Where does AI help in recruitment, and where is it risky?
AI for recruitment and candidate screening is genuinely strong at the reading: extracting structured information from hundreds of CVs, matching stated requirements against stated experience, drafting first-pass summaries, keeping candidates informed, and taking the note-writing out of a consultant's evening. It is risky the moment it starts deciding rather than reading, because a screening decision is a decision with legal consequences and the machine cannot carry them.
The line is worth holding precisely. Reading, summarising, structuring and surfacing are safe and valuable. Ranking, rejecting and scoring people are where the exposure lives.
What does the reading actually save?
It saves the hours that make consultants slow rather than the judgement that makes them good.
A consultancy handling a role with two hundred applicants spends most of the first week extracting the same eight facts from each CV in eight different formats. That is clerical work with a right answer. A machine does it consistently, in an afternoon, and presents every candidate in the same shape so that comparison is actually possible.
The same applies to the write-up burden. Interview notes turned into a client-ready summary, in your house format, drafted immediately rather than at nine that night. Consultants generally do not resent this being taken away.
Why is automated screening legally risky?
Because a screening rule that disadvantages a protected group is unlawful whether a person or a system applied it, and a system applies it at scale and leaves a record.
The mechanism is rarely deliberate. A model trained or prompted on your historical hiring will reproduce your historical patterns, including the ones you would not defend in writing. Proxies are the specific danger: postcode, school, employment gaps, name, years since graduation. None of those are protected attributes and all of them can stand in for one.
The Australian Human Rights Commission has published on AI in hiring and it is worth reading before anything is deployed. Your obligations under anti-discrimination law and under Fair Work do not change because a tool was involved, and "the system ranked them" is not a defence anyone should want to test.
What should the machine never do?
It should never reject a candidate, never produce a score that functions as a rejection, and never use an attribute you could not justify out loud.
The practical shape of a safe build: the machine reads and structures every application, surfaces evidence against the stated criteria with the source quoted, and flags where a requirement appears unmet. A human reads and decides. Nobody is filtered out before a person has looked.
That is more work than an automated shortlist, and it is the correct amount of work. If two hundred applications is unmanageable for a human even with the reading done, the real problem is a job advertisement that is not doing its job.
Human approval gates on anything consequential are a default in how we work, and screening is the clearest case for them we build against.
How do you keep it defensible?
Log everything, cite everything, and be able to explain any individual outcome afterwards.
Three controls do most of the work. Every summary the machine produces should quote the source line from the application, so a claim can be traced rather than trusted. Every action should be logged, so that six months later you can reconstruct exactly what happened for a specific candidate. And the criteria should be written down in advance and applied identically, which is a discipline that improves human screening too.
Then audit it. Periodically compare the machine's flags against the outcomes a consultant reached independently, and look specifically at whether the gap correlates with anything it should not. This is not exotic work, but it does have to be somebody's job.
Tell candidates, as well. If automated processing is part of your assessment, saying so plainly is both the decent thing and increasingly the expected one. Your privacy collection notice probably needs updating: the Australian Privacy Principles apply squarely to recruitment data, which is some of the most sensitive information a business holds.
What else in a consultancy is worth automating?
The candidate communication and the internal admin, both of which are pure loss when they slip and neither of which involves a decision about a person.
Candidates who never hear back are the reputational cost the whole industry carries. Acknowledgement, status updates and a proper close-out are entirely rule-shaped and get skipped only because everyone is busy. Automating them is low risk and disproportionately good for a consultancy's name.
Internally, the same logic applies to compliance document chasing, right-to-work checks reaching expiry, timesheet nudges and renewal flags. That is people-platform work rather than hiring judgement, and it is the kind of thing Maggie is built for. Work over your own documents and systems sits in agents on your data, which is scoped per pilot because every firm's document pile is different.
Where should a firm start?
Start with the reading and the communication, keep every decision human, and run a thirty-day measurement on time-to-shortlist rather than on volume.
That gives you a real result on the metric clients actually feel, without putting a single hiring decision through a system that cannot be held accountable. If it works, the case for going further is made with evidence. If it does not, you have lost a month and nobody has been unfairly assessed.
If you want to talk through where the line sits for your firm, start a conversation. It is a discussion we would rather have carefully than quickly.