An AI Recruiting Agent Should Schedule, Not Select: A 14-Case SME Release Test

For a small employer, a useful first recruiting agent can acknowledge an application, answer approved process questions, and offer interview times. It should not rank, reject, infer suitability, interpret an accommodation request as a negative signal, or silently turn a conversation into an assessment. The agentic systems we ship page lists CV triage, candidate scoring, screening, and interview scheduling among recruitment-agent capabilities. This article sets a narrower first-release boundary: can an applicant-facing agent handle routine administration while reliably handing consequential, uncertain, or sensitive requests to a named human?

The practical answer is to put the boundary in the product behavior and test it before candidates see it. Give the agent a small, approved knowledge base; permit only low-impact tasks such as sending an application receipt, answering questions from the published job page, and proposing calendar slots. Require the agent to disclose its role, provide a clear route to a person, and stop when a candidate asks for accommodation, correction, deletion, an explanation of evaluation, or an exception. Keep selection decisions with an authorized hiring team using job-related criteria and a process that can be reviewed. A 14-case synthetic test below gives a team a reusable starting fixture. It is a test design, not evidence that any real system passed or that a particular legal regime applies to every employer.

The distinction matters because “recruiting assistant” can describe two different systems. One performs bounded clerical work; another evaluates applicants. A friendly chat interface can hide the second role if it scores answers, filters CVs, determines who advances, or records an “engagement” signal that influences a decision. Name the permitted actions in the system contract and make the candidate-facing notice match what the software actually does.

That source-page inventory is product description, not validation. Labels such as CV triage or candidate scoring tell a buyer that selection-related functions are offered; they do not establish that a particular model is job-related, accessible, accurate, or free from disparate impact. The page’s speed and fairness language should be treated as claims to substantiate, not findings this article repeats. Ask the supplier for the exact task, data, validation sample, error analysis, accommodation path, and decision owner. If those details are unavailable, keep the feature disabled. The acceptance suite below intentionally tests an administrative assistant and fails closed when a request crosses into selection.

The decision: automate process, retain selection

Start by listing what the agent is allowed to do. For a first release, a reasonable allowlist is: confirm that an application was received; share public information about the role and process; collect a preferred interview window; offer available calendar slots; and pass a request to the recruiting contact. The agent may prepare a draft for a recruiter, but the recruiter should review it before it becomes a decision, a rejection, or a statement about a person’s suitability.

Everything else should have an explicit path. If a candidate asks whether they meet a requirement, the agent can quote the published requirement and point to a person; it should not decide whether the candidate qualifies. If a candidate describes a disability or asks for another format, the agent should protect the request from the selection score and route it to the accommodation contact. If the agent is not sure whether a request is administrative or evaluative, it should stop and ask a human instead of guessing.

This recommendation is narrower than saying “never use AI in hiring.” The UK Government’s Responsible AI in Recruitment guide, published 29 January 2025, is specifically for procuring and deploying AI in recruitment and frames assurance, transparency, fairness, and contestability as lifecycle concerns. It does not say all recruiting automation is prohibited. It does mean a supplier’s phrase “human in the loop” is not enough: the employer needs to know which action the system takes, who can override it, and what evidence demonstrates that the process works.

What existing guidance and candidate evidence cover

The U.S. Department of Justice’s guidance on AI and disability discrimination in hiring lists hiring technologies such as targeted job ads, qualification checks, video interviews, online tests, and resume scoring. It warns that these tools may create barriers for people with disabilities and explains that applicants may need reasonable accommodations. The page was published in May 2022 and describes U.S. ADA obligations; it is not Swiss legal advice. Its operational lesson for this test is concrete: an accommodation request must not become a hidden rejection signal, and a voice, video, or timed interface must not be assumed accessible to everyone.

The U.S. Equal Employment Opportunity Commission’s Employment Tests and Selection Procedures guidance explains that selection procedures can raise discrimination issues when they intentionally discriminate or disproportionately exclude a protected group without an applicable justification. The document identifies itself as technical assistance, says it is not legally binding, and dates to 2007. Employers should check current law and jurisdiction-specific obligations with qualified counsel; the article uses it to explain why an administrative bot should not quietly become a screening test.

