Global AI Hiring Compliance: Candidate Checklist

Cross-border hiring now makes one question harder than “is this an AI interview?” The real question is which employer, candidate, role, vendor, and decision are connected to the system. A tool used for scheduling is not the same as a tool that ranks applicants, and the obligations can differ again when the candidate lives in another jurisdiction.

This checklist is a preparation aid, not legal advice. The AI disclosure and consent guide explains the first conversation with an employer; here we organise the questions for a global application.

Quick answer: Map the employer, candidate, role, vendor, and decision first. Then ask for notice, data purpose, human accountability, retention, and an escalation contact; use the answers to decide whether to proceed.

Map the decision before you map the law

Write down four facts: where the employer is established, where you are located, what role you applied for, and whether the tool only assists a person or materially determines access to the next stage. Add the vendor's processing location if it is disclosed.

This simple map prevents overclaiming. A public article about one city's audit rule may be relevant to a local employer and irrelevant to another process. It also helps you ask a recruiter a useful question instead of sending a broad “is this legal?” message.

The candidate-facing five-part checklist

Notice. Does the invitation identify automation and explain its role in screening, interviewing, scoring, or recommendation?

Purpose and data. What is collected: audio, video, transcript, screen events, identity documents, work samples, or inferred attributes? Which fields are optional, and what is the lawful or contractual purpose?

Human accountability. Who reviews a disputed result? Can a person inspect the evidence, correct a transcription, or reassess an accommodation request?

Retention and vendors. How long is data kept, where is it processed, and which vendors or subprocessors can access it? Is training or product improvement a separate purpose?

Escalation. What email or portal handles privacy questions, accessibility requests, correction, deletion, or a request for human review? Save the case number or written response.

Understand the major reference points without overpromising

The EU AI Act treats many employment-related AI systems as high-risk and establishes duties for risk management, data governance, logging, documentation, and human oversight. The exact obligations depend on the system's role and the actors involved. It is not a universal candidate opt-out form.

In New York City, Local Law 144 addresses certain automated employment decision tools and requires bias-audit and notice conditions for covered uses. Coverage, enforcement, and employer location matter; do not assume a tool is covered merely because a company has New York applicants.

Privacy frameworks such as the GDPR also provide principles around transparency, purpose limitation, data minimisation, accuracy, and rights related to automated decisions. Read the employer's notice alongside the relevant regulator guidance. The evidence-anchored scoring guide explains why accuracy and human review matter in practice.

What to document when something goes wrong

Keep the original notice, timestamps, screenshots of consent choices, and the exact question or answer affected. Describe the impact without guessing intent: “The transcript omitted the section where I explained the cache invalidation test, and the scorecard marked that competency as not demonstrated.”

Ask for the narrowest remedy that can resolve the issue: corrected transcript, human review of the evidence, an accessible alternative, or confirmation of deletion. If a regulator or counsel must be involved, your factual record will be more useful than a long accusation.

Red flags that deserve a pause

The process asks for biometric or identity data with no purpose or retention period.
A vendor is named, but no employer contact can explain access or deletion.
The system produces a score while the company says nobody can review the evidence.
Consent is bundled with unrelated model-training or marketing use.
A request for accommodation is routed only to an automated form with no response deadline.

One red flag does not prove unlawful processing, but it does justify slowing down and asking for clarity before sharing more data.

A neutral message for international applications

“Could you share the AI system's role in this stage, data categories and retention period, whether a human reviews disputed results, and the contact for correction or accommodation requests? I am applying from [country], so I would also appreciate the applicable privacy notice.”

The message keeps the conversation factual and gives the employer a chance to route it to the right owner. If the answer remains vague, weigh the opportunity against the data and process risk; you are allowed to make a considered choice.