AI without the regret: risk, privacy and governance for recruitment agencies
Recruitment agencies sit on candidate personal information all day, and from 10 December 2026 Australian privacy law requires them to explain any automated decision that touches a candidate. Alvo built the education module agency owners needed before buying anything, delivered through the Savage Recruitment Academy, and turned its governance framework into the working model below.
The one-page policy, the tool register and the human-in-the-loop log, running.
Demonstration environment with an invented agency. The five-part framework from the module (policy, register, human review, data rules, quarterly rhythm) becomes a set of records in the agency's own systems rather than a document in a drawer. Nothing here screens or scores a candidate; it governs the tools that might.
The risks that hurt a recruitment agency are legal and reputational, not technical.
The candidate database is both the asset and the exposure. Candidate records are personal information under the Privacy Act, and pasting them into an unapproved consumer AI tool is a disclosure that cannot be taken back. It happens in agencies every week, usually with good intentions: a free CV formatter, a note-taker dropped into every client call, a consultant's personal chatbot account.
Bias attracts liability regardless of intent, the Fair Work Act is technology-neutral, and from 10 December 2026 the agency must explain any automated decision-making that touches a candidate, including features already buried inside the ATS. No new legislation is needed for an agency to be exposed today. Owners were hearing about AI weekly and had no structured way to move from awareness to a decision they could defend.
An owner's playbook, delivered where agency leaders already learn.
The module: Implementing AI in Your Recruitment Agency
A 39-minute session for owners and directors, in eight standalone sections: the five questions before you spend a dollar, the recruitment-specific risk map, ten questions for any vendor, governance that speeds you up, the cost disciplines, and a first 90 days. Delivered through the Savage Recruitment Academy, in the industry's own language. Nothing in it teaches recruiter craft; that stays with the Academy.
Three tools an owner can install in a week
The AI Governance Starter Framework (one-page policy, tool register, human-in-the-loop rule, data rules by class, quarterly review), the AI Vendor Question Checklist with good-answer guidance, and the Adoption Thesis. ANZ and international variants, ungated.
The research behind it
Alvo's own report, The State of AI in Australian Recruitment: adoption, use cases, and the gap between agencies that use it and those that don't. Named because it is ours.
The framework as a working model
The screen above is the governance framework built as records in an agency's own systems: register, policy sign-off, review log, data map and cost roll-up, with the December deadline counting down. It is the Assess and first Build milestone for an agency that has watched the module and wants it running rather than filed.
Governance is the operating system, not the paperwork.
Built on the published floor
The framework sits on the National AI Centre's guidance and the Voluntary AI Safety Standard as the floor, ISO/IEC 42001 as the anchor when an enterprise or government client asks, and the RCSA Code of Professional Conduct as the industry overlay.
Not legal advice
Alvo does not give legal advice. The module and the framework draw on legally reviewed research into the AI obligations on Australian recruiters, and the privacy policy wording for automated decisions is drafted with the agency's own adviser.
Governance wins work
The commercial frame is simple: enterprise and government clients now ask about AI controls in tenders. The agency that answers in one page wins the work from the agency that goes quiet for a week.
Run a recruitment agency with tools nobody has registered?
Start with the module and the free framework. If you want it running in your systems before 10 December, the Assess baselines every tool in use, including the unofficial ones, and the first milestone installs the register and the policy.