How to Document Hiring Decisions: A Record-Keeping Guide for Teams Using AI Screening
What to record at each hiring stage, how long to keep it under US, UK and EU rules, and how to write a rejection reason that still holds up a year later.
By the HireRabbit.AI team · Published · Last updated
On this page
This article is general information for HR and talent teams, not legal advice. Retention periods and access rights differ by country, state and sometimes city, and several of the rules below are under review. Confirm your schedule with employment counsel and your privacy lead.
A hiring record is only tested on a bad day. A rejected candidate files a charge. A regulator asks how the AI tool reached its scores. A candidate in the UK or EU makes a subject access request and your interview notes become something they will read. A board member asks why the last ten hires all came from the same two companies. On that day, the team needs to find what was decided, by whom, against what criteria, and why, for a role that closed eight months ago.
This guide covers what to record at each stage, how to write a reason that still makes sense a year later, how long to keep it all under the main US, UK and EU rules, and how the picture changes once AI scoring is part of the process.
What the rules ask you to keep
The rules come from several directions, and they ask for different things: some for the records themselves, some for how long you keep them, and some, more recently, for evidence that a person supervised the software.
United States, federal. EEOC regulations at 29 CFR 1602.14 require employers to keep personnel and employment records, including application forms and other hiring records, for one year from the date the record was made or the action was taken, whichever is later. If a charge of discrimination is filed, the records relating to it must be kept until final disposition, which the EEOC defines as the end of the 90-day period for filing suit or, if a suit is filed, the end of the litigation including appeals. Federal contractors face longer periods under OFCCP rules: 41 CFR 60-1.12 sets two years for contractors with 150 or more employees or a contract of $150,000 or more, and one year below that.
United States, Uniform Guidelines. 29 CFR 1607.4(A) asks each employer to keep records showing the impact of its selection procedures by race, sex and ethnic group. That is a different kind of record from the application file: it is the funnel data that an adverse impact analysis runs on.
New York City. Employers using an automated employment decision tool for hiring in the city must have an annual independent bias audit and publish a summary. The audit needs the tool's selection data by sex and race or ethnicity, which means keeping stage outcomes per candidate for at least a year.
United Kingdom. The ICO's recruitment and selection guidance says employers should not keep recruitment records for unsuccessful candidates beyond the statutory period in which a claim from the process can be brought, unless there is a clear business reason to keep them longer. It also warns in the other direction: destroying candidate records too quickly can make it harder to show that your end-to-end process is transparent, fair and accountable, and candidates can make a subject access request for their information. The ICO notes that the guidance is under review following the Data (Use and Access) Act.
France. France's data protection authority, the CNIL, is generally summarised as allowing an unsuccessful candidate's file to stay in the active recruitment database for two years from the last contact with the candidate, after which it should be deleted unless the person asked to stay in a talent pool. The figure comes from vendor summaries of CNIL's recruitment guidance, so confirm it against the current CNIL text before you write it into a policy.
European Union, AI Act. Where a high-risk AI system is used in recruitment, Article 26 puts obligations on the employer using it. Among them: assign human oversight to people with the necessary competence, training and authority; keep the logs the system generates for at least six months, or longer where other law requires; tell workers' representatives and affected workers before the system is used in the workplace; and tell people that they are subject to the system. These obligations are scheduled to apply from 2027, and the AI hiring laws guide tracks the dates.
Taken together, the rules point the same way. Keep the decision records for at least a year, and longer where contracts or a claim require it. Keep demographic funnel data separately. If AI is involved, keep the logs and a record of who oversaw it.
