Security, Compliance, and Governance in AI Hiring Tools

When procurement teams, legal departments, and IT reviewers evaluate an AI hiring tool, they need to assess each one separately, because the risks are different.

Think of it this way. Compliance asks whether the AI tool meets regulatory requirements. Security asks whether candidate data is protected. Governance asks whether a human can intervene, explain, and be held accountable when something goes wrong. Mixing them up is like asking your plumber to check your wiring. Both involve your house, but the skill sets are very different.

Conflating them leads to surface-level vendor evaluations. Separating them leads to better buying decisions, and fewer surprises when a regulator, candidate, or client asks hard questions.

This post breaks down all three, explains what matters in each, and points to where Carv documents its approach in detail through its Trust Center. For teams earlier in their AI evaluation journey, our framework for implementing AI in recruitment covers the broader adoption picture.

Compliance: The regulatory landscape for AI hiring

AI in hiring is increasingly regulated, and the rules are moving fast. If you’re deploying AI in recruitment, these are the regulations your legal team needs to have on its radar right now.

NYC Local Law 144 and Automated Employment Decision Tools

New York City’s Local Law 144 of 2021 regulates automated employment decision tools (AEDTs) and was the first U.S. law to mandate independent bias audits of them. It applies to any employer or employment agency using an AEDT to screen candidates or evaluate employees for roles tied to a New York City office.

The law has three core obligations.

Independent bias audit: Before using an AEDT, and at least annually after that, employers must have an independent third party conduct an AI bias audit that calculates selection rates and impact ratios across protected categories, including race, ethnicity, and sex.

Public disclosure: A summary of the most recent bias audit, including the audit date and a description of the source data, must be posted on the employer’s website.

Candidate notification: Employers must notify candidates at least 10 business days before using an AEDT in their evaluation, including information about what data the tool collects and analyzes.

The important nuance is that compliance responsibility sits with the employer, not the vendor. But the vendor’s architecture determines whether compliance is even possible. If the tool can’t produce auditable outputs, the employer can’t meet audit requirements, regardless of intent.

GDPR Article 22

For any organization hiring in the EU, GDPR Article 22 gives candidates the right not to be subject to decisions based solely on automated processing. In practice, this means candidates can request human intervention, express their point of view, and contest decisions made by AI systems.

This has real implications for how AI hiring tools are designed. Tools that make autonomous pass/fail decisions without a human review step create GDPR exposure. Tools that recommend and surface candidates for a human to decide on operate on safer ground.

Carv’s approach to GDPR compliance is documented at compliance.carv.com/gdpr.

EU AI Act

The EU AI Act (Regulation (EU) 2024/1689) classifies AI systems used in employment, worker management, and access to self-employment as “high-risk.” AI hiring tools used in the EU must therefore meet specific requirements around risk management, data governance, transparency, human oversight, accuracy, and cybersecurity.

For providers, high-risk classification means risk management systems, conformity assessments, technical documentation, and post-market monitoring. Deployers (the employers using the tool) take on their own obligations, including human oversight, monitoring, record-keeping, and informing candidates, and some deployers must also carry out a fundamental rights impact assessment. Application dates for the high-risk obligations have been subject to proposed delays, so confirm current timelines with counsel. Either way, organizations deploying AI hiring tools in the EU need to know whether their vendor’s system meets these requirements or whether they’re inheriting compliance gaps.

For a deeper breakdown of what the regulation means for recruitment teams specifically, see The EU AI Act and Its Impact on Recruitment. Carv’s EU AI Act documentation is available at compliance.carv.com/euaiact.

CCPA

The California Consumer Privacy Act gives California residents rights over their personal information, including the right to know what data is collected, the right to delete it, and the right to opt out of its sale. For AI hiring tools processing California candidate data, that means clear disclosure of data collection practices and honoring candidate data requests.

Carv’s CCPA documentation is available at compliance.carv.com/ca-ccpa.

The bigger picture

These regulations don’t exist in isolation, and more are coming. New Jersey has proposed legislation similar to NYC’s Local Law 144. Illinois, Maryland, and Colorado have enacted or proposed AI-related employment laws. The trend line is unmistakable. Waiting until regulations hit your jurisdiction to figure out compliance is like studying for the exam after the bell rings.

For a full view of Carv’s regulatory compliance across all applicable frameworks, visit the Carv Trust Center.

