Policy
Your Sourcing Tool Ranks People Who Have Not Applied
A sourcing tool that ranks profiles before anyone applies falls outside most of the AI hiring rules people quote, because those rules define their subject as a person who has already applied. New York City's rules turn on the word applied, and federal applicant recordkeeping needs an expression of interest from the person. Illinois and the EU are the exceptions: both attach to recruitment itself, though the EU's rules for it apply only from December 2027. Meanwhile the pool narrows where no selection rate can see it.
The takeThe gap here is legal, not moral. A ranking that decides who hears about a job removes people from the process as effectively as a knockout filter does, and it does it in the one place nothing counts. Compliance attention follows the statute, so the least observed decision in hiring is also the least reviewed. Anyone who wants sourcing held to the standard the screen is held to has to build the record themselves, starting with the search they ran this morning.
Where Olive fits
Open a role and see what the work shows
Where a hiring step has to be explainable later, what survives is the record it left. Olive produces no composite, and no decision about a candidate is made by a machine alone: a person writes or edits each of the six findings, every finding carries the timestamped excerpt it rests on, and a released report exports with its rubric, scorer and bank versions attached.
Assess your shortlistWhy do the AI hiring rules start at the application?
Because most of them define their subject as a person who has already applied. New York City's rules are the clearest case. They define a candidate for employment as someone who has applied for a specific position by submitting the information or items the employer required, and define screening as a determination about whether that candidate should be selected or advanced 1.
A profile sitting in a sourcing tool has done none of that.
So the tool that ranked it is not screening a candidate, because on those definitions there is no candidate yet. The question of whether your tool counts as an AEDT under Local Law 144 does not arise at the sourcing step, since the employment decision the definition needs has not happened.
The practice is common enough to be worth the question. Among organizations that use AI to support recruiting, SHRM's 2025 survey of HR professionals reports automating candidate searches at 32% and screening resumes at 44% 8. The statutes people quote point at the second row.
Federal recordkeeping draws the same line, and draws it in the person's own hand. The rule on Internet Applicants covers an individual who "submits an expression of interest in employment through the Internet or related electronic data technologies". The same definition also requires that the contractor consider the person for a particular position, that the expression of interest indicate the basic qualifications, and that the person not withdraw 2.
The expression of interest has to come from the person. A recruiter's search does not supply one.
An applicant tracking system's knockout question sits on the other side of that line, which is why your ATS knockout questions may already be regulated AI while a ranked sourcing list probably is not. The filter acts on a submitted application. The sourcing tool acts on a profile nobody sent you.
Which laws reach a tool that acts before anyone applies?
Two, on their wording: both name recruitment rather than applications. Effective January 1, 2026, Illinois made it a civil rights violation for an employer to use artificial intelligence that has the effect of discriminating on the basis of a protected class in recruitment, hiring, promotion or discharge. The same amendment bars using zip codes as a proxy for a protected class 3.
An effects standard does not ask what the vendor intended.
Illinois does not say how to comply. The statute requires no bias audit and does not fix a notice date; the timing, circumstances and means of notice were delegated to Department of Human Rights rulemaking 3. The duty is written and the procedure is not.
The European Union named the activity instead. Annex III, point 4 of the AI Act lists systems intended for the recruitment or selection of natural persons as high-risk, "in particular to place targeted job advertisements, to analyse and filter job applications, and to evaluate candidates" 4. Targeted advertising also happens before anyone applies, and the drafters put it first.
The obligations are not live. The European Commission's own implementation timeline now shows the high-risk rules in Annex III applying from 2 December 2027 5, later than the 2 August 2026 in the Regulation as adopted 4. Most compliance notes written before mid-2026 still carry the older date.
Colorado is the cautionary one. Senate Bill 24-205 never applied to anybody. On May 14, 2026 the governor signed SB 26-189, repealing and reenacting it as a narrower automated-decision regime that begins January 1, 2027 6.
Plenty of 2025 commentary still describes it as imminent. Sorting the live from the pending is an hour's work once a quarter, and five US AI hiring laws bind you today is the current map. Confirm any of it with employment counsel; none of this is legal advice.
What does a ranked sourcing list do to a selection rate?
