How do you write an AI transparency notice for candidates?

If an AI system touches your hiring process, you almost certainly owe candidates a clear account of that fact. This article sets out what the duty to inform actually requires and how to write a notice that satisfies it. It is a practical orientation, not legal advice; for decisions about your specific situation, speak to your own advisers.

{/* SOURCE (founder-verified 2026-06-18): the candidate-transparency duty below rests on EU AI Act Article 26(7) (deployer duty to inform persons subject to a high-risk system) read with Annex III(4) (recruitment/selection), plus Recital 84 and the Article 50 transparency obligations. Confirm article numbers and the current consolidated text before publish. Source: artificialintelligenceact.eu, consolidated AI Act. */}

Who has to tell candidates anything?

Two regimes can apply at once, and they answer slightly different questions.

The EU AI Act treats recruitment and selection AI as high-risk under Annex III. As a deployer of a high-risk system, you must inform the people who are subject to it that it is in use. That is a standalone duty on the employer, separate from anything your vendor does. The point is straightforward: a candidate cannot exercise any right they do not know they have.

{/* SOURCE (founder-verified 2026-06-18): "deployer must inform persons subject to the high-risk system" maps to Article 26(7). The high-risk classification of recruitment/selection AI is Annex III point 4. Verify both citations against the consolidated text at publish. */}

UK and EU data protection law adds a second layer. Where personal data is processed, candidates have a right to be told what is happening with it, on what basis, and to what effect. Where a decision is based solely on automated processing and produces legal or similarly significant effects, the data subject has specific rights attached, including meaningful information about the logic involved. A hiring outcome is plainly significant, so this is not a theoretical corner.

{/* SOURCE (founder-verified 2026-06-18): solely-automated-decision rights are UK GDPR Article 22 / EU GDPR Article 22, with the transparency duties in Articles 13 to 15. The "meaningful information about the logic involved" wording is Article 13(2)(f) / 14(2)(g) / 15(1)(h). Confirm before publish; note the UK DPDI/DUAA reforms may have adjusted the Article 22 framing. Source: ICO guidance on automated decision-making. */}

Does the deadline change whether you need this?

Be careful with dates here, because the timeline is genuinely in flux. The EU AI Act's high-risk obligations covering hiring were set to apply from 2 August 2026. On 7 May 2026 the EU reached a provisional political agreement, the Digital Omnibus, to defer standalone Annex III obligations, which expressly include recruitment and selection AI, to 2 December 2027. As of writing that agreement is not yet formally adopted, so the legal position today still points at 2 August 2026.

{/* SOURCE (founder-verified 2026-06-18): both dates are load-bearing and time-sensitive. The Digital Omnibus provisional agreement (7 May 2026) and the proposed 2 December 2027 deferral were NOT YET ADOPTED as of 2026-06-18; re-check adoption status immediately before publish. Sources: Gibson Dunn, Travers Smith, EU AI Act Service Desk, artificialintelligenceact.eu. */}

The practical answer is that the transparency duty does not hinge on which date wins. UK data protection law already requires you to be transparent about automated processing, and that duty applies today, regardless of the EU enforcement calendar. Writing the notice now is the safe move whichever way the Omnibus lands.

What does a good notice actually say?

A candidate-facing AI notice answers a small set of questions in plain language. Lead with substance, not with reassurance.

• That AI is used at all. Name the stage. "We use an automated tool to help shortlist applications" is clearer than a vague reference to "technology".
• What it does, and what it does not do. Describe the function in concrete terms: does it rank, score, summarise, or filter? State explicitly whether a person makes the final call. If a human decides, say so, because that is the single fact candidates most want to know.
• What data it uses. The CV, the application form answers, an assessment score. Candidates should not have to guess what the tool reads.
• The legal basis and their rights. Point to how they can ask for a human review, contest an outcome, or request more information. Give a route, not just a statement of rights.
• Who to contact. A named function or inbox for questions about the AI specifically, not a generic careers address.

Keep it short, keep it specific, and put it where candidates will see it before they are assessed, not buried in a privacy policy footer.

Where should the notice live?

Place the disclosure at the point of collection and again before any AI-assisted stage. The application form is the natural home for the first mention; an assessment invitation is the natural home for the second. Repetition here is a feature, not clutter, because consent and awareness decay between a job advert and an assessment three weeks later.

A common mistake is to treat the privacy notice as sufficient. It is necessary, but a dense privacy policy is not where a candidate forms their understanding of how they are being assessed. The AI-specific notice is a separate, plainer artefact that sits alongside it.

What about human oversight?

Transparency and oversight travel together. Telling candidates that a human makes the final decision is only honest if a human genuinely does. The notice is downstream of your process design: if the tool can move someone out of a pipeline without a person reviewing that step, no wording fixes the underlying problem. Design the meaningful human review first, then describe it accurately.

This is also where the language matters. Avoid framing any outcome as the machine's verdict. A candidate who is not progressing should hear that from a process a person owns, with the reasoning available, not as an opaque automated result.

How KimonRecruit approaches this

We built KimonRecruit so the transparency notice describes something true. The platform produces decision support, never automated outcomes: there is no code path that moves a candidate out of a pipeline without a human recruiter making that call. Every assessment score is replayable from the prompt, model and version that produced it, so the "meaningful information about the logic" a candidate is entitled to actually exists. Candidates are told how AI is used in their process as a matter of design, not as an afterthought.

None of that removes the deployer's duty to inform. It does mean the facts your notice needs to state, what the tool does, what it does not do, and who decides, are stable, documented facts about the system rather than aspirations. To see how the decision-support model shapes the candidate experience, read our pillar guide to the EU AI Act and recruitment.

The notice is not a compliance chore bolted on at the end. Written early, it forces the clarity about your own process that every other obligation depends on. That is reason enough to draft it now, whatever the enforcement calendar settles on.