What Is Notification Requirement? Definition & Examples

A legal obligation to tell candidates that an automated employment decision tool will be used, what it will assess, and what data it relies on. The notice may also need to cover data retention and accommodation options. These requirements are meant to improve transparency before the screening process begins.

What the Notification Requirement Covers

A notification requirement is a transparency control, not an access-control rule. Its purpose is to tell candidates, before screening begins, that an automated employment decision tool will be used, what it will evaluate, and which data sources or categories it relies on.

That notice is often broader than a simple disclosure. Depending on the jurisdiction or rule set, it can also need to explain retention practices and whether accommodations are available, so the person being screened can understand the process in advance and decide how to respond.

For organisations, the practical meaning is straightforward: the notice must be accurate, timely, and tied to the actual screening workflow. A generic privacy notice is usually not enough if the law expects a tool-specific disclosure.

Where the legal duty is part of a broader AI governance program, the structure of the notice should match the real decision pipeline and the real inputs used by the system. That is why transparency, data governance, and retention disclosures are often discussed alongside responsible AI controls and auditability, not only as HR communications. For broader governance context, see the NIST AI Risk Management Framework and ISO/IEC 42001:2023 AI Management System Standard.

What Must Be Communicated Before Screening

The core of the notification requirement is pre-use disclosure. Candidates should know that an automated employment decision tool is involved, what it is expected to assess, and what information it will use to make or support a decision.

That matters because screening systems can combine multiple inputs, such as application data, assessments, interview artifacts, or other records. The notice should be precise enough that the candidate can understand the scope of automation without needing to infer it from later stages of the process.

Retention language is often part of the same disclosure because data persistence affects fairness and privacy expectations. If the organisation keeps candidate data longer than the immediate hiring decision, that fact should be clearly stated where the rule requires it.

Accommodation language is equally important when the process may disadvantage candidates who need an alternative format or review path. The notice is strongest when it points to the actual mechanism for requesting help, not just a general statement that accommodations exist.

In practice, this means the notification should be written from the actual workflow, not copied from a template. The more the tool influences decisions, the more carefully the notice should describe the tool’s role and inputs. For control-oriented disclosure practices, the NIST AI Risk Management Framework and OWASP ASVS are useful reference points for thinking about transparency and trust in the surrounding system.

Why This Requirement Exists

The notification requirement exists to reduce informational asymmetry. Candidates cannot meaningfully engage with a screening process if they do not know when automation is being used or what kinds of information are influencing the outcome.

That transparency also supports accountability. When employers must describe the tool’s function and inputs, they are less likely to let undocumented model behaviour, undocumented data use, or informal process drift shape candidate outcomes.

Another reason is procedural fairness. A candidate who understands the screening mechanism is better positioned to identify errors, request an accommodation, or challenge a result that appears inconsistent with the role or with their own submitted information.

From a governance perspective, notification is a signal that the organisation has moved from experimentation into regulated operational use. If the tool affects employment decisions, disclosure becomes part of the control surface around AI risk, data handling, and reviewability. External governance obligations often become clearer when paired with compliance-facing controls such as PCI DSS v4.0 in regulated environments and with AI governance structures such as ISO/IEC 42001:2023 AI Management System Standard.

Notification Requirement in Practice

The most common implementation mistake is treating the notice as a legal footer rather than a process control. If the tool, the data sources, or the assessment criteria change, the notice may need to change too.

Another frequent issue is overpromising precision. A notice should accurately describe what the system does, not what the organisation hopes it does. If the tool supports a human review process, the notice should not imply fully automated decision-making unless that is actually the case.

Effective practice also depends on recordkeeping. Organisations should be able to show what version of the notice was given, when it was presented, and which candidate workflow it applied to. That evidence matters when a regulator, auditor, or internal reviewer asks whether disclosure was timely and complete.

For teams managing candidate screening across multiple jurisdictions, the key challenge is consistency without flattening legal nuance. The notice should remain understandable to candidates while still reflecting the specific obligations that apply to that employment workflow. In governance-heavy environments, Ultimate Guide to NHIs, Regulatory and Audit Perspectives is a useful internal reference for thinking about disclosure, audit trails, and governance obligations across automated systems.

Risk and Threat Considerations

Notification failures create both compliance risk and trust risk. If candidates are not told that automation is involved, the organisation may face regulatory exposure, dispute risk, or reputational harm, especially when the tool materially affects access to employment opportunities.

Failure mechanism: The risk usually comes from incomplete disclosure, stale notice language, or a mismatch between the notice and the live screening workflow. When the actual data inputs or decision logic change but the notice does not, the organisation can end up representing a process that no longer exists.

Impact: Candidates may be unable to exercise accommodation rights, challenge inaccurate data, or understand why a decision was made. That can turn a transparency gap into a fairness failure, a privacy issue, and a governance problem at the same time.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST AI RMF and NIST CSF 2.0 set the technical controls, while ISO/IEC 42001:2023 define the regulatory obligations.

Framework	Control / Reference	Relevance
NIST AI RMF	GOVERN — Govern	AI hiring notices are part of AI governance and transparency expectations.
Recommendation — Govern the screening tool’s purpose, inputs, and notice content as a controlled AI process.
ISO/IEC 42001:2023	5.2 — AI policy	The notice reflects organisational policy for transparent AI system use in employment decisions.
	8.3 — AI risk treatment	Retention, disclosure, and accommodation gaps are AI risk treatment issues in deployment.
Recommendation — Define policy for when and how candidates are informed about AI-assisted screening. Treat notice accuracy and lifecycle updates as part of AI risk treatment and control monitoring.
NIST CSF 2.0	GV.OV — Oversight	Candidate notification is an oversight and accountability control for automated screening use.
	GV.RM — Risk Management Strategy	Disclosure reduces legal and trust risk by making automated employment screening transparent.
	PR.DS — Data Security	The notice depends on clear handling of the data the screening tool assesses and retains.
Recommendation — Assign oversight for approved disclosure language and periodic review of screening notices. Include candidate disclosure requirements in the organisation’s AI risk management strategy. Document which candidate data categories are collected, used, and retained by the tool.

Practitioner Guidance

Governance implication: Treat the notification requirement as a governed artefact tied to the actual decision workflow, not as a static legal disclaimer. The notice owner should be able to confirm which tool, which data categories, and which retention rules are covered by each version.

What to watch for: Revisions to model inputs, vendor configurations, retention practices, or candidate accommodations should trigger notice review. If the screening process changes faster than the disclosure, the organisation is likely creating avoidable compliance drift.

Notification Requirement