The Legal Side of AI in Hiring with Paul Britton

This week's episode was originally broadcast in January 2025 during our Social Talent Live webinar. Visit socialtalent.com live to make sure you catch our next event.

Let's bring us on to our second guest. I'm really excited to introduce Paul Britton. So Paul is well known in the UK media, international media, for his legal opinions. I found Paul when he was talking about the impact of the EU AI act and particularly looking at hiring and Paul is an interesting and colorful guy who's a lawyer but you know, we forgive him for that. He's one of us, trust me. You're a normal person at heart, aren't you Paul? Solicitor, by the way, in the uk, isn't that correct?

Yes, a solicitor in, in England and Wales. I'm just, I'm just wondering how I'm going to make this segment interesting for everybody. I probably fall into that 57% where I don't have a clue about the EU AI Act. So I'm going to wing it and try and make it as interesting as I can.

Well, I might start with Paul. I was talking to a customer of ours, managing director of one of BCG's businesses in Boston, Consulting Group's business in Europe and they shared a story about a customer who came to them with 300 potential risks around the EU AI act and hiring in their organization. And when they actually put somebody on it who knew what they were talking about, they mitigated that down to zero. And the story got me thinking about there's a lot of misconceptions, a lot of non legal folks misinterpreting the act potentially of the different acts. I'm wondering if you might have some insight in what you think are some of the biggest misconceptions about the likes of the EU AI act and maybe that you might expand on that to explain what it is and what it isn't then.

Okay, well I mean look, the, the EU AI act, it came into force. The boring bit is it came into Force on 1 August 2024. The actual bit that we're talking about is when it's used in the hiring process or by recruiters and the app makes that particular activity fall into what they deem as a high risk category. But it's not going to be enforced until 2026 so they don't have to panic just yet. But having 300 risks and then getting it down to zero is quite common. I mean my clients that have. Because you have to remember the EU AI act, although it's applies in the eu, it's actually effective, it has a global reach. Because if you are going to recruit candidates from within the European Union, then you have to make sure that you comply with the Act. And it sets out kind of five really core principles and they're transparency, explainability, traceability, human interaction and getting the candidates consent. Then it moves on to the risk categories and as I said, you're in the high, or people using this AI to do this will fall into the high risk category. One of the things that you mentioned previously was sometimes candidates are able to use AI whilst they're being live interviewed. There is actually AI that can take the recording of that interview and analyze it and feedback if there were times where eye movement moved to certain places and give you a percentage of the chances that that candidate was using something like ChatGPT. But again, that would fall into the high category. One of the misconceptions that I've come across quite a few times is that it's only the company that has to deal with the transparency element, and that's not true. The vendor and the company. So if you're buying a piece of technology from a vendor, it's. They are responsible, but you're also responsible as well for a company if you're going to use it, if you're going to utilize it. I've had clients that have fallen into the trap where they currently use a piece of technology and the vendor has adopted and implemented or rolled out some sort of AI technology. And although the employer has been given an update saying, now we've got this fabulous piece of AI that's being used, they haven't said, they haven't really said to the company how they're going to make it explainable, how they're going to make it traceable, where the human interaction comes into place. So if you are using a piece of technology at the moment and it's being yielded up and upgraded and it's going to roll out an AI, piece of technology or feature, you should be being proactive. Reach out to the vendor and ask how it's going to satisfy those five core principles, because you don't want to be caught out by this. The penalties can be quite steep. They're up to, I think, 27 million euros or 7% of your global turnover. I mean, this is in the most punitive circumstances. If it's your first offense, you might just get a slap on the wrist and a warning, but if you're a repeat offender, or if the offense is big, is massive or big, that's a Donald Trump phrase. If it's big, then you may be punished significantly financially by the AI office.

