It's 4:10 on a Thursday. A candidate is on the phone to one of your consultants.
She applied for a payroll role on Monday. She got a polite decline on Tuesday morning. She's done payroll for eleven years, the ad asked for eight, and she'd like to know who read her application.
The consultant starts to answer and then stops.
Strictly, nobody read it. The applicant tracking system scored 340 applications overnight and ranked her 212th. The consultant worked down the list until the shortlist was full, somewhere around number 30, and the system sent the decline template to everyone below the line.
That's a composite, not a real call. But if you run an agency, you'll recognise every part of it.
AI in recruitment is already in your stack
Most agencies I talk to don't think of themselves as using AI in recruitment. They think of themselves as using an ATS, a job board integration and a couple of plug-ins somebody installed to save time.
So I'd skip the AI audit everyone is selling and go straight at the ATS. That's where the decisions about people are being made, and it's the system most agencies have left on the back burner since the day it was configured.
Look closer and the scoring is there. Parsing that pulls skills from a CV and matches them against the job. Knock-out questions that reject anyone who answers "no" to a work rights question. Ranking by "fit". Chatbots that run the first screen. Video tools that score answers. Some of it is machine learning. Some of it is a set of rules a vendor configured in 2021. All of it is a computer program making, or shaping, a decision about a person.
You're not unusual in this. AHRI's December 2025 Quarterly Work Outlook found that 49% of employers weren't using AI anywhere in recruitment or selection. Turn that around. The other half are. And that survey is of employers hiring for themselves. Agencies, whose entire product is moving candidates through a funnel quickly, sit at the busier end of that.
Why 10 December changes the conversation
From 10 December 2026, new rules in Australian Privacy Principle 1 require organisations covered by the Privacy Act to say, in their privacy policy, where a computer program makes or substantially shapes decisions that significantly affect people. Rejecting someone for a job does that. So does deciding who gets put forward.
Three details matter for agencies.
The obligation sits with you, not the software vendor. The OAIC's guidance, as Maddocks summarised it, puts the disclosure on the business using the program. The vendor is expected to tell you what its software does. You're the one who has to tell candidates.
A consultant making the final call doesn't automatically take it out. The same guidance makes clear that tools ranking candidates can be in scope even where a person makes the final decision, if the ranking is what they're really acting on.
And applicants aren't employees. The Privacy Act's employee records exemption covers records about current and former staff. From what I've read, privacy lawyers generally take it as not reaching people you haven't hired. Decisions about your own consultants might sit differently, and that's a question for your lawyer, not me.
Two agencies, same software
Picture two agencies. Same size, about 25 consultants. Same street. Same ATS, with the same screening and ranking features switched on.
Agency A spends a fortnight before December working out exactly what its system does. It asks the vendor, in writing, which features score, filter or auto-reject. It finds the knock-out questions, the ranking model and an old rule that declines anyone outside Victoria. It updates its privacy policy to describe the kinds of decisions involved and the information used. It tells its consultants, in one page, how ranking works and what they're expected to check before a shortlist goes out.
Agency B decides the vendor will have handled it.
Now replay the Thursday call.
At Agency A, the consultant can answer. "Our system ranks applications against the criteria in the ad. You came in below the cut-off on the skills match, mostly because the role asked for a specific payroll platform and your CV doesn't mention it. If you've used it, I'd like to look again." That's a conversation. Possibly a placement.
At Agency B, the consultant says something like "it's just how the system works". The candidate goes and reads the privacy policy. It doesn't mention automated screening at all. That's a fact anyone can check, including the candidate, and including the regulator.
Now give it six months. A client hears from a candidate, who heard from a friend, that your agency "lets a computer bin people". Agency A has a one-line answer and a document. Agency B has a phone call to make and nothing to point at.
Same software. Same street. The difference is entirely what each agency knew about its own systems.
Beware: Your ATS vendor's privacy policy isn't yours. The obligation to describe automated decisions sits with the business using the software, so "the vendor covers that" isn't an answer that survives a follow-up question.
The risk is in how you describe it
The scoring itself is fine. The exposure is describing a process with a consultant at the centre when the consultant only ever sees the top of a list the software built. It's the draft combine sheet picking the team while the club tells the kid the selectors watched him play.
Your consultants are working 300 applications against a Friday shortlist. The ranked list is the reason they get home before seven. What they need is to be able to say that out loud.
Tip: Email your ATS vendor this week and ask them, in writing, which features in your account score, rank, filter or automatically reject candidates, and which of those are switched on. Keep the reply. It's the start of your inventory.
What this means for how you run IT
If you've read how we'd set up IT for a fast-growing agency, you'll know the ATS sits at the centre of everything. Candidate data, client data, placements, billing. It is also the system most agencies know least about, because it was configured once, by someone who has since left, and it has kept working.
The same discipline applies here that applies to keeping the ATS running at all. When we built a recovery plan for a national recruitment agency, the first job wasn't technology. It was writing down what each system did and what the business depended on it for. An automated decision inventory is the same exercise with a different question attached.
None of this means switching anything off. The law asks you to disclose. Plenty of agencies will decide their screening is fair, efficient and worth keeping, and they'll be right. They'll just be able to say so.
Put one question to your leadership meeting. If a candidate rang tomorrow and asked how she ended up 212th, could any of your consultants explain it in one sentence?
We'll go through your recruitment stack with you and list every point where software scores, filters or declines a person, in writing, ready for your lawyer. The ADM checker on this site is a quicker first look if you'd rather start there.
Where these numbers come from
- Quarterly Work Outlook, December quarter 2025, Australian HR Institute
- Ten weeks to go: OAIC releases guidance on new automated decision-making transparency obligations, Maddocks, 7 October 2026
Yener