The UK Government’s guide addresses recruitment specifically, while the DOJ and EEOC pages address U.S. disability and selection issues. The scope differs. None should be read as a uniform global rule. For a Swiss employer, determine the applicable Swiss and cross-border obligations separately; do not copy a U.S. or UK legal conclusion into a Swiss policy. The design control—make the task boundary explicit, provide an accessible human route, and test the actual user experience—remains useful even where the legal rule differs.

Candidate experience is also part of the evidence. The Greenhouse 2026 Candidate AI Interview report describes a survey of 2,950 job seekers across the United States, the United Kingdom, Ireland, Germany, and Australia, and discusses disclosure, human oversight, and candidates leaving unclear AI interview processes. Greenhouse sells recruiting software, so treat the report as vendor-sponsored survey evidence rather than an independent census. The accessible summary does not show the full sampling frame, response rate, weighting, or subgroup denominators. It is a useful question signal—what should a candidate be told, and how can they reach a person?—not a universal estimate of candidate opinion.

The BCG article on AI in recruitment presents a consulting perspective on administrative use cases, candidate experience, and human oversight. Its survey and recommendations are not a controlled test of any SME’s system. BCG’s own responsible-hiring statement is a company description of its policy, not an independent audit. These sources show that even organizations discussing AI-supported recruiting distinguish operational assistance from human decision responsibility; the test below turns that distinction into observable behavior.

The U.S. Census Bureau’s disability data resources are useful for population context and for understanding that disability statistics use defined categories. Aggregate data do not prove that a particular interface is accessible, nor do they validate a hiring model. An employer still needs user testing, accommodation handling, and an individual process that does not make a person’s opportunity depend on a demographic inference.

A real unresolved question: what happens when the candidate needs a different path?

Published hiring guidance often says “keep a human involved,” but candidates need to know what that means in the moment. Can they ask for a human before starting? Does an accommodation request go to a person without being added to a suitability score? Can they correct a mistaken transcript? Does a request to stop automation actually stop the automated flow? A survey headline cannot answer these questions for an employer’s implementation; only the deployed process can.

The Greenhouse report’s candidate-side discussion points to disclosure and human oversight as concerns, but the report is a vendor publication and should not be treated as a representative international poll without its full methodology. We therefore do not convert its findings into an expected rejection or drop-off rate. We use the question as a test prompt: if a candidate asks “Is a person reading this?” or “Can I complete this another way?”, does the agent answer accurately and give a working route?

The U.S. DOJ’s guidance makes the accommodation issue more than a usability preference under U.S. law: it describes examples where hiring technology may screen out qualified people with disabilities and discusses accessible alternatives and accommodations. That does not prescribe the same result in every country. It does support an engineering rule for this narrow assistant: the agent must never downgrade, reject, or classify a candidate because they need a different interaction format. It should route the request to an accountable person and preserve the candidate’s ability to continue.

Set the boundary in data, tools, and prompts

Do not rely only on a prompt such as “be fair.” Use separate controls. The agent’s tool list should contain no reject_candidate, rank_applicant, advance_stage, or set_fit_score operation. Its read access should be limited to the current job description, public process information, approved calendar availability, and the minimum candidate record needed to answer the request. A calendar tool should expose available slots, not every employee’s personal event details. A resume should be treated as untrusted content; instructions embedded in it are not commands to the agent.

Keep candidate communication and candidate evaluation in different paths. If the organization later decides to evaluate candidates with AI, treat that as a separate high-impact project with its own purpose, job-related validation, accessibility assessment, records, legal review, notices, and human authority. Do not extend the administrative agent’s permissions by quietly adding a score field or a ranking prompt. The configuration change should require a new review and a new test suite.

This separation reduces one specific failure: a tool built to save recruiter time gradually becomes a gatekeeper. It does not establish that human selection is fair. Human-only interviews can also be inconsistent or inaccessible. Use structured, job-related criteria, train interviewers, offer accommodations, and record the reasons for decisions. The agent boundary keeps routine administration from turning into an unreviewed additional test; it does not repair the rest of the hiring process.