Security: The technical fundamentals

Regulatory compliance and data privacy tell you the vendor follows the rules. Security tells you whether your candidate data is actually safe.

When procurement and IT teams evaluate AI hiring tools, they’re looking for specifics: where data is stored, who can access it, how it’s encrypted, and what certifications back up the vendor’s claims.

Data protection and encryption

At minimum, candidate data should be encrypted both in transit and at rest. But “we encrypt your data” has become the vendor equivalent of “we value your privacy.” It sounds reassuring without telling you much. The questions worth asking go deeper: what encryption standards are used, whether data is encrypted at the field level or only at the storage level, and what happens to data when it’s processed by AI models.

Carv’s data protection practices are documented at compliance.carv.com/security/data-protection.

Access control

Who inside the vendor’s organization, and who inside yours, can see candidate data? Access control covers role-based permissions, authentication requirements, audit logging of data access, and separation between customer environments.

Strong access control means a recruiter sees only the candidates assigned to their roles, a hiring manager sees only their open positions, and a vendor engineer can’t browse candidate records without explicit authorization and an audit trail.

Carv’s access control documentation is at compliance.carv.com/security/access-control.

Certifications

Third-party certifications are the fastest way to verify that a vendor’s security claims have been independently validated. Carv holds ISO 27001 (information security management) and SOC 2 Type II (trust service criteria for security, availability, and confidentiality). ISO 27701 (privacy information management) is in progress.

Full certification details are available at compliance.carv.com/security/certifications.

Infrastructure security

Where the system is hosted matters, both for performance and for regulatory compliance. Data residency requirements vary by jurisdiction, and organizations hiring in the EU often need assurance that candidate data stays within the European Economic Area.

Carv’s infrastructure is hosted on Google Cloud Platform within the EEA. Infrastructure details are documented at compliance.carv.com/security/infrastructure.

For the full picture of Carv’s security posture and technical safeguards, see the security section of the Trust Center.

Governance: The human oversight layer in AI-assisted hiring

This is where most AI hiring tool evaluations get thin. Compliance and security are relatively easy to assess. Certifications exist, regulations have checklists, and encryption is either there or it isn’t.

Governance is messier. It answers the question that keeps legal teams up at night: when something goes wrong, who’s accountable, and can we explain what happened? There’s no certificate you can point to that says “we have good governance.” It’s baked into architecture, process, and culture.

Human-in-the-loop review

The EU AI Act requires meaningful human oversight of high-risk AI systems, and GDPR Article 22 gives candidates the right to human intervention in automated decisions. “Meaningful” is the key word. A rubber-stamp review, where a recruiter clicks “approve” on every AI recommendation without actually evaluating it, doesn’t meet the standard.

Genuine human-in-the-loop means recruiters can review, override, and contextualize AI outputs before hiring decisions are made. The AI surfaces recommendations and handles execution. Humans make decisions. Carv’s Scoring Agent, for example, ranks candidates against defined competencies but explicitly leaves the hiring decision to the recruiter.

Audit trails and explainability

When a candidate asks why they were screened out, or a client challenges a hiring decision, you need to reconstruct what happened. That requires audit trails: a documented record of what data the AI processed, what logic it applied, and what output it produced.

Explainability goes further. It means the AI’s decision-making process can be described in terms a non-technical person can understand. “The candidate was flagged because they didn’t meet the minimum availability requirements for the night shift” is explainable. “The model assigned a score of 0.43 based on feature vector analysis” is not. For an example of how this works in practice, see how Carv’s agents log handover reasoning and decision audit trails in BPO hiring. And for how screening design itself affects fairness, see our comparison of AI-driven and traditional pre-screening.

Accountability between vendor and employer

Here’s a question most vendor evaluations skip: when a hiring decision is challenged, who’s responsible?

Under most regulatory frameworks, the employer (or deployer) bears primary compliance responsibility. But the vendor’s system architecture determines whether the employer can actually meet those obligations. If the AI produces unexplainable outputs, the employer inherits that opacity. If the system lacks audit trails, the employer can’t demonstrate compliance even if they want to.

Smart buyers negotiate this upfront. Vendor agreements should clearly define data processing roles, incident response responsibilities, and who provides what documentation when regulators come calling.

Carv’s governance controls are documented at compliance.carv.com/security/governance, with AI-specific model governance at compliance.carv.com/ai.