What to record at each stage
The simplest test for a hiring record is whether a colleague who was not involved could reconstruct the decision from it. The table lists what that takes at each stage.
| Stage | Record | Why it matters later |
|---|---|---|
| Opening the role | The posting as published, the scoring sheet (must-haves, weighted requirements, area weights), who agreed it, the date | Defines what "qualified" meant for this role on this day |
| Screening | Each candidate's score and its breakdown, the cut-off in force, who confirmed any batch rejection, the date | Shows the same yardstick was applied to everyone, and that a person approved the removal |
| Moves between stages | The reason for each individual move, the person who made it, the date | The record a candidate or regulator will ask about first |
| Interviews | Completed scorecards from each interviewer, filed before the debrief | Shows the decision rested on the criteria, not on the loudest voice |
| Offer or rejection | The decision, the reason, who made it, the date; for rejections, which criterion the person did not meet | Closes the file in a way that can be explained |
| Changes mid-search | Any change to the sheet, weights or cut-off, with the date and reason; the old version kept | A shortlist built last month must be explainable against last month's rules |
Two things are deliberately absent. Demographic data stays in a separate store, joined only at analysis time. And free-text impressions that are not tied to a criterion ("good energy", "not sure about fit") should not be in the file at all, for reasons the next section covers.
How to write a reason that holds up
Most hiring records fail on the reason field. It is either blank, or it says something that reads badly a year later. A reason that holds up has four properties.
It names a criterion from the scoring sheet. "Did not show the required experience debugging customer-reported issues; resume lists internal QA only" points at a must-have and at the evidence. "Not technical enough" points at nothing.
It is written at the time, by the person who decided. A reason reconstructed six months later for a lawyer is worth less than a shorter one written on the day. If the hiring manager made the call, the hiring manager's name is on it.
It is one or two sentences. Long reasons invite the writer to add impressions, and impressions are where protected characteristics and their proxies creep in. "Seemed likely to move on quickly" is an age or family-status proxy in many readings. "Strong culture fit" has been read as several things in litigation. Stick to the criterion.
It avoids anything the law protects, directly or by proxy. Age, sex, race, religion, disability, pregnancy, family status and the rest, and the phrases that stand in for them: "overqualified", "digital native", "energetic", "settled". If a sentence would need explaining to a tribunal, replace it with the criterion.
Two before-and-after examples:
| Before | After |
|---|---|
| "Great person, just not the right fit for the team right now." | "Scored below the cut-off on skills; the role requires log analysis and basic SQL, and neither appears in the resume or the exercise." |
| "Concerned she'd struggle with the pace here." | "Take-home exercise completed, but the written explanation did not meet the must-have for customer-facing writing; two of three reviewers scored it 2 of 5 against the anchor." |
The second column is longer only because it carries evidence. It also has the property that the candidate could read it and understand the decision, which is the standard a growing number of rules are moving toward.
Keep demographic data apart from decision data
An employer needs demographic data to run an adverse impact analysis and should not have it in front of anyone making a decision. The practical arrangement is a voluntary form, separate from the application, stored where recruiters, hiring managers and any scoring tool cannot read it. The person who runs the quarterly analysis joins it to stage outcomes by candidate identifier, produces the ratios, and files the analysis with the scoring sheets in force at the time.
This separation is also what makes the one-year and two-year retention periods workable. Decision records and demographic records can be on different schedules, and the demographic store can be deleted or aggregated earlier without weakening the decision file.
Decide who can see what
Interview notes and reasons are read by more people than the writer expects: the candidate, under a subject access request; the auditor; the lawyer on the other side. Two access rules reduce the risk without slowing the process.
First, give each interviewer the stage they own and nothing else. An interviewer who runs the technical round does not need the recruiter's screening notes or the other panelists' scores before the debrief, and seeing them changes the ratings. Second, keep the written reason attached to the move, so that the audit trail is one record rather than a chat thread, an email and a spreadsheet that have to be reassembled later.
The structured interview scorecard guide covers how independent scoring before the debrief improves the decision as well as the record.
When AI is part of the decision
AI scoring adds three things to the file.