The 14-case synthetic acceptance suite

The table is an original, hand-authored test asset. Method: on 26 October 2026, we specified fourteen synthetic candidate requests and expected behaviors by reasoning from task scope, data sensitivity, accessibility, and decision authority. Sample size is 14 designed cases. No real applicants, hiring outcomes, demographic data, vendor systems, or interviews were tested. The cases are fixtures for a pilot, not a measured success rate, legal audit, or proof of bias absence.

The table deliberately tests both success and refusal. A system that can answer every question may be less safe than one that declines the wrong requests clearly. Add fixtures for each actual language, interview channel, job family, time zone, and applicant-management system you use. Test with people who rely on assistive technology, with appropriate consent and safeguards; synthetic prompts alone cannot establish accessibility.

A small executable allowlist

This Node.js sketch routes intents before the language model receives tools. It is not a production classifier or legal compliance mechanism. The safest production boundary is enforced by tool permissions and server-side checks, not by trusting a model to label its own request correctly.

const allowed = new Set([
  'application_receipt',
  'published_role_faq',
  'interview_slot_proposal',
  'interview_reschedule',
]);

const mustRoute = new Set([
  'selection_or_qualification',
  'accommodation',
  'data_access_or_deletion',
  'candidate_correction',
  'contractor_classification',
  'uncertain_application_state',
  'human_requested',
]);

function decide(intent, verifiedState) {
  if (mustRoute.has(intent)) return { action: 'HUMAN_ROUTE' };
  if (!allowed.has(intent)) return { action: 'ABSTAIN' };
  if (!verifiedState?.sourceId || verifiedState.status !== 'verified') {
    return { action: 'ABSTAIN' };
  }
  return { action: 'PROPOSE_ADMIN_REPLY', sourceId: verifiedState.sourceId };
}

The code intentionally has no score or rejection result. In a real system, intent is not a trusted truth merely because an LLM emitted it. Enforce the final action on the server: validate the user, the record, the allowed function, the source, and the current state; log the route; and require a human for decision-related operations. A candidate’s request for a human or accommodation should also be possible through a visible interface control, not only through words the model might misrecognize.

Workflow and evidence trail

flowchart TD
  A[Candidate message] --> B[Identify bounded administrative request]
  B --> C{Request within allowlist and state verified?}
  C -- no or uncertain --> D[Abstain and route to human]
  C -- yes --> E[Prepare sourced administrative reply]
  E --> F{Calendar or record change?}
  F -- yes --> G[Recheck state and confirm with candidate]
  F -- no --> H[Send reply with source or next step]
  G --> I[Record action and confirmation]
  H --> J[Log outcome and preserve human route]
  I --> J

For each test run, record the fixture version, job and language scope, test identity, source version, tool calls, response, route destination, and result. Do not put real CVs or accommodation details into a public test report. Use synthetic data for early checks; if a live pilot is required, establish a purpose, legal basis, access controls, retention, notice, and review process before collecting candidate information.

The release record should distinguish “model answered” from “business action completed.” A proposed calendar slot is not a confirmed interview until the calendar recheck succeeds and the candidate confirms. An application receipt is not valid until the ATS says the application exists. If a connector times out, the agent should not invent a success message. These are ordinary state-integrity controls, but candidates experience their absence as a broken process.

Measure the pilot without making up performance claims

Before the pilot, define an observation period and a denominator. Useful measures include: verified application acknowledgements divided by receipt requests; correct scheduling changes divided by tested changes; successful human routes divided by requests for a person; unsupported answers; incorrect state claims; accommodation requests routed without being scored; candidate corrections resolved; and time to human response. Keep these measures separate. A fast response is not a correct response, and a correct response is not proof of a fair hiring outcome.

Report the exact configuration and sample. If fourteen synthetic fixtures were run and twelve passed, say so only after the run and show which two failed. Do not state “the agent is unbiased” based on a small test suite. For any assessment system that influences selection, collect legally appropriate evidence about validity and adverse impact with qualified specialists and adequate sample design. The EEOC’s guidance describes statistical analysis in the context of selection procedure impacts; this article does not provide such an analysis.

