Buying a recruitment AI tool is easy. Proving it works, treats candidates fairly, and will keep doing so next quarter is the hard part — and it is the part most organisations skip. Vendors demo polished dashboards and quote impressive accuracy figures, but a demo is not evidence. Validation is the discipline of generating that evidence, and it is what separates a defensible hiring system from a lawsuit waiting to happen.
This guide sets out the core validation activities every organisation should run before it lets an algorithm touch a candidate — and repeat for as long as the system stays in use.
Start With the Decision, Not the Model
Before you test anything, write down what the system actually decides. Does it screen CVs in or out? Rank candidates? Score a recorded interview? Recommend a shortlist a human then reviews? The answer determines both the legal weight of the tool and the tests it must pass. A system that auto-rejects applicants carries far more risk than one that merely reorders a list a recruiter reads in full.
Be precise about the outcome the model is predicting, too. "Good hire" is not a measurable target. "Passed probation", "rated 3+ by hiring manager at six months", or "still employed at twelve months" are. If the vendor cannot tell you exactly what outcome their model was trained to predict, you cannot validate it — and neither can they.
Validity: Does the Score Predict Anything Real?
Validity is the first question and the most often ignored. A recruitment tool is valid if its scores actually relate to job performance. This sounds obvious, yet many tools are validated only against whether they predict who *previous* recruiters hired — which measures how well the model imitates past human decisions, not whether those decisions were any good.
Ask the vendor for a criterion-validity study: evidence that higher scores correlate with better on-the-job outcomes, measured on real employees, in a role comparable to yours. Check the sample size, the date, and whether the study was done on a population resembling your candidate pool. A validity coefficient established on 200 software engineers in California tells you little about warehouse supervisors in Rotterdam.
Where no such study exists — the common case — you can build your own by scoring a cohort of recent hires and correlating those scores against their later performance reviews. It is not glamorous work, but it is the only thing that answers the question that matters: is this score measuring competence, or noise dressed up as insight?
Bias Testing: Look for Disparate Impact
A system can be accurate on average and still discriminate. Bias testing measures whether the tool produces systematically different outcomes for different groups. The most widely used yardstick is the four-fifths rule: if the selection rate for any protected group is less than 80% of the rate for the most-selected group, that is evidence of adverse impact requiring investigation.
Run the analysis across every dimension you can lawfully measure — gender, age bands, ethnicity where permitted — and do it on the tool's actual outputs, not the vendor's marketing claims. New York City's Local Law 144 now requires exactly this kind of independent bias audit, using impact ratios, before an automated employment decision tool can be used on candidates in the city. Even where you are not legally bound by that regime, its methodology is a sound template.
Two cautions. First, an aggregate pass can hide subgroup failure: a tool can look balanced on gender and on ethnicity separately while badly disadvantaging, say, older women specifically. Test intersections where your numbers allow. Second, bias testing is not one-and-done. A model retrained on new data, or fed a shifting applicant mix, can develop disparate impact it did not have at launch.
Probe the Inputs for Proxy Discrimination
Removing gender or ethnicity from the data does not remove bias, because other fields quietly stand in for them. Postcodes correlate with ethnicity. Certain sports, schools or career gaps correlate with gender or class. This is proxy discrimination, and it is exactly how Amazon's experimental CV tool learned to penalise the word "women's" and downgrade graduates of all-women's colleges despite never being told applicants' gender directly.
To probe for it, examine which features drive the model's scores and ask whether any could be a stand-in for a protected characteristic. If the vendor cannot or will not tell you which inputs matter most, treat that opacity as a finding in itself. A tool whose reasoning cannot be inspected cannot be defended when a rejected candidate — or a regulator — asks why.
Human Oversight That Is Real, Not Ritual
Regulators increasingly demand a human in the loop, and the EU AI Act makes meaningful human oversight a core obligation for high-risk recruitment systems. But oversight only counts if the human can actually change the outcome. A reviewer who rubber-stamps ninety-nine of every hundred algorithmic recommendations is not oversight; they are decoration.
Design the review so the human sees the candidate, not just the score — enough context to form an independent judgement — and record when they override the machine. If overrides never happen, your "human oversight" is a fiction, and you should assume a court or regulator will see it that way too.
Monitoring: Validation Has No Finish Line
The most dangerous assumption in recruitment AI is that a system validated at launch stays valid. It does not. Labour markets shift, applicant pools change, and models retrained on fresh data drift. A tool that was fair and predictive in January can quietly degrade by June.
Set up ongoing monitoring: track selection rates by group month over month, re-run adverse-impact analysis on a fixed schedule, and watch for changes in which candidates the system favours. Keep the logs — the EU AI Act expects records of high-risk system operation to be retained, and they are also your evidence if a decision is ever challenged. Define in advance what result triggers a pause and a re-audit, so a drifting model is caught by a threshold rather than by a lawsuit.
Turning Validation Into a Defensible File
Each of these activities produces evidence. Kept together — the validity study, the bias audit, the proxy analysis, the oversight records, the monitoring reports — they form a file that answers the two questions every organisation will eventually be asked: can you show this tool works, and can you show it treats people fairly? Organisations that can produce that file are in a fundamentally different position from those relying on a vendor's word.
Testing a recruitment AI system is not a one-off gate to clear before go-live. It is a continuous discipline, and it is the difference between using AI in hiring and being used by it.