The configuration in force. The scoring sheet, the area weights, the must-have list and the cut-off, with dates. If the overall score is built from visible area scores, keep the breakdown with each candidate, not just the total. "The AI scored this person 61" is not a record; "skills 70, experience 55, projects 60, education 50, weighted 40/30/20/10, against a cut-off of 65" is.
The human in the loop. Who confirmed a batch rejection, who overrode a score, and why. Under the EU AI Act's Article 26 the person assigned to oversee the system must have the competence and authority to do so, and the record should show that a named person did.
The logs. Whatever the system generates about its own operation: versions, runs, changes to configuration. The AI Act sets a minimum of six months; one year lines up with the US baseline and is simpler to administer.
If a vendor cannot give you the breakdown behind a score, or cannot tell you which version of the tool scored a given batch, that is a gap in your record before it is a gap in theirs. The explainable AI resume screening guide covers what to ask for.
A retention schedule to adapt
The schedule below is a starting point for a company hiring in the US, UK and EU. Shorten or lengthen each line to match your counsel's advice and the longest rule you are subject to.
| Record | Keep for | Trigger to extend |
|---|---|---|
| Posting, scoring sheet, weights, cut-off | Life of the role plus 2 years | Any charge, claim or audit touching the role |
| Candidate applications and scores (unsuccessful) | 1 year from decision (US baseline); 2 years for OFCCP contractors; UK: the statutory claim period unless a business reason applies; France: up to 2 years from last contact | Charge or claim: until final disposition |
| Stage moves and written reasons | Same as the application file | Same |
| Interview scorecards | Same as the application file | Same |
| Demographic data (voluntary, separate store) | Aggregate at 1 year; delete identifiable data when the analysis for that period is filed | Audit in progress |
| Adverse impact analyses | 3 years | Ongoing claim |
| AI system logs and configuration history | 1 year (above the EU AI Act's 6-month minimum) | Charge, claim, audit |
| Records of hired candidates | Move to the personnel file on its own schedule |
Write the schedule down, name an owner, and run the deletions on a calendar. A retention policy that exists only as a good intention is, in the ICO's terms, neither transparent nor accountable.
How HireRabbit.AI keeps the record
HireRabbit.AI was built so that the record is produced as a side effect of doing the work rather than as a separate task. Every overall score is computed from four visible area scores, for skills, experience, projects and education, and the breakdown stays with the candidate. Auto-reject only applies below a cut-off your team sets, in a batch a named person confirms, and it is reversible. Moving a single candidate between stages requires a written reason; the AI can suggest one, and the person keeps or changes it. Interviewers see only the stage they own, through custom roles. The security page describes how access is scoped and the product page walks through the workflow.
Sources
- EEOC, Recordkeeping requirements: https://www.eeoc.gov/employers/recordkeeping-requirements
- EEOC, Summary of selected recordkeeping obligations in 29 CFR Part 1602: https://www.eeoc.gov/employers/summary-selected-recordkeeping-obligations-29-cfr-part-1602
- 41 CFR 60-1.12, Record retention (OFCCP): https://www.ecfr.gov/current/title-41/subtitle-B/chapter-60/part-60-1/subpart-B/section-60-1.12
- 29 CFR 1607.4, Uniform Guidelines on Employee Selection Procedures, Information on impact: https://www.law.cornell.edu/cfr/text/29/1607.4
- ICO, Employment practices and data protection: keeping recruitment records: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/employment/recruitment-and-selection/keeping-recruitment-records/
- Hirify, How long can you keep a candidate's data? (summary of CNIL guidance): https://hirify.fr/en/resources/duree-conservation-donnees-candidat
- European Commission AI Act Service Desk, Article 26: Obligations of deployers of high-risk AI systems: https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-26
- Seyfarth, New York City Releases Final Rules Implementing Local Law 144 (Apr 2023): https://www.seyfarth.com/news-insights/new-york-city-releases-final-rules-implementing-local-law-144-aimed-at-curbing-artificial-intelligence-bias-in-employment-decisions.html