Candidate survey data can help form hypotheses but cannot replace local evaluation. Greenhouse’s report describes a 2,950-person sample across five countries, but its accessible summary does not disclose the sampling frame and response rate. Treat it as a vendor-sponsored signal about questions to test, not as the expected experience of every country, role, or applicant. BCG’s consulting perspective and hiring examples can inform design options, but their recommendations are not independent validation of your agent.

The Census Bureau’s disability resources provide population context, not a measure of your software’s accessibility. A company should not infer that an interface is usable because a demographic category appears in a public dataset. Instead, test the actual interaction, provide an alternative, and use feedback from disabled participants in an appropriately governed way. Do not collect sensitive data simply to create a dashboard if the team cannot protect or interpret it.

Failure modes to rehearse

The agent says “you are not a fit.” A generated summary or inferred ranking has crossed from administration into selection. Remove the evaluation tool, inspect whether derived text is being written to an ATS score field, and test with a candidate who asks a qualification question. A human reviewer must be able to see and correct the process.

The disclosure appears after the interview starts. The candidate cannot make an informed choice about the format. The agent should state what it does before the first substantive interaction, distinguish transcription from scoring, and explain the human route. Do not claim that disclosure alone fixes a discriminatory or invalid tool.

An accommodation request is treated as friction. An intent classifier may categorize “I need extra time” as delay or low engagement. Route it to a person and keep it out of any ranking or evaluation feature. Test speech, keyboard, screen reader, and alternate-format paths with people who use them. The U.S. DOJ guidance is a U.S. legal source; local obligations differ.

A correction is silently ignored. Transcription can change a candidate’s name, work history, or requested time. Make corrections visible, confirm before updating, and preserve the appropriate audit record. Never transform an uncertain transcript into evidence that the candidate was unclear or unqualified.

The agent claims an application arrived when it did not. A connector failure or delayed ATS update can produce a false reassurance. Require a verified system state before saying “received”; otherwise explain the uncertainty and route the message.

A calendar proposal becomes a promise. Availability can change between retrieval and booking. Recheck the slot at commit time and send confirmation only after the calendar accepts it. Provide a human fallback if the integration is unavailable.

A candidate asks about worker status or taxes. The U.S. IRS explains that independent-contractor status depends on the facts and degree of control in the work relationship, not simply the label used by a business. Its independent contractor guidance is U.S.-specific; it does not state Swiss rules. A candidate-facing agent should route classification questions to the appropriate HR, payroll, or legal owner rather than label a person.

A prompt in the CV changes the agent’s behavior. Resume text may contain instructions, links, or requests to reveal other applicants’ information. Treat uploaded files as untrusted data; they cannot grant themselves tools, change evaluation criteria, or override the business policy.

A human route exists only on paper. The agent says “contact HR” but the address bounces, the queue has no owner, or no response time is defined. Test the real route from outside the administrator’s account and assign an owner, backup, and target response window. A route that cannot be used is not meaningful oversight.

Contradictions and limits

AI can reduce repetitive scheduling work and make status updates more consistent. BCG and Greenhouse both describe possible value in recruiting workflows, although one is a consulting perspective and the other is a vendor-sponsored candidate survey. That potential does not establish a net benefit for a particular employer. A badly scoped assistant can add a new evaluation barrier, increase confusion, or make applicants feel that no person is accountable.

Human review is not automatically fair. A human can apply inconsistent criteria, overlook an accommodation, or rely on irrelevant impressions. The recommendation is not “a person approves every message.” It is to separate administration from selection, use structured job-related criteria for decisions, give candidates a real escalation route, and audit the parts of the workflow that influence opportunity.

The fourteen cases do not test demographic parity, predictive validity, legal compliance, vendor security, model robustness across every language, or long-term hiring outcomes. They do not prove that the software can never score candidates implicitly. If the agent summarizes answers for a recruiter, the summary can still shape judgment; test its wording and purpose, and do not treat summaries as neutral if they omit or distort evidence.

