Who's Liable When Recruiting AI Gets It Wrong?

Marcus

4 days ago

7 min read

Picture a rejected candidate filing a lawsuit. Not over the rejection itself, but over how it happened: a screening system never passed their application to a human being. In court, an uncomfortably simple question lands on the table. Who decided to deploy this system? And what did that person do before signing off on it?

The answer "the algorithm did it" doesn't exist legally. Neither does "that's IT's department" or "the vendor assured us the model was vetted." Two KPMG Law attorneys put it quite drily in a recent interview with Haufe: responsibility for business decisions stays with the board, not with the AI. The attitude of "IT will sort it out" is dangerous.

This isn't a compliance footnote. It's the heart of the matter — and unlike the endless debate over postponed EU AI Act deadlines, it already applies today.

That's precisely why this piece isn't about deadlines, risk classes, and transition rules — those were covered in earlier posts. This is about the immediately practical question: whose name is attached to the deployment of a screening AI, and what does that person need to produce when someone asks?

The Rule That's Supposed to Protect You

No one running a corporation is liable for every wrong decision. That's what the business judgment rule is for — anchored in Germany in Section 93(1) sentence 2 of the Stock Corporation Act (AktG), and applied analogously to managing directors under Section 43 of the GmbH Act. It works like a shield: someone who makes a business decision and could reasonably assume they acted on adequate information for the good of the company isn't liable—even if the decision later turns out to be an expensive mistake.

Two words carry the entire weight: adequate information. That's exactly where things get interesting once AI enters the picture.

Because AI doesn't deliver information in the sense of an expert opinion. It delivers an output. That output can be brilliant; it can be hallucinated; it can rest on sources nobody can trace. A human expert owes you expertise, independence, and disclosure of their basis. A model owes you nothing. Sabrina Riesenbeck of KPMG Law puts the problem precisely: when decisions rest substantially on AI analysis, the structure is missing the human components the business judgment rule hinges on.

So the shield doesn't pop open automatically just because a tool was involved. It opens when it's demonstrable that a human independently assessed the result.

The Catch on the Other Side

Now comes the twist that surprises many people. Not using AI isn't automatically the safe side either. KPMG Law points to a line of Federal Court of Justice (BGH) rulings under which management bodies must fully exhaust the information sources available to them. If a company has established AI systems and deliberately ignores them in a time-critical situation, that too can be a breach of duty.

So the choice isn't "AI or no risk." The choice is "AI with a documented process" or "risk in both directions."

Translated Into Recruiting Terms

Screening, ranking, matching scores, automated rejections: these aren't fringe areas. The EU AI Act classifies AI used to select and evaluate candidates as high-risk, and for deployers — meaning the companies using the tool, not the manufacturers — Article 26 lays out a list that reads like a governance handbook.

Human oversight must be assigned to people who genuinely have the necessary competence, training, and authority. The emphasis is on authority: a recruiter who doubts a score but isn't allowed to change anything isn't oversight, just decoration. Input data must be relevant and sufficiently representative, to the extent it's within your control. Operation must be monitored, and suspected incidents must be reported to the provider and to market surveillance authorities. Automatically generated logs must be retained for at least six months. Employees and their representatives must be informed before deployment. And the data protection impact assessment under Article 35 GDPR comes on top of all that.

Six months of logs. That sounds like IT operations. In reality, it's the body of evidence for the day someone asks why that application never reached a human being. And because the burden-of-proof rules of Germany's General Equal Treatment Act (AGG) run alongside recruiting anyway — anyone who presents indications of discrimination forces the employer to prove otherwise — a patchy log is especially uncomfortable there. Without a record, there's nothing to exonerate you.

"But Surely the Vendor Is Liable"

That hope is understandable, and it doesn't hold up in reality. In the US case Mobley v. Workday, the presiding court made clear in March 2026 that an employer can't escape liability simply by delegating classic employer functions to a third party. The case is proceeding as a collective action for applicants aged 40 and over; court filings mention roughly 1.1 billion applications rejected through the platform.

