Assessment design
What You May Collect and Keep From a Candidate's AI Session
Decide what you'll capture from a candidate's AI session while you design the assessment, not afterwards. Capture the narrowest artefact that answers your question, which is usually the prompt-and-revision trail rather than a full screen recording. Tell the candidate before they start what is captured, who reads it, how long it is kept and whether any vendor trains on it. Then file it on the same retention schedule as the rest of the hiring record, because it is part of that record.
The takeQuietly deleting the transcript once the hire is made is the most common wrong answer here, and it is wrong under the rule that matters most. A California employer covered by the state's fair-employment law has sat, since October 2025, under a four-year retention period for employment records that expressly includes automated-decision-system data. Deletion that happens because a reviewer cleared out an inbox is not a retention decision, it is the absence of one, and from the outside it is indistinguishable from destroying evidence. Set the schedule once and let it run without anyone's judgment.
Where Olive fits
Open a role and see what the work shows
Building this in-house, the expensive parts are the answer key and the evidence trail rather than the exercise. Olive supplies twelve authored item banks, each grounded in one occupation, and returns six separately evidenced findings anchored to moments in the session, with the identical report going to the candidate at no cost.
Rank your shortlistWho owns a candidate's prompt log?
Not you, or at least not you alone. A chat transcript, a prompt history and a screen recording feel like work product because your exercise produced them, but every one of them is personal data generated by the candidate, and the candidate holds rights over it that do not depend on your view of who created it.
California is the clearest statement of that. Its consumer privacy law defines a consumer as any natural person who is a state resident, with no carve-out for job applicants, and its definition of personal information expressly includes professional or employment-related information 2. For an employer big enough to sit under the state's privacy law, an applicant asking what you hold is exercising a right, not making a request you may weigh on the merits.
This is the assumption that quietly breaks assessment designs. A team that thinks of the transcript as its own file stores it wherever the reviewer put it, shares it with whoever asks, keeps it for as long as nobody deletes it, and never writes down what it is for. Each of those is defensible when the file is a scorecard the company authored. None is defensible when the file is a record of somebody else's work, produced under an instruction you gave.
The reframe costs nothing and fixes most of the downstream questions. Treat the session artefact as the candidate's material that you are holding for a stated purpose, for a stated period, with a stated audience. What to actually look for once you hold it is a separate skill: what to read in a candidate's AI chat log.
What should you capture, and what should you leave alone?
The prompt-and-revision trail, and almost nothing else. It shows how the candidate framed the problem, what they asked for, what came back, what they kept and what they threw out, which is the entire question most AI work samples are trying to answer. It is text, it is small, it is reviewable in minutes, and it drags no additional regime in behind it.
Each wider option costs more than it returns:
- Full screen recording captures the assessment plus whatever else is on the screen, and it turns the exercise into a recorded session with its own consent duties. If you want it anyway, the terms and the retention limits are worked through in what to tell candidates before recording their screen.
- Keystroke or activity capture is monitoring. It answers a question about presence rather than about judgment, and it changes what the candidate believes the exercise is measuring.
- Camera or webcam capture reaches for a biometric regime that a text exercise never needed, and adds a written-release problem on top of a consent problem 5.
- Timing telemetry looks harmless and usually is, but speed is a poor proxy for quality and a bad thing to be caught having stored an opinion about.
One honest counter-argument remains. A trail alone cannot tell you whether a second person was in the room, and some teams record the screen for exactly that. That is a real trade rather than a mistake, but make it deliberately: the capture is wider, the disclosure is longer, the retention question is harder, and the exercise now has to be worth all three.
How do the retention duty and the deletion right fit together?
They fit better than they look, because the statute anticipated the collision. California's employment regulations, amended effective October 1, 2025, extended the employment-records retention period for covered employers from two years to four and said expressly that automated-decision-system data is included 16. The state's privacy law gives a consumer the right to ask a business to delete personal information it collected from them 3. On the face of it those point in opposite directions.
The resolution is written into the deletion right itself. A business may decline a deletion request where retaining the information is reasonably necessary to comply with a legal obligation 3, and a four-year records-retention rule is exactly such an obligation. So the answer to a candidate asking for deletion of an assessment file is usually that it is retained for a defined period under a records rule, then destroyed, and that they are being told which.
That answer only works if the period exists. An employer who cannot name the retention period, or whose real practice is that files sit in a reviewer's inbox until somebody tidies up, has no legal obligation to point at and no schedule to describe. The exception protects a policy, not a habit.
Deletion duties do run the other way in specific places, which is why the schedule has to be per-artefact rather than per-company. Illinois requires an employer using AI to analyse recorded video interviews to destroy the video within 30 days of an applicant's request, and to instruct everyone who received a copy to delete their backups too 4. A single company can therefore owe four-year retention on one artefact and thirty-day destruction on another. Write both into the same schedule.
Decide these three things before the first candidate takes it
Scope, disclosure and destination. Each is a sentence, all three are cheaper to write now than to reconstruct under a subject access request, and none of them requires a lawyer to draft, only to review. Put the answers in the assessment brief itself so the person running the exercise cannot quietly widen any of them.