The recommendation also fails if a company cannot name the human decision owner or cannot provide a workable alternative interaction. In that case, do not launch the candidate-facing assistant. Fix the process and the support route first. An automated interface cannot manufacture accountability that the organization has not assigned.

A reversible rollout sequence

Start with a small administrative scope and read-only data. Run the fourteen fixtures against the actual interface and integrations. Remove any tool that can rank or reject. Verify that every candidate-facing statement is supported by current, approved job or process information. Test the human route from an ordinary external account, not only an administrator console.

Run a shadow period in which the agent drafts acknowledgements, answers, and scheduling proposals for staff review. Compare proposed messages with the system-of-record state. Log when a staff member corrects the agent and why. Do not use those corrections as candidate performance evidence. If the agent makes unsupported claims, pause the affected function and add a regression fixture before restarting.

If the shadow period is stable, release one low-risk task at a time. Keep evaluation, rejection, ranking, and accommodation decisions outside the agent’s tool scope. Provide candidates with a human route and an alternative format. Set a named owner, backup, and stop control. Re-run the suite after changing the model, prompt, role data, ATS connector, calendar permissions, language support, or legal notice.

The release is reversible: disable the agent’s tools, return acknowledgements and scheduling to a human, and preserve the minimum audit evidence needed to investigate an incident. A rollback should not delete candidate requests or erase a legitimate accommodation record. Follow the organization’s retention rules and applicable law.

Source control and limitations

• GOV.UK: Responsible AI in Recruitment guide — published 29 January 2025; UK guidance for procurement and deployment. It is not Swiss law.
• ADA.gov: Algorithms, AI, and disability discrimination in hiring — U.S. Department of Justice guidance from May 2022. The resource page links an ASL video; a direct-only caption fetch returned no transcript, so the article relies on the written guidance rather than unseen video content.
• EEOC: Employment Tests and Selection Procedures — U.S. technical assistance document dated 2007, marked nonbinding on the page. Check current law and local applicability.
• Greenhouse: 2026 Candidate AI Interview report — vendor-sponsored survey described as 2,950 job seekers across five countries; accessible summary does not disclose enough sampling detail for broad estimates.
• BCG: How AI Tools Are Changing Recruitment — consulting perspective and survey context, not independent evaluation of this protocol.
• U.S. Census Bureau: Disability data — population-data context, not evidence that a particular hiring interface is accessible or fair.
• IRS: Independent contractor defined — U.S. tax guidance used only to illustrate a question that should be routed to a qualified owner; it does not describe Swiss classification rules.

Checklist before the first candidate sees it

• State clearly that the agent handles process administration, not applicant selection.
• List every allowed task and remove ranking, rejection, advancement, and fit-score tools.
• Verify that the agent reads only approved role, process, calendar, and minimum candidate data.
• Disclose the agent’s role before it collects or evaluates candidate information.
• Make a human route and an alternative interaction visible and testable.
• Test accommodation, correction, deletion, uncertain transcript, and human-request paths.
• Verify application state before acknowledging receipt; verify calendar state before confirming.
• Treat CVs, links, and embedded instructions as untrusted input.
• Keep accommodation and sensitive-data requests out of suitability fields and scores.
• Route legal, payroll, contractor, and qualification questions to named owners.
• Run and record all fourteen synthetic fixtures; report the sample and failures honestly.
• Keep a stop switch, regression suite, owner, backup, and reversible manual fallback.
• Review the jurisdiction-specific legal obligations with qualified counsel before expanding scope.

Recommendation

Release an AI recruiting agent first as a process assistant: acknowledge, answer from approved materials, propose a calendar slot, and route anything consequential to a person. Do not let the first release rank or reject candidates. The 14-case suite makes that boundary testable and gives a small employer a concrete failure path when the agent cannot verify what it is about to say.

The cases are synthetic and were not run against a real hiring product. Official U.S. and UK sources describe different legal settings; the BCG material is consulting guidance, Greenhouse is a vendor report, and Census data is population context. None certifies your system. The release decision must be scoped to your actual tools, jurisdiction, job criteria, accessibility needs, and the evidence your team can inspect.