That's US law and doesn't translate one-to-one. But the underlying logic does: whoever outsources the selection decision doesn't outsource the responsibility for it along with it. German labor law shows the same mechanism elsewhere — the employer bears the organizational risk, and employees who operate a tool are largely protected by graduated employee liability. In cases of slight negligence, they aren't liable at all. Higher up, toward the management level, the air gets thinner.

The Gap the Numbers Reveal

How well prepared are companies for this? Moderately. A Red Hat survey conducted by Censuswide among 500 IT decision-makers in Europe (100 of them in Germany, May 2026) found only 30 percent with mature governance structures for agentic AI. 29 percent had rule sets with gaps, 27 percent had only the basics. Not even every second company had a complete overview of where its own data is processed.

The same gap shows up in HR. The Gallup HR Report Germany 2026 puts the figure at 81 percent of HR staff using AI tools in their daily work — while only four percent of professionals consider the workforce adequately prepared.

Usage: 81. Preparedness: 4. The liability problem lives between those two numbers.

Four Documents That Count When It Matters

Governance sounds like a project plan. In practice, it comes down to a manageable stack of paper you either have, or you don't.

The Selection Rationale

Why this tool and not another one? Which alternatives were considered, which criteria were applied, and what did the vendor disclose about training data and validation? One sentence in the procurement log isn't enough; two pages are more than enough. A short standard questionnaire to every vendor, answered in writing, helps: what was the model trained on, against which population was it validated, when was that last done, and what happens with a model update? Anyone who gets no answer to that already has a result — just an uncomfortable one.

The Approval Path

Who approved going live — by name, with a date? Who got a say, who had a veto? Under Section 87(1) No. 6 of the Works Constitution Act (BetrVG), the works council generally has co-determination rights over AI-supported systems; a works agreement isn't an obstacle, it's the best proof that a process actually exists.

The Review Log

How is the output checked, by whom, on what sample? For the board level, KPMG Law recommends saving prompts and results as PDFs. In recruiting, that translates into regular spot checks: how many automatically filtered-out profiles did a human review, and what came of it?

The Escalation Path

What happens when a recruiter believes a result is wrong? Who decides then, within what timeframe, with what documentation? Without a defined path back, there's no effective human oversight — just a human standing next to the system.

And in Switzerland?

The EU AI Act doesn't apply here directly — though it does apply to Swiss companies with applicants or subsidiaries in the EU. Separately, the liability of the board of directors under Article 754 of the Swiss Code of Obligations (OR) follows the same basic mechanics: duty of care, adequate information, and demonstrability. On top of that, Article 21 of the revised Data Protection Act (revDSG) triggers information and consultation duties for automated individual decisions with significant consequences. A fully automated rejection with no way to request human review is risky here too.

The Real Takeaway

The debate about AI in recruiting usually revolves around efficiency, sometimes bias, and occasionally deadlines. The liability question is quieter — and becomes relevant first anyway, because it doesn't come with a transition period.

It's also the only one still standing long after a tool has been replaced. Contracts expire, vendors vanish from the market, models get swapped out — the question of who signed off back then remains.

The good part: the effort involved is calculable. Four documents, one named owner, a working escalation path, logs you actually keep. That's not a digitization initiative — it's an afternoon with legal and a recurring slot in the calendar.

And it answers the question that gets asked when things go wrong — before it's even asked.

Sources

Transparency notice on the use of AI

In creating this article, tools based on artificial intelligence were used in a supporting capacity. They serve in particular for research and the structuring of information, for linguistic and grammatical revision, for translation, and in part for creating or editing illustrations and image material.

Concept, substantive statements, assessments and conclusions come from the author and reflect his personal thoughts, professional experience and convictions. All content is editorially reviewed and vouched for before publication.

Articles on this website are not created or published automatically by AI. AI is used as a supporting tool; responsibility for content and editorial decisions remains entirely with the author.