Short answer
Automate the administration — leave, expenses, document generation, probation and certification reminders, the account-and-equipment chain behind a new hire. That is where the hours are, and none of it ranks a person. Treat anything that scores or sorts candidates as a separate category with its own rules: in the EU, CV-sorting software is named as a high-risk use of AI, with obligations that apply from 2 December 2027 after the AI Omnibus postponement (European Commission, read 5 August 2026). The workable design is to have the system structure applications rather than rank them, and keep the comparison human.
The boring half is where the time goes
Conversations about AI in HR go straight to hiring, because hiring is the interesting part. The time, however, is somewhere else entirely. In a company of 10 to 100 people, HR usually is not a department — it is a portion of somebody's week, and most of that portion is spent on the same handful of administrative loops.
Leave requests and the balance nobody can find. Expense claims that arrive as photographs. The employment document that gets rebuilt from the last one by hand. The probation date that passed three weeks ago. The certification that expired without anyone noticing. The new starter whose accounts were not ready on day one because four different people each had to do one thing.
All of it is frequent, rule-based and low-stakes in the sense that matters: a mistake is visible and reversible. That combination is exactly what makes a good first automation, for the reasons set out in deciding what to automate first. Very little of it needs a model at all — most of it is plumbing between systems you already pay for.
If you only do one thing: automate the chain behind a signed hire, end to end. It is the single process where an internal failure is visible to a new employee on their first day, and it is almost entirely deterministic.
The line: administration versus ranking people
There is a clean division inside HR automation and it is worth drawing before you build anything.
On one side, the system handles a decision that has already been made by a person: this hire happened, so generate the documents, create the accounts, enroll them in payroll, schedule the check-ins. The automation executes; it does not choose.
On the other side, the system produces an assessment of a person: a ranking of applicants, a score on a performance dimension, a flag on someone's behavior. Here the output is an opinion about a human being, and three things change at once — the failure is invisible (a good candidate silently filtered out generates no error), the harm is asymmetric, and the legal exposure is real.
This is the same rules-versus-judgment split that governs every automation project, described in the line between rules and judgment. HR is where it stops being a design consideration and becomes a compliance one.
What the regulation actually says, and when
It is worth getting the dates right, because a lot of what circulates on this subject is out of date — the timeline was amended after it was first published, and summaries written before the amendment are still in circulation.
The European Commission's own page on the regulatory framework for AI states that "The AI Act entered into force on 1 August 2024 and became applicable on 2 August 2026", with exceptions. Employment is one of them. The Commission lists among high-risk uses "AI tools for employment, management of workers and access to self-employment (e.g. CV-sorting software for recruitment)", and states that the rules for those high-risk areas — "[...] including biometrics, critical infrastructure, education, employment, migration, asylum and border control — will apply from 2 December 2027", having been extended as a result of the political agreement on the AI Omnibus proposal (European Commission, read 5 August 2026).
Three practical consequences for a company using or considering these tools.
- You have time, and it is not a reason to ignore it. Systems bought now will still be running in December 2027. Asking a vendor today how they handle documentation, human oversight and data quality costs nothing and tells you a great deal about whether they have thought about it.
- The postponement changed the date, not the classification. CV-sorting is still named as high-risk. Anyone telling you the category went away has read a headline rather than the text.
- Discrimination law never paused. Whatever obligations already applied to your hiring decisions apply identically when a tool makes them faster. A tool cannot hold a liability; you can.
All of the above is the EU position. Other jurisdictions have their own requirements on automated employment decisions, some already in force and some more demanding — this article makes no claim about them, and if you hire outside the EU that is a question to put to a local adviser once, and then encode in your process.
CV screening, and the version that is defensible
Screening is the most requested HR automation and the one we most often talk companies out of, in the form they ask for it.
The request is usually "rank these two hundred applications so we only read the top twenty". The problem is not that a model cannot produce that ranking — it will, instantly, and it will look reasonable. The problem is that the ranking encodes whatever pattern it was given. Prompt it with your past hires and it reproduces your past hiring, including the parts of it you would struggle to defend. Removing names and photos does not fix this, because the signal survives in the postcode, the institution, the career gap, the register of the writing.
And the failure mode is silent, which is what makes it worse than a wrong invoice. A strong candidate dropped at position 87 produces no error, no complaint and no log entry. Nobody ever finds out.
There is a version that works, and it is a genuinely useful one: have the system extract and structure, not score.
- Pull the same fields out of every application — years in a relevant role, specific tools used, languages, location and availability, whatever your criteria actually are — and present them in one comparable table. Reading twenty applications side by side in the same format is faster than reading two hundred in twenty different layouts, and no ranking has been produced.
