How can HR teams use AI in hiring without bias?

A busy recruiter with 300 applications for one job is exactly the person AI tools are sold to. The danger is that a model quietly learns, or is handed, patterns that disadvantage people because of age, gender, disability, origin or another protected ground. Human rights law in Canada and anti-discrimination law elsewhere apply to the outcome, whether a person or a program produced it.

The safe pattern is to treat AI as an assistant that reads and organizes, never as the judge. The person who decides stays accountable, the criteria are written down before anyone looks at a résumé, and the results are checked for unfair differences between groups. This guide is general information, not legal advice; an employment lawyer should review any process before you rely on it.

Why AI screening can go wrong

A language model has absorbed patterns from huge amounts of text, including old stereotypes. Asked to "find the best candidates," it fills the gap with its own guesses about what "best" looks like. That can mean favouring certain schools, penalizing career gaps (which often reflect parenting, illness or disability), or reading names as signals of origin.

Ontario's Human Rights Commission and the Law Commission of Ontario took this risk seriously enough to publish a Human Rights Impact Assessment for AI in November 2024. An impact assessment is a structured questionnaire you complete before and during use: first you rate how much the system could affect people's rights, then you work through questions on how to reduce the risks you found. Both bodies explicitly invite employers to use it.

A screening-assist workflow, step by step

Here is one workflow that keeps the benefits and limits the risks. The job and the details are illustrative.

1. Write the criteria first. For a bookkeeper role: knowledge of accounts payable, experience with a named accounting program, accuracy with numbers, French and English at work level. Each criterion must relate to the job.
2. Remove what the model doesn't need. Strip names, photos, addresses, birth dates and graduation years before any text reaches the tool.
3. Ask for evidence, not a ranking. The prompt below asks the model to quote what it found for each criterion and to say when evidence is missing. It never asks for a score or a yes/no.
4. A trained person decides. The recruiter reads the summary and the original application, then decides who moves forward and writes down why.
5. Check the results. Each month, compare how candidates from different groups move through each stage, where you have lawfully collected voluntary self-identification data. A large gap is a signal to stop and investigate.
6. Tell candidates. Say in the job posting and your privacy notice that an AI tool helps summarize applications, that people make the decisions, and how to ask questions or request a human review.

You are helping a recruiter review an application for a bookkeeper position.
Criteria (job-related only):
1. Accounts payable experience
2. Experience with [accounting program]
3. Accuracy with numbers (evidence such as reconciliations, audits)
4. Working French and English

For each criterion, quote the exact words from the application that show it,
or write "No evidence found." Do not infer anything from names, age, gaps in
employment, schools, addresses or writing style. Do not rank, score or
recommend. End with a list of questions the recruiter could ask to fill gaps.

Application:
[paste the anonymized résumé and cover letter]

Rules worth knowing

Laws differ by place, so check those that apply where you hire.

• Canada. Provincial and federal human rights codes prohibit discrimination in employment on protected grounds. The Ontario impact assessment, which the Canadian Human Rights Commission helped develop, is a practical way to document your diligence.
• New York City. Local Law 144 of 2021 says an employer or hiring agency may not rely on an automated tool to screen or select candidates unless it has had a bias audit within the past year, a summary of the audit is public, and candidates or employees received notice. The city's consumer and worker protection department has enforced it since July 5, 2023, and says the notice must come 10 business days before the tool is used.
• Québec. Law 25 added a duty to tell people when a decision about them is made by automated processing alone, explained in the next section.

Notice the common thread: transparency to candidates, evidence that the tool was tested, and a human who can step in.

What does Québec's Law 25 require for automated decisions?

Law 25 modernized Québec's private-sector privacy act, and one of its provisions, section 12.1, has applied since September 22, 2023. It covers a business that uses personal information to make a decision based exclusively on automated processing, meaning no person meaningfully takes part. The business must tell the person concerned that the decision was made this way, no later than when it tells them the decision itself.

If the person asks, the business must also explain three things: which personal information was used, the reasons behind the decision and the main factors and parameters it relied on, and their right to have that information corrected. And the person must be able to present their point of view to a staff member who has the authority to review the decision. Separately, the act requires that information used to make a decision about someone be accurate and up to date.

For hiring, the simplest path is the workflow above: a person reads the application and makes the call, so the decision is not exclusively automated. Even then, telling candidates that AI helps summarize applications is good practice and fits the act's general duty to explain why and how personal information is collected. A plain notice might read: "We use an AI tool to summarize applications against the posted job requirements. A member of our HR team reviews every application and makes all decisions. To ask questions or request a review, write to [contact]." Québec's privacy regulator, the Commission d'accès à l'information, and a privacy lawyer can confirm what your specific process needs.