. Include a candidate privacy notice disclosing AI tool use, the purpose of collection, data storage location, and retention period. From December 2026, your privacy policy also needs to disclose that you use automated decision-making and the types of decisions involved.
- Application processing. Configure your AI screening tool to produce a ranked shortlist, not a final rejection list. AI scores inform the human review; they do not replace it.
- Human review of AI shortlist. A qualified member of your team reviews the AI shortlist before any candidate is rejected. Review the AI scores critically, not as objective truth. Flag any outputs that look surprising or inconsistent.
- Candidate communication. Unsuccessful candidates are notified of the outcome. If they ask about the assessment process, be prepared to describe what AI tools were used and how they can request further information.
- Data retention and deletion. Retain candidate data for the period disclosed in your privacy notice, then delete it. Do not keep application data in AI tools indefinitely. Check whether your AI vendor retains data after a contract ends and what the deletion process involves.
- Annual audit. Review your AI-assisted hiring outcomes annually for demographic patterns. Document the review and what action, if any, you took in response.
Methodology (Real-World, Verified)
This guide is researched against primary regulatory sources and official regulator guidance, verified as of the date shown, and written for a business with no dedicated compliance function.
Read our full methodology and independence and disclosure policy.
Related reading: our can staff upload customer data to AI tools.
Related reading: our Claude AI review for Australian business.
Try our free AI Compliance Checker to check whether your AI tools meet your compliance obligations.
Related reading: our AI and the Privacy Act guide.
Related reading: our AI governance by region.
Do we need to tell candidates when they have been rejected by an AI?
Current Australian law does not require proactively notifying each rejected candidate that AI was used to assess their specific application. However, under APP 5, businesses are expected to disclose in their candidate privacy notice that AI is used in the hiring process. From December 2026, APP 1.7 requires the privacy policy to describe automated decision-making, but it does not require offering candidates a right to human review — that's a business choice, not a legal mandate. If a candidate asks directly whether AI was used to assess them, an honest answer is both the ethical approach and the legally defensible one. See the OAIC's guidance at oaic.gov.au.
Can we use video AI interview tools in Australia?
Yes, video AI interview tools are legal to use in Australia, but they carry the highest discrimination and privacy risk of any AI recruitment tool type. Before using one, review the vendor's documentation on how their AI was trained, whether it has been audited for bias, and what demographic data was used in training. Ensure candidates are clearly told a video AI assessment is being used and what it measures. Consider offering an alternative assessment method for candidates who object to AI video analysis. Many organisations internationally have moved away from these tools after discrimination findings.
What if a candidate complains that our AI tool discriminated against them?
If a candidate makes a discrimination complaint related to your AI hiring tool, do not dismiss it. The complaint may go to the Australian Human Rights Commission, a state equal opportunity body, or the Fair Work Commission. Begin by documenting what AI tool was used, what the tool's output was for that candidate, and what human review occurred. Do not delete records. Engage a lawyer with employment and privacy law expertise. Review whether the tool's AI outputs show any systematic bias that may support the complaint. Early engagement and a constructive response to the complaint is always preferable to a formal investigation.
Does using a third-party AI recruitment platform change our obligations?
No. Using a third-party platform does not transfer your Privacy Act obligations to the platform. You are the entity that collected the candidate's personal information and chose to use an AI tool to process it. The obligations under the APPs, including notification, security, cross-border disclosure, and from December 2026 the automated decision-making requirements, remain with you. The platform is a service provider. Review their data processing agreement to confirm they handle data in accordance with your APPs obligations, but do not rely on that review as a substitute for your own compliance steps.
What records should we keep about AI-assisted hiring decisions?
Keep records of what AI tool was used in each hiring round, the criteria the AI was configured to assess, the shortlist produced by the AI, any human review notes that followed the AI shortlist, and the final hiring decision with the rationale. These records serve three purposes: they support your ability to respond to a discrimination complaint, they provide evidence that human review occurred for any automated decision-making inquiry, and they help you audit your AI-assisted outcomes over time. Retention periods should match your standard HR records policy, typically seven years or the duration specified in your industry award.
The information in this article is general in nature. It reflects a summary of publicly available guidance and does not constitute legal, privacy, or professional advice. Your obligations will depend on your specific situation, jurisdiction, and business circumstances. Do not rely on this article as a substitute for qualified legal or professional advice.
Understand all your HR AI compliance obligations: Privacy Act, anti-discrimination, Fair Work, and the December 2026 ADM requirements.
Read the full HR AI compliance guide