Your Recruiters Already Pasted Resumes Into ChatGPT. Here's How to Govern It Before Legal Does.

You get the email Tuesday afternoon. Your employment lawyer wants to schedule a call. A candidate filed a complaint: she was rejected in your hiring pipeline and wants to know why. Your head of recruiting pulls the file. The ATS shows a rejection. She can't explain the criteria. She remembers dropping the resume into Claude over the weekend, but has no screenshot, no notes on what the model evaluated, no record of what it flagged. The candidate's attorney is now asking for your AI screening documentation. You have none. That's when you realize: you've been running an undocumented algorithmic hiring system for six months.

This isn't theoretical risk. This is what's happening at 60% of mid-market companies right now. Your recruiting team isn't waiting for procurement to evaluate AI vendors. They're already using them. Your scheduling coordinator is drafting interview questions in ChatGPT. Your recruiter is pasting job descriptions into Claude to rewrite them. Your hiring managers are asking GPT to flag candidates who "look like your top performer." None of this went through legal. None of it has a data processing agreement. None of it has an audit trail.

The companies shipping recruiting AI fastest are the ones who got ahead of this. They're not banning the tools. They're not waiting for perfect vendor solutions. They're systematizing the tools that are already in use.

The Three Operational Gaps That Create Legal Exposure

Most HR leaders think they face a binary choice: deploy AI recruiting through an approved vendor (safe) or ban AI entirely (slow). Both are wrong. The real risk isn't "AI making hiring decisions." The real risk is three specific operational gaps:

• You have no visibility into which candidates were screened by human judgment and which by algorithm—which means you can't defend a hiring decision if challenged.
• Resumes and candidate data are moving into systems you don't have contracts with, creating compliance exposure.
• Every recruiter is using a different tool with different criteria, so your hiring outcomes are fragmented and you can't measure them or improve them.

The third gap is the one that kills you operationally. When your recruiting team is all using different AI tools, you have no way to measure whether your hiring is getting better, worse, or just faster. You have no way to audit for bias. You have no consistency. That's not just a compliance problem. That's a talent acquisition problem.

The Supervised AI Workflow: Four Components, Each With a Specific Role

The companies that solve this don't restrict AI. They systematize it. They move the shadow work into the light by answering a single question for each part of the hiring process: Where should AI assist and where should a human make the final call?

There's a specific model that works. Call it the Supervised AI Workflow. It has four components. Each one has a different risk profile, a different compliance requirement, and a different payoff.

Component One: Resume Screening Assist

Candidate applies. The system generates a match score against the job requirements. A recruiter reviews the score and makes the final yes/no decision. The AI surfaces patterns. The human excludes or advances. Every decision is logged.

A mid-market SaaS company in Austin runs this model with Ashby (their ATS) integrated with a screening layer. Candidates land in the ATS. The vendor AI generates four standardized fields: technical match (0–100), domain experience (match or no match), work history gaps (if any), red flags (if any). A recruiter sees these fields alongside the resume. The recruiter clicks advance or reject manually. The AI output is visible. The human decision is final.

The compliance story is clean: if asked "why didn't this candidate advance," you say "our recruiting team reviewed their qualifications and determined they didn't meet the requirements." You can show the resume, the AI assist data, the human decision, and the audit trail. You're not hiding the AI—you're using it as a tool that supports human judgment, not replace it.

Component Two: Scheduling and Coordination

Interview scheduling is a black hole for recruiter time. Coordinating calendars, sending reminders, collecting feedback templates. This is where AI reduces toil without touching hiring decisions.

The model is simple: AI handles logistics, humans handle all judgment calls. A candidate advances. The system (Calendly + Zapier + Claude API, or a unified platform like Greenhouse) drafts an interview invitation email, suggests three time slots based on interviewer availability, confirms logistics, sends a pre-interview reminder. No candidate is accepted or rejected via AI. No interview questions are generated without human review. The AI automates the calendar coordination. That's it.