It's interesting. I remember when GDPR came in and lots of people were like, oh, like they won't probably fine you. And then several years later, we see massive fines. Actually, they often come out of Ireland, where the Data Commission Data Privacy Commissioner sits. And they've been massive fines, particularly on the social media companies and so on and so forth. And you order hundreds of millions. So, you know, I would be less skeptical of it being a small thing. And I'd probably say, you know what, we'll end up having big fines over time when this really kicks in. Lots of our audience, by the way, Paul, I don't know whether they're joking or not. We're like, we didn't know there were AI laws. Some folks wondering, people wondering, is there any, Are there any in my country? Because again, we're talking about the EU AI act. And as you mentioned, it's not just companies in the eu, it's any organization in the world who might hire or consider an applicant from the eu, which is probably everybody. And then California and other states in the US have them. Somebody was asking about Canada and another audience member was sharing that. It seems like it's coming in Canada if it's not there already. So, so this is a big thing. We did ask, Jessica's asking, can we rec the five core principles? We will at the end, Jessica, for you, for sure, but actually it's not just about each principle, Paul, because I think, you know, when I had this conversation with you last week, you know, you explained to me that it's really the interaction of the five that is important. So can you maybe explain that how rather than just looking at the five principles on their own, and maybe for Jessica, we can recap on those five principles. Talk to me about how they interact and what's the best way to think about the five principles in a simpler way?

I mean, the principles are the core principles of this act. So when you're speaking to a lawyer about it, then they are going to come up again and again, just quickly in terms of other countries using it, the EU is well ahead. I know in England and Wales we're looking at it now. Legislation from the United Kingdom, we are behind. I think the United States are and Canada have ventilated a similar type of legislation. But as far as I know, it hasn't come about yet. It really is the EU that's leading the way on this. And one of the they are motivated to lead the way because it kind of sets a precedent for the rest of the world to say candidates from this jurisdiction are being looked after, cared for, and that we take artificial intelligence seriously. Any country that's can be criticized for not doing it can, it can impact on their economies. So that's one of the reasons that you are leading it in terms of transparency. The candidate must know that AI is being used. So you have to make sure you get a little disclaimer or privacy notice pop up. Just like when we use websites in England, we have a little thing saying the cookies are being used and you have to accept or reject. They're going to have to be told and you want them to interact and say that they understand that it's being used. And in the back end of the vendor software, you want to make sure that there's a backend record of that so that the candidate has, has, has certified that they're okay to continue. Explainability. If a candidate asks you to explain the decision making process of the AI of the artificial intelligence element, you have got to be able to set out to that candidate exactly how it came to that decision. And not in some hoity toity, convoluted, technologically advanced way. It has got to be in simple terms for the candidate to understand how it reached that conclusion. Otherwise you could face a fine. The traceability principle is that as a company, as a vendor, a vendor that's developing this type of technology should be able to say to a company, look, this is all the bells and whistles, this is what it does, this is the audit trail. This is how you can trace every single function. This is how you can trace the decision making process so that if a candidate ever says, I want to see your audit trail of how it came to this conclusion, you can just quickly send it. Because what you don't want to do is be subject to like a subject access request in the UK where someone asks all the details about their application or whatever and you're running through all your files trying to build up a bundle to send to them to satisfy them. You really want to go just click a few buttons and it produces that bundle and it can send it to the candidates requesting that. The fourth core principle is that there's a human element. So if the AI has rejected the candidate, it doesn't mean that no human being is now going to have to check. A human being has to log into the system. And it might be simple as seeing 100 rejected candidates and maybe clicking a button that ticks them all and then you send out the rejection. The human being has to do that function. There has to be human oversight and candidate consent. It has to be, they have to express their consent. So it would be very sensible to doubly opt in. That is they tick a box and then they sign would be great. And click accept. And then you've got a nice record in the back end to say that they almost triple entered, they ticked, they signed and then click the button to proceed. And then you might want another one saying you've agreed that AI is going to be used in this process and now you'll be taken onto whatever the process is. If you can satisfy those, you'll avoid a firing.