The questions every AI hiring vendor should be ready to answer

Compliance pages, security certifications, and governance frameworks look reassuring on a vendor’s website. But a polished Trust Center and a trustworthy product aren’t always the same thing. The real test is whether those commitments hold up when your legal and procurement teams start pulling threads.

Whether you’re evaluating Carv or any other vendor, these are the questions your procurement and legal teams should be asking.

Is there an independent AI bias audit, and can we see the results?

NYC Local Law 144 requires annual independent audits for covered tools. Even if your organization isn’t subject to LL144, a vendor that proactively conducts and publishes bias audits holds itself to a higher standard of accountability. This tells you whether the vendor treats fairness as a checkbox or a practice.

You can also ask:

• Who conducts the audit?
• How are impact ratios calculated?
• What actions does the vendor take when results flag potential disparities?

Where is candidate data stored, and under which jurisdiction?

Data residency affects which regulations apply. If candidate data is processed or stored outside the EEA, GDPR transfer requirements come into play. This tells you whether you’re inheriting cross-border compliance obligations you didn’t plan for.

You can also ask:

• Which cloud provider and region?
• Can data residency be contractually guaranteed?
• Are there any sub-processors in different jurisdictions?

Who can access candidate data inside the vendor and inside our organization?

Look for role-based access control, multi-factor authentication, and audit logging of every data access event. This tells you whether the vendor has granular control over data exposure or a flat access model where too many people can see too much.

You can also ask:

• Can vendor engineers access our candidate data?
• Under what circumstances, and is that access logged and time-limited?
• What role-based permissions are available for our team?

What happens when a candidate disputes a decision?

Can the system reconstruct why a candidate was screened in or out? Is there an audit trail? Can the explanation be given in plain language? If the answer is “we’d need to check,” the vendor built explainability as an afterthought rather than into the architecture.

You can also ask:

• What’s the average turnaround time for producing an explanation?
• Has a candidate or regulator ever requested one, and how was it handled?
• Are audit trails retained, and for how long?

Is there a human review step before hiring decisions are made?

AI that recommends is different from AI that decides. Understand where the human checkpoint sits in the workflow. This tells you whether the vendor’s architecture supports real human oversight or just creates the appearance of it.

You can also ask:

• Can the human review step be bypassed?
• What percentage of decisions are actually reviewed by a person?
• How is the override process documented?

What certifications does the vendor hold, and when were they last audited?

ISO 27001, SOC 2 Type II, and ISO 27701 are the most relevant for AI hiring tools. Ask for dates: a certification from three years ago without a re-audit is a red flag. This tells you whether security and privacy practices are independently validated or self-reported.

You can also ask:

• Are audit reports available for review under NDA?
• Is the vendor pursuing any additional certifications?
• What’s the re-audit schedule?

How are AI models trained, and on what data?

Find out whether the vendor’s models are trained on your candidate data, industry-wide data, or synthetic data. This tells you whether your candidate data is being used to improve a product that benefits competitors, and how the vendor manages training data governance.

You can also ask:

• What are the data retention policies for training data?
• Can we opt out of having our data used for model improvement?
• How is training data anonymized?

What’s the incident response process?

When a data breach or system failure occurs, what’s the notification timeline? Who’s responsible for what? This tells you whether the vendor has a tested playbook for when things go wrong or will be figuring it out in real time alongside you.

You can also ask:

• Is there a documented incident response plan we can review?
• What’s the contractual notification window?
• Has the vendor experienced a breach, and how was it handled?

How Carv approaches AI hiring compliance, security, and governance

Every claim in this post, and every claim any AI hiring vendor makes, should be independently verifiable. That’s the point of a Trust Center.

Carv’s Trust Center is the single destination for your legal, procurement, and IT teams to verify our compliance documentation, security certifications, AI governance framework, and regulatory coverage, including GDPR, the EU AI Act, NYC Local Law 144, CCPA, and SOC 2 Type II audit reports.

Carv holds ISO 27001 and SOC 2 Type II certifications, hosts all data on Google Cloud Platform within the EEA, and logs the reasoning behind AI-assisted decisions and handovers so they can be audited. Compliance and security agents run alongside recruitment agents to flag potential bias and keep every interaction within regulatory guardrails.

If you’re evaluating AI recruitment tools and want to see how Carv handles compliance, security, and governance alongside the product itself, book a demo and bring your legal team. We’d rather answer hard questions early than easy ones later.