Using AI in hiring lawfully in Ireland
Reviewed by Mellow Editorial Team, HR & payroll content team
Employers in Ireland can use AI tools in hiring, but they must comply with existing employment, data protection and equality law — none of which makes an exception for automated decision-making. The rules are not new, but applying them to AI requires deliberate choices.
Why existing law already covers AI in hiring
There is no single Irish statute called an "AI in Hiring Act." Instead, several overlapping frameworks apply the moment you use an automated tool to sift CVs, rank candidates or conduct video assessments.
GDPR and the Data Protection Act 2018 are the most immediately relevant. Candidates are data subjects, and their personal data — including inferred characteristics — must be processed lawfully, fairly and transparently. Article 22 of GDPR gives individuals the right not to be subject to a decision based solely on automated processing that produces a legal or similarly significant effect. In practice, this means a fully automated reject with no human review is legally risky. You need either explicit consent, a contractual necessity ground, or a Union/Member State law authorisation — none of which is straightforward in a recruitment context.
The Employment Equality Acts 1998–2015 prohibit discrimination on nine grounds: gender, civil status, family status, age, disability, race, sexual orientation, religion and membership of the Traveller community. An AI tool trained on biased historical data can replicate or amplify those biases without any discriminatory intent on your part. Intent is not a defence under the Acts — outcomes matter.
The EU AI Act, which is phasing in across 2024–2026, classifies AI systems used for recruitment and employee management as high-risk. High-risk systems face stricter obligations around transparency, human oversight, accuracy and record-keeping. Employers deploying such tools — even off-the-shelf products — have obligations as "deployers" under the Act.
What "meaningful human involvement" actually means
The phrase appears in guidance from the Data Protection Commission (DPC) and is worth taking seriously. It does not mean a human glances at a shortlist and clicks approve. It means a person with actual authority reviews the AI's output, can override it, understands the basis on which candidates were filtered, and is not simply rubber-stamping a machine recommendation.
In practical terms: if a recruiter sees only the candidates an AI has already filtered in, any subsequent human review happens too late. The filtering stage was the significant decision. Document where human judgement enters the process and make sure it enters early enough to be real.
Transparency obligations towards candidates
Candidates have a right to know:
- that AI or automated tools are being used in the selection process
- what data is being collected (including, for example, facial expression analysis in video interviews)
- how decisions or rankings are produced
- that they can request human review of any automated decision
This information should appear in your privacy notice and, ideally, in candidate-facing communications before the process begins. Burying it in a lengthy privacy policy that candidates are unlikely to read does not satisfy the transparency principle in spirit, even if it ticks a box.
If a candidate asks why they were rejected, and the answer is "the algorithm scored you low," that is not a sufficient explanation under GDPR. You need to be able to articulate the criteria and how they were applied.
Vetting the tools you use
Many employers assume that buying a reputable product shifts responsibility. It does not. You remain a data controller (or co-controller) and a deployer under the EU AI Act. Before deploying any AI hiring tool, work through these questions:
- Training data: what data was the model trained on, and does the vendor provide a bias audit? Ask for it in writing.
- Purpose limitation: is the tool being used for the task it was designed for? A general-purpose large language model is not the same as a validated psychometric tool.
- Data transfers: if the vendor processes candidate data outside the EEA, what transfer mechanism applies?
- Retention: how long does the vendor hold candidate data, including video recordings or test responses?
- Contractual protections: does your data processing agreement with the vendor cover all of the above?
A Data Protection Impact Assessment (DPIA) is mandatory under GDPR where processing is likely to result in high risk to individuals. Automated decision-making in recruitment almost certainly meets that threshold. Running a DPIA before you go live — not after a complaint — is the right sequence.
Where equality law and AI intersect
The Workplace Relations Commission (WRC) handles complaints under the Employment Equality Acts. An unsuccessful candidate who believes an AI tool screened them out on a discriminatory basis can bring a claim. The burden of proof can shift to the employer once a prima facie case is established.
This is not hypothetical. As AI tools become more common in Irish recruitment, equality-based challenges are a realistic exposure. Keeping records of how your shortlisting criteria were set, how they map to genuine job requirements, and how the tool performed across different demographic groups is a practical safeguard — and evidence you would need if a claim arose.
---
Run HR and payroll in Ireland with Mellow
Mellow brings HR, payroll and 12 AI agents into one platform — built to handle Ireland properly, with payroll included, from £4 per employee per month. The AI agents don't just answer questions; they generate contracts, run cost estimates and draft letters for you.
[Start a free trial →](/register)