So Tom in a previous chat had talked about obviously a race at which candidates were not accepting AI. So again, you know, demonstrate that they're for that consent. They're making it clear what's happening. Certain number of people opt out, lots of people in the chat talking about their opt out rates and they don't like AI being used in the chats. When the candidate brings it on, the candidates obviously have that right. And again that transparency piece reminds me of reasonable accommodations. Right? So RAs in a hiring process is something that of us should be familiar with in most parts of the world where for various protected characteristics we're meant to have these reasonable accommodations and we're meant to have opt ins and alternative routes for people to take if they, you know, they don't want to go through the traditional route. So it's, it's, it strikes me as it's less of something to see as a negative, but maybe more more of a positive that this perhaps enforces, if you like, a better, more human centric hiring process. Is that the way you see it or how would you frame it? Paul?

Yes. So although let's talk about something more positive. Candidates have been successful and now you want the AI to schedule their meeting. And if it's face to face accommodation or reasonable adjustments, it's probably sensible that a human takes over that area. I mean if a candidate has said that they have special requirements, I probably at this time would not trust the AI to interpret them. And to meet those requirements, it's probably best that that is filtered over to a human being to say, okay, right, we have got a candidate that has this reasonable adjustment that must be made. What do we do? What is our policy to facilitate that interview?

I have a question here by the way, just interesting one from Manny. If a candidate joined an online interview and we can see that an AI tool has started. Can you ask them to remove the funct?

I would think this is, this is reversing it. So I'm talking about how companies and vendors will comply. But if you catch a candidate, I mean, what you might want to do is ask candidates to certify that they are not using any AI their end. And if you detect that they are, you're, I mean you're going to have to call it out and say, well look, we've identified this, you did certify that you wouldn't be using any. We'll give you the benefit of the doubt, you can switch it off and we'll carry on or I'm sorry, we're just going to terminate. I remember reading quite some time ago in forbes that on CVs, this is before the advent of AI, over 70% of candidates would lie in their CVs anyway. So I don't think we should think that candidates aren't prepared to mislead in the best case scenario or in the worst case be dishonest about what they're doing. Well, their credentials in a cv, but then also whether or not they're deploying their end, some sort of AI technology. I have to say, if you catch them out, it's a really bad way to start the relationship with a future employer. I mean, surely, I mean, if you're going to say we don't want to use, we don't want you to use any AI technology, you might want to flag up a warning to say if it's detected, you would automatically be removed from the process just to impress upon the candidate how serious it, how serious you take it as an organization that someone might, might use that technology to better their chances of getting a job in your company.

We have tons of advice in the chat by the way, from our audience. Liam has a bunch of pieces of advice. I think this one is the one I like the most. Always assume the candidate is recording things in the phone while interviewing via laptop. It may not be AI, don't forget people could just record on their phone. They have been able to do so for absolutely years and it probably drives a more fair process. Like what are you saying that you're concerned about people recording in the first place? If you're doing a good interview, if you are following a good thorough hiring process, you should have nothing to hide. Anyway, we're going to chat with Ali about that best practice and maybe more transparency on the hiring site. Paul though, if folks want to reach out to you to understand a bit more about this impact and how your firm can help. What's the best way to reach you?

They can reach us on the website, which is just Britain Time dot com. So there's no and it's Britain Time dot com and they can reach me on LinkedIn if they type Paul, Britain. Or just give us a Google and find us. There was one point I just wanted to say about recording in England and Wales. It's okay for candidates to record their employer, but the law doesn't support employers recording their candidates surreptitiously. So they can record you surreptitiously, but you're not allowed to record them in England and Wales without telling them.

Very interesting. For me, I'm getting from this that I need to be on ChatGPT, asking ChatGPT or I need to know the legalities of AI in hiring and the different jurisdictions I'm hiring in. I think the requirement for recruiters just went up. We need to know our stuff a little bit better than we. We seem to, certainly, according to the chat. Paul.

Yeah.

Paul, it's been a pleasure. Thank you so much for joining us. I know you're a busy man. A pleasure to have you here today and hopefully we'll have you rejoin us. You're going to be our new legal expert for all of these different shows, Paul, so take that role.

Thanks for joining us. Yeah, I'm prepared to take that role. Okay.