- Apply only hard, stated filters mechanically, of the kind you would publish in the advert: a required certification, a legal right to work, a location constraint. A deterministic filter you could defend in a sentence is a different object from a model's opinion.
- Keep the rejection human and keep the record. If you cannot explain why an application did not progress, you are not ready to automate that step regardless of what the calendar says.
- Sample what the extraction produced against the original documents, the way you would sample any delegated judgment. Extraction is a judgment step and it is wrong occasionally and confidently.
Employee onboarding is an internal dependency problem
Onboarding a new employee looks like onboarding a client and behaves differently. With a client, the constraint is information you need from them, and the failure is a chase that annoys someone you just signed — the reason client onboarding gets measured on time to first value.
With an employee, almost nothing is blocked on the person. It is blocked on you: an account in four systems, a device ordered in time, access granted by someone on holiday, payroll enrollment before a cutoff date, a manager who has actually cleared their first morning. Each is small; the coordination is the whole difficulty, and it is deterministic — which makes it one of the highest-value, lowest-risk automations available to a company this size.
- Work backwards from day one. Every task gets a deadline derived from the start date, not from the date the contract was signed. Equipment with a two-week lead time is not a day-one task.
- Make the owner explicit and alert them, not a shared inbox. Onboarding fails at the step everyone assumed someone else had done.
- Automate the offboarding chain at the same time. It is the same list reversed, it is the one nobody builds, and it is the one with a security consequence — accounts that stay live after someone leaves.
HR data raises the cost of every mistake
One last thing that changes in this domain: the data. HR systems hold identity documents, home addresses, bank details, salary, sometimes health-related information. The same automation that would be unremarkable elsewhere carries a different consequence here when it goes wrong.
Three habits cover most of it, and none require a compliance project.
- Move references, not payloads. A workflow that passes an employee identifier between systems is a different risk object from one that copies a scanned passport into a third-party tool for convenience.
- Check where the processing happens before a document goes anywhere, and whether the vendor retains it. This is a one-time question per tool with a written answer, and it is much easier to ask before deployment than after an incident.
- Restrict who can see the run history. Logs are the part people forget: an execution history that shows salary values is a copy of the payroll data with weaker access control than the payroll system.
None of this makes HR automation hard. It makes it deliberate, which is the right posture for the one domain where the records are about the people you work with. The practical question of building and owning these workflows without a developer is covered in automation without developers.
Frequently asked questions
Is it legal to use AI to screen job applicants?
It depends entirely on where you operate, and the rules are tightening rather than settling. In the European Union, the AI Act names CV-sorting software for recruitment as a high-risk use, which brings obligations on transparency, human oversight, documentation and data quality. Those specific obligations were pushed back: as of the European Commission page read on 5 August 2026, the high-risk rules covering employment apply from 2 December 2027 rather than from the general application date of 2 August 2026. Other jurisdictions have their own requirements, some already in force, so check locally rather than assuming the EU timeline applies to you. What no timeline changes is the underlying discrimination law, which already applied to whatever method you used before.
What HR work is safest to automate first?
Anything administrative that does not rank a person: leave requests and balances, expense processing, document generation for a hire that has already been decided, reminders for probation dates and certification expiry, and the account and equipment setup that follows a signature. These are frequent, rule-based, and their failures are visible and cheap. In our experience running these engagements, that is also where most of the time actually goes in a company of 10 to 100 people — the HR work that hurts is rarely the interesting judgment, it is the twentieth time someone retypes the same details.
Can AI rank candidates fairly if we remove names and photos?
Removing obvious identifiers helps and does not solve the problem, because other fields carry the same signal — a postcode, a university, a career gap, the phrasing someone uses. A model trained or prompted on your past hiring decisions will reproduce the pattern of those decisions, including the parts you would not defend out loud. The safer design is to stop asking the system to rank at all: have it extract and structure what each application contains, so a human compares like with like, and keep the comparison human.
How is automating employee onboarding different from client onboarding?
The mechanics are similar and the stakes are inverted. A client watches your onboarding and judges whether they were right to sign; a new employee has already committed, and what they are judging is whether the company is organized. The concrete difference is that employee onboarding is dominated by internal dependencies — accounts, access, equipment, payroll enrollment, a manager who has to be free on day one — rather than by information you need from the person. Automate the internal chain and the reminders that keep it on schedule, and treat anything that touches pay or personal records as the sensitive data it is.
If you want the administrative half automated properly and the assessment half left alone deliberately, that is how we build HR workflows for companies your size. Book a call.
