What an applicant tracking system can reject on its own, what it costs and how you leave

A rule you set can reject applicants, and vendor terms leave you to answer for it

Many applicant tracking systems can act on an application without a person reading it. Before you switch anything on, find out which rules do that and who answers if one gets it wrong.

Two kinds of rule matter. One rejects on an answer to a screening question. A must-have question rejects anyone who gives the wrong answer. The other rejects on a score or a test result. The register below shows which kind each of thirteen vendors uses, and what happens next.

Look at what the candidate hears and who on your team is told. A rule that rejects without telling anyone makes the outcome harder to explain later. That matters because several vendors’ terms put the legal risk of these tools on you.

Hireology’s terms tie that risk to the rules themselves. They make you solely responsible for questions and assessments built with its screening tools. They also make you fully liable for results deemed a disparate impact. That means results that fall harder on one group, such as by gender or race.

The vendors’ AI terms push the risk onto you in three ways. Some put the oversight on you. Some limit what you may use the AI for. Some limit what you can hold the vendor to.

On oversight, Greenhouse’s AI terms make you solely responsible for human oversight of its AI features. That oversight must be enough to avoid unlawful or discriminatory behaviour. Eightfold’s AI terms make you the deployer, the company that puts the AI to use. You must not rely exclusively on its outputs for employment decisions.

BambooHR limits the use instead. Under its AI terms, you may not use its AI for high-risk, significant or consequential decisions under applicable law.

The third kind limits what you can hold the vendor to. Hireology’s terms make you solely responsible for AI-law compliance. They have you waive claims against Hireology over its AI services. Greenhouse is not responsible for inaccuracies or bias in AI output.

If a rule or score rejects the wrong person, these terms point back to you as the employer. So find out who answers before you switch the rule on.

Some laws reach the rules themselves. If a tool counts, the duties fall on you as the employer, not on the vendor. New York City’s Local Law 144 covers an “automated employment decision tool”. That is software that issues a score, classification or recommendation. The law covers it when the output is used to “substantially assist or replace discretionary decision making” in screening candidates. The duties are three. The tool needs a bias audit within the year before use. You must post a summary of it on your website. You must tell each candidate who lives in the city at least ten business days ahead. Under the city’s guidance, the vendor that made the tool is not responsible for its bias audit. A first violation costs up to $500, and each day of use counts as a separate violation. The law applies where the job is based in an office in New York City at least part time.

Whether your tool counts can turn on how you use it. ADP believes its Candidate Relevancy score is not covered by the city’s law, if used as ADP intends. So ask each vendor in writing whether its scores or rules count as a covered tool.

The EU AI Act puts AI that filters or evaluates candidates on its high-risk list, unless an exemption applies. Article 6(3) sets the exemption. It can apply when the software poses no significant risk of harm to fundamental rights. It is removed when the software profiles people. A 2026 EU law called the Digital Omnibus moves the date for these duties to 2 December 2027. Where the exemption does not apply, an employer must assign trained people to oversee the system. It must keep the system’s logs for at least six months and tell the people it is used on. So ask each vendor whether it relies on the exemption, and what oversight and logs it supplies.

GDPR Article 22 gives people the right not to be subject to a decision based only on automated processing. The right covers decisions with legal or similarly significant effects. “E-recruiting practices without any human intervention” is one of GDPR’s own examples of such a decision. The UK added Articles 22A to 22C to its GDPR. They require safeguards for significant decisions based only on automated processing, including human intervention and a way to contest. Those UK rules came fully into force on 5 February 2026, so they apply now. The UK Information Commissioner’s Office (ICO) audited AI recruitment tools. The ICO advises providers to stop recruiters moving or rejecting candidates on the AI’s indicative grades or fit scores alone. So a person needs to be able to step in before a score alone rejects anyone.

Four more places add their own duties. California’s rules on automated-decision systems took effect on 1 October 2025. Evidence of anti-bias testing, or the lack of it, is relevant to a discrimination claim or defence. So ask each vendor for its testing evidence, and keep it.

Colorado’s new act applies to decisions made on or after 1 January 2027. It counts job applicants who live in Colorado as consumers. Consumers get the right to meaningful human review after an adverse consequential decision, and that term covers employment. That bears directly on automatic rejection. So ask how a person can review a rejection in each product.

Illinois bars AI that discriminates in hiring from 1 January 2026. Ontario employers with 25 or more employees must say in job postings if they use AI. That covers AI used to screen, assess or select applicants. A simple statement is enough. The duty stays with you if a vendor does the screening. Ontario’s duty began on 1 January 2026.

Bias audits differ in what they cover. Greenhouse’s audits run monthly by Warden AI across ten protected classes. Gem’s BABL AI audit did not cover groups beyond race, ethnicity and gender. Eightfold’s audit did not test groups beyond race, ethnicity, gender and age. ADP’s audit was done by BLDS in April 2024. So a passed audit may not have tested the group you are worried about. Ask for the audit and read which groups it tests.