It takes people out of the arithmetic before the arithmetic starts. New York City's rules say a selection rate may be calculated by dividing the number of individuals in a category who move forward by the total number in that category "who applied for a position or were considered for promotion" 1. Someone the ranking buried on page four never applied.
Your own applicant-flow data has the same shape and the same blind spot.
A person who applies and is rejected leaves a row: a date, a stage, a reason if you record one. A person ranked four hundredth leaves nothing at all, because nothing happened to them.
No rejection, no notice, no complaint.
A posting that puts people off before they apply drills the same hole from the other end, which is why you cannot compute a selection rate on people who never applied. Sourcing gets there earlier and more quietly, because the person never saw the posting to be discouraged by it.
Per-gate arithmetic catches a bad screen and still misses this one. Computing selection rates per gate works because every gate has a population on both sides of it. Sourcing has a population on one side only, and you chose it.
Check whether the rank rests on inferred attributes
Ask the vendor what the ordering is computed from, and get the answer in writing before the next search runs. Between August 2023 and May 2024 the UK's Information Commissioner's Office audited developers and providers of AI sourcing, screening and selection tools. The audit found some tools estimating or inferring gender, ethnicity and other characteristics from an application or from a name alone 7.
The regulator's verdict on that inference is flat: it is not accurate enough to monitor bias effectively, and it was often processed without a lawful basis and without the candidate's knowledge 7.
Auditors also found search functionality that let recruiters filter out candidates with certain protected characteristics 7. The report says "some tools" and "others" with no counts attached, so nothing in it supports a market rate. It supports a question to put to a vendor.
The line worth drawing is between an inference and something the person published. Three years of a named tool on a profile is a fact somebody typed. A predicted seniority, a predicted openness to a move, a predicted skill the profile never mentions: those are model output about a person who has not spoken to you.
A skills-inference engine infers from words, not work, and an ordering built on one inherits whatever those words were standing in for.
Then check the least interesting thing in the system: whether anybody opens page two. A ranked list is a recommendation about attention. A recruiter who writes to the first twenty names has let the tool decide, whatever the documentation says about human oversight.
Sample from below the fold for a month and compare reply rates. If position twelve and position ninety answer at about the same rate, the ordering is decoration, and it is still deciding who hears about the job.
Keep the query, the list and the contact log
Keep three artifacts from the day each search runs, because none of them can be reconstructed afterwards. The query or filter set exactly as it was typed. The ranked list the tool returned, with positions attached. And the record of who was contacted and who answered. A tool that re-ranks weekly overwrites its own history, and the vendor owes you none of yours.
None of the rules cited above requires you to keep any of it today. Ask counsel whether another rule already does.
Nothing above is new, the objection runs, because sourcing was always arbitrary. A recruiter running a Boolean search read the first two screens and stopped, and nobody audited that either. Ranking a list did not invent the problem of attention running out at twenty names.
What changed is consistency. One recruiter's habits vary by day, by requisition and by how the morning went. One ordering rule applies the same weighting to every search anyone runs against it, which is what makes a wrong rule expensive at scale rather than merely wrong.
So keep the list. The EU's high-risk obligations arrive on 2 December 2027 and Colorado's replacement regime on January 1, 2027 56. If either one reaches your sourcing, the only record of the searches you ran in 2026 is the one you kept.
The ranked list you did not save is the evidence you will not have.
Common questions
Does Local Law 144 apply to a tool that ranks people who have not applied?
On the rules as written, no. The New York City rules define a candidate for employment as a person who has applied for a specific position by submitting what the employer required. The same rules define screening as a determination about whether that candidate should be selected or advanced. A profile a recruiter surfaced has done neither. That reading is not a safe harbor for what follows: once a sourced person applies, the duties attach to whatever tool touches the application. Check the specific facts with employment counsel rather than relying on a definitional read.
Do sourced candidates appear in applicant-flow or EEO reporting?
Not unless they apply. The federal Internet Applicant rule requires the individual to submit an expression of interest in employment through the Internet or related electronic data technologies. It also requires that the person be considered for a particular position, meet the basic qualifications for the position, and not withdraw. A recruiter's search satisfies none of that on the person's behalf. So a sourcing tool can narrow who ever hears about a role without moving a single number in the reports an employer files or the selection rates it computes.
Does the EU AI Act cover sourcing?