A fintech in San Francisco freed up a recruiting coordinator's entire work block using this model. That coordinator was spending four hours a day on scheduling emails. The system now handles it. The coordinator spends that time on follow-up, relationship building, and making sure candidates actually show up. Better candidate experience. Less overhead. Zero algorithmic bias in hiring decisions.

Component Three: Structured Interview Feedback

Most companies don't have structured interview feedback. An interviewer talks to a candidate for 30 minutes and gives a subjective gut feeling: "Strong technical fit" or "Aligns with culture." That's where bias lives.

The AI intervention here isn't to make the hiring decision. It's to make the interview process consistent and documented. After each interview, the interviewer answers standardized questions in their ATS: Does the candidate meet requirement X? Does the candidate meet requirement Y? Do you have concerns about Z? The interviewer's answers are their judgment. Because the questions are standardized, every interviewer is evaluating the same dimensions for every candidate. That consistency is the bias reduction.

Platforms like Workable and iCIMS with structured feedback modules can auto-generate these question templates based on the job description. The AI creates the framework. The human provides judgment. The system records both. When you later review a hiring decision—internally or for compliance—you have a structured record of what multiple people observed, not a collection of gut feelings.

Component Four: Candidate Communication and Internal Status

Candidates often don't know where they stand. Internal coordination lives in five different spreadsheets. This is friction and opacity. AI can help here without risk if it stays in communications assist mode.

A recruiting team at a healthcare software company uses their ATS to auto-generate candidate status updates: "We've reviewed your application and would like to move to the next stage" or "We've decided to move forward with other candidates." These messages are templated and reviewed by a recruiter before sending. The recruiter can customize, but the template exists. The system also summarizes candidate status for internal stakeholders: stage reached, key feedback, next steps. All transparent, auditable, consistent.

Monday Morning: Your First 30 Days

You don't need to rebuild your entire recruiting function. You need to audit what's already happening, identify which gaps matter first, and assign ownership. Here's the sequence:

• Day 1-3: Audit. Ask your recruiting team directly: What AI tools are you using? What are you using them for? How do you document decisions? Write down everything. Don't judge it yet. You're mapping shadow work.
• Day 4-7: Identify gaps. Which tools touch hiring decisions? Which ones lack audit trails? Which ones process candidate data without a DPA? Which ones are creating fragmented outcomes? Rank them by compliance risk and operational impact.
• Day 8-14: Assign ownership. Pick one gap to fix first. Usually it's resume screening or feedback structure. Assign a recruiting ops person to own it. Give them a 2-week mandate to choose a tool or process that addresses one component of the Supervised AI Workflow.
• Day 15-30: Implement one component. If you're fixing resume screening: select an ATS vendor or ATS layer (Ashby, Greenhouse, Workable, or a screening vendor like Gem or Lever). Integrate it. Run 20 candidates through it. Document how the AI assist works, how recruiters interact with it, where the human makes the final call. Create the audit trail. Train your team on the new process.

After 30 days, you've systematized one component and documented what was previously invisible. You have an audit trail. You know what the AI is doing. You know where humans are making decisions. You've moved shadow work into the light.

Then you repeat for the next component. Scheduling and coordination next usually. Then structured feedback. The full Supervised AI Workflow takes 90 days, not a year, because you're not waiting for perfect vendor solutions. You're using what already works and adding guardrails.

The Strategic Insight: Governance Compounds

Here's what separates the companies shipping recruiting AI from the ones getting sued: they understand that speed and governance aren't opposed. Governance compounds.

Once you have structured interview feedback, you can measure what dimensions actually predict retention or performance. Once you have audit trails on screening decisions, you can identify where bias is actually showing up (not where it theoretically could). Once you have systematized communication, you can improve candidate experience at scale without increasing headcount.

The companies moving fastest through their hiring pipeline aren't the ones with the most AI tools. They're the ones with the most governance around the AI tools they've already deployed. They can explain every hiring decision. They have audit trails. They can measure and improve their own process.

Your recruiters have already pasted resumes into ChatGPT. You can't un-ring that bell. What you can do is bring it into a system where every decision is visible, every tool has a purpose, and every hiring outcome is defensible. That's not just compliance. That's competitive advantage.