Scope. Name the artefact: the prompt-and-revision trail, the submitted work, and the written debrief. Say what is not captured, in the same breath, because a candidate who does not know what is off the record behaves as though everything is on it.
Disclosure. Four facts, before the candidate starts, in the invitation rather than in a terms page: what is captured, who reads it, how long it is kept, and whether any vendor trains on it. In an all-party consent state, if you are recording anything beyond text, this has to be an affirmative yes rather than a notice. That distinction is the whole of consent rules for recording an interview, and it applies to assessments for the same reason.
Destination. The file goes into the hiring record with the scorecards, under the retention schedule, with access limited to the people evaluating that requisition. Not a shared drive, not a reviewer's downloads folder, not the vendor's account as the only copy. Then note in the candidate's file that the disclosure was given and when, which is the same discipline the notice duties elsewhere require: see what your AI notice has to say.
Do all three and the hard version of this question never arrives. Skip the third and it arrives eighteen months later, from a lawyer, about a file nobody can now locate.
Common questions
Can I ask candidates to submit their own chat log with the take-home?
Yes. A log the candidate hands over is the lightest way to get the trail. Say what you will do with it, keep it to the assignment rather than the whole account history, and accept that it can be edited before it reaches you. That last point matters less than it sounds: a log that has been curated still shows how the candidate wanted their reasoning to look, and the debrief conversation is where the curation shows.
Does it change anything if the vendor holds the file instead of me?
It changes who else can be sued, not whether you are responsible. California's employment regulations treat an agent acting for an employer, including a vendor running the system, as an employer under the state's fair-employment law 1. Practically, get the retention period, the access list, the deletion path and the model-training answer into the contract, and keep an export you control. A vendor's default retention is a decision you made by not making it.
Should the prompt log go into the ATS?
Into the hiring record, wherever that is. The ATS is usually the right home because it already has the retention schedule, the access controls and the audit trail. Whatever you choose, the test is the same: could you produce every artefact for a given candidate, in one action, four years from now, without asking a former employee where they saved it.
Is a candidate's AI session recording a biometric?
Not by itself, and a text trail never is. Illinois's Biometric Information Privacy Act, in force since 2008, defines a biometric identifier to include a voiceprint or a scan of face geometry, requires a written release before a private entity collects one, and gives the candidate a direct right of action when it does not 5. A recording becomes a biometric question the moment something derives a faceprint or a voiceprint from it. This is the main reason to keep assessment capture textual: the wider capture reaches a much more expensive statute for a marginal gain in signal, and the states you hire in are worth a question to counsel.
How long should the retention period actually be?
Long enough to satisfy the strictest rule you are subject to, and identical across candidates. Four years covers California employers under the amended employment regulations, in force since October 2025 1. Whatever number you land on, apply it uniformly, automate the destruction, and confirm it with counsel against the states you hire in. A period that varies by reviewer is worse than a period that is too long, because it cannot be explained.
What do I tell a candidate who asks for their assessment file back?
Tell them what you hold, why you hold it, how long for, and who has seen it. If a records-retention obligation is why you cannot delete it yet, say that plainly and give the date it ends. Candidates rarely object to a stated period. They object to discovering that nobody knows the answer, which is the version that turns a question into a complaint.
References
- 1. Final Unmodified Text of Proposed Employment Regulations Regarding Automated-Decision Systems (Attachment B), 2 CCR sections 11008, 11009, 11013 calcivilrights.ca.gov Supports the move from two years to four for employment records, the express inclusion of automated-decision-system data, and the vendor-as-employer clause cited in the FAQ.
- 2. California Civil Code section 1798.140, Definitions (consumer; personal information) leginfo.legislature.ca.gov Supports the claim that a consumer is any California resident with no applicant carve-out, and that personal information includes professional or employment-related information.
- 3. California Civil Code section 1798.105, Consumers' right to delete personal information leginfo.legislature.ca.gov Supports the right to request deletion and the exception permitting a business to retain information where doing so is reasonably necessary to comply with a legal obligation.
- 4. Artificial Intelligence Video Interview Act, 820 ILCS 42 ilga.gov Supports the 30-day destruction duty on request and the duty to instruct recipients to delete their copies.
- 5. Biometric Information Privacy Act, 740 ILCS 14, sections 10, 15 and 20 (P.A. 95-994, eff. 10-3-08) ilga.gov Supports the definition of a biometric identifier as including a voiceprint or scan of face geometry, the written-release duty before collection, and the private right of action cited in the FAQ.
- 6. Rulemaking Actions - Civil Rights Council ✓ calcivilrights.ca.gov The Council's own record of the automated-decision-system employment regulations: approved by OAL and filed with the Secretary of State, effective October 1, 2025.
6 sources, numbered by first appearance. How Olive sources claims
General guidance for hiring teams. What works at one company and one volume may not transfer to yours.
Olive assesses how a person works with AI. It does not detect AI-written documents, and it never produces a score, a ranking, or a match percentage for a person. Candidates read the same report the employer reads.