Annex III, point 4 of the AI Act lists AI intended for the recruitment or selection of natural persons as high-risk and names targeted job advertising first, an activity that happens before an application exists. Classification is not yet obligation: the European Commission's timeline shows the Annex III high-risk rules applying from 2 December 2027, moved back from 2 August 2026. Article 6(3) also carves out systems that perform a narrow procedural task, so the scope question turns on what the tool does rather than on what the vendor calls it.
Is Colorado's AI Act about to apply to this?
No. Colorado's Senate Bill 24-205 was repealed before it took effect. On May 14, 2026 the governor signed SB 26-189, which repeals and reenacts it as a narrower automated-decision-making regime taking effect January 1, 2027. The replacement names employment as a consequential decision and centers on notice at the point of interaction, a plain-language description of the technology's role after an adverse outcome, and a right to request meaningful human review.
What should you ask a sourcing vendor before the next search?
Four things, all answerable in writing. What the ordering is computed from, naming any attribute the tool infers rather than reads. Whether the search interface can filter on anything that functions as a protected characteristic. How long a ranked list is retained, and whether it can be exported with positions intact. And what the vendor keeps about the queries an employer ran. A vendor that cannot answer the last two is telling you the record you would need later does not exist.
References
- 1. Notice of Adoption of Final Rule: Use of Automated Employment Decisionmaking Tools (6 RCNY 5-300 et seq.) ✓ rules.cityofnewyork.us Section 5-300 defines a candidate for employment as a person who has applied for a specific position by submitting the required information or items, defines screening as a determination about advancing that candidate, and computes a selection rate over individuals who applied for a position or were considered for promotion, which is the basis for the claim that the rule's subject and its denominator both start at the application.
- 2. 41 CFR 60-1.3 - Definitions (Internet Applicant) ✓ law.cornell.edu The Internet Applicant definition requires the individual to submit an expression of interest in employment through the Internet or related electronic data technologies, be considered for a particular position, meet the basic qualifications and not withdraw, which supports the claim that a recruiter's search never puts a sourced person into applicant recordkeeping.
- 3. HB3773 Enrolled (Public Act 103-0804), amending the Illinois Human Rights Act ✓ ilga.gov Supports the claim that Illinois reaches recruitment by effect from January 1, 2026 and bars zip codes as a proxy for a protected class, while requiring no bias audit and leaving the notice timing and means to Department of Human Rights rulemaking.
- 4. Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act) ✓ publications.europa.eu Annex III, point 4 lists AI intended for the recruitment or selection of natural persons as high-risk and names targeted job advertising first, which supports the claim that EU law attaches to recruitment activity rather than waiting for an application. Article 113 states that the Regulation applies from 2 August 2026, excepting only Chapters I and II, a listed set of chapters, and Article 6(1), which is the source for the 2 August 2026 date named beside the Commission timeline.
- 5. Timeline: implementation of the EU AI Act ✓ ai-act-service-desk.ec.europa.eu Supports the claim that the Annex III high-risk obligations apply from 2 December 2027 rather than the widely repeated 2 August 2026 date.
- 6. SB26-189 Automated Decision-Making Technology - Bill Summary ✓ leg.colorado.gov Supports the claim that Colorado SB 24-205 was repealed and reenacted as a narrower automated-decision-making regime taking effect January 1, 2027, so nothing in Colorado binds an employer today.
- 7. AI tools in recruitment: Audit outcomes report ✓ ico.org.uk Supports the claims that the ICO audited AI sourcing, screening and selection tools between August 2023 and May 2024, that some tools inferred gender, ethnicity and other characteristics from an application or a name alone, that the regulator judged the inference not accurate enough to monitor bias effectively and often unlawful, and that some search functionality could filter out candidates with protected characteristics.
- 8. The Role of AI in HR Continues to Expand (2025 Talent Trends) ✓ web.archive.org Supports the figures that automating candidate searches is reported at 32% and screening resumes at 44% among organizations using AI to support recruiting.
8 sources, numbered by first appearance. Every one was opened and checked against the claim it carries. How Olive sources claims
General guidance, not legal advice. Hiring rules differ by state and country and change often; check anything here against your own counsel before you act on it.
Olive assesses how a person works with AI. It does not detect AI-written documents, and it never produces a score, a ranking, or a match percentage for a person. Candidates read the same report the employer reads.