Quick answer: what AI should and should not do in hiring
AI in recruitment is most useful for repetitive work: drafting job descriptions, extracting information from CVs, scheduling interviews and answering onboarding questions. The decision to invite, reject or hire a person must still be made, and owned, by a human. In Vietnam, employers must follow Article 25 of the 2025 Personal Data Protection Law (candidate consent, deletion when not hired), Decree 356/2025/ND-CP and the non-discrimination rules of the 2019 Labour Code.
What AI can do in recruitment and HR
The most practical way to look at it is to split recruitment work into two kinds: drafting, sorting and lookup (where AI helps well) and judging people (where AI should only suggest and a person decides). The four use cases below belong to the first kind or sit close to the boundary, so they need careful design.
If you are just starting, map your current hiring workflow before choosing tools: who does each step, which data flows where, and which step produces a decision that affects a candidate.
1. Drafting job descriptions and job ads
A language model can draft a JD from a competency framework, standardise tone, produce bilingual versions and flag wording that may mislead. This is low risk because a person reviews the output before it is published.
What to check: AI can copy old habits such as gender, age or marital-status requirements that are not tied to the specific requirements of the job. The 2019 Labour Code treats these as grounds for discrimination, so reviewers should screen for them before an ad goes live.
2. Reading and extracting CVs
AI extracts fields such as experience, skills and qualifications from PDF or image CVs and loads them into the applicant tracking system (ATS). This cuts manual data entry and makes candidate search faster.
The key boundary: extracting data is different from scoring and rejecting candidates. Once the system ranks or automatically filters applications, it is taking part in the hiring decision and needs the controls described below.
3. Scheduling interviews and candidate communication
An AI Agent can read interviewers' availability, propose slots, send invitations and reminders, and answer questions about location and process. This is repetitive, low-judgement work that suits automation with limited access rights.
Have the AI use approved message templates and hand any question about salary, results or reasons for rejection to the responsible recruiter.
4. Onboarding Q&A for new employees
An internal knowledge assistant (often built with RAG) answers questions about workplace rules, leave procedures and internal tools from official company documents, with links to the source. This reduces repeated questions to HR.
The assistant should read only documents approved for internal sharing, have no access to payroll or personal files, and say clearly when it cannot find an answer instead of guessing.
The main risks of using AI to assess candidates
The risk is not the technology itself but the use of AI output as the basis for decisions about people. There are three groups of risk to manage.
Bias
A model trained on past hiring data learns the biases of the past. The most cited case is Amazon's experimental CV-scoring tool: according to Reuters (2018), it was trained on applications submitted over about ten years, mostly from men, and did not rate candidates for technical roles in a gender-neutral way; the company eventually disbanded the team. Reuters also reported that Amazon's recruiters never relied solely on the tool's rankings.
The lesson: removing the gender column is not enough, because a model can infer sensitive characteristics from indirect signals such as school names, clubs or gaps in work history.
Explainability
When a candidate asks why they were rejected, "the system scored you low" is not an answer. If an employer cannot explain which criteria led to the result, it also cannot show that the decision was not based on prohibited grounds. Prefer clear, checkable criteria (for example, whether a mandatory certificate is held) over composite scores that are hard to interpret.
Candidate data
CVs contain a lot of personal data; video interviews or identity checks may collect biometric data. Common failures: uploading CVs to public AI tools without a data processing agreement, keeping rejected candidates' files indefinitely "for later", and transferring data abroad without assessment.
Relevant Vietnamese law (updated October 2026)
This section summarises the main instruments. Check the original texts and the latest updates before applying them.
Law on Personal Data Protection 2025 (Law No. 91/2025/QH15)
Passed by the National Assembly on 26 June 2025 and in force from 1 January 2026. Article 25 is dedicated to personal data protection in recruiting, managing and employing workers. Under clause 1 of Article 25, the recruiting party:
- May only request information that serves the recruitment purpose; the information may only be used for recruitment and other purposes agreed in accordance with the law.
- Must process the information in accordance with the law and with the consent of the applicant.
- Must delete or destroy the applicant's information if they are not hired, unless otherwise agreed with that person.
Decree 356/2025/ND-CP
Issued on 31 December 2025, in force from 1 January 2026, replacing Decree 13/2023/ND-CP. It sets out the lists of basic and sensitive personal data, how consent is expressed, impact assessments for processing and cross-border transfers, and specific rules for data processing in artificial intelligence systems. Two points matter directly for HR: data in employment relationships can include sensitive data such as health and biometric data; and cross-border transfers for managing personnel under lawful workplace rules, labour regulations or collective agreements are exempt from the cross-border transfer impact assessment dossier.
Labour Code 2019: discrimination is prohibited
Clause 8 of Article 3 defines discrimination in employment as distinction, exclusion or preference based on race, colour, national or social origin, ethnicity, sex, age, maternity status, marital status, religion, belief, political opinion, disability, family responsibilities, HIV status, or trade-union reasons, that affects equality of opportunity in employment or occupation. Article 8 lists discrimination in employment as a prohibited act. Distinctions based on the specific requirements of a job are not considered discrimination.
The law does not distinguish between decisions made by a person and by software: if an AI filter rejects candidates by age or marital status, responsibility still lies with the employer.
Law on Artificial Intelligence (Law No. 134/2025/QH15): is hiring "high risk"?
Passed on 10 December 2025 and in force from 1 March 2026, the law regulates AI by risk level. High-risk systems must undergo conformity assessment before use and ensure human oversight.
On the list itself: the draft published for comment by the Ministry of Science and Technology in early 2026 proposed classifying AI used in recruitment and HR management as high risk if applied to 500 or more workers a year or if the AI output is the main basis for personnel decisions. However, the official list issued under Decision 33/2026/QD-TTg of 30 June 2026 (effective 15 August 2026), contains 46 systems in six sectors: education, ethnic and religious affairs, health, banking, judicial proceedings and transport; labour and employment are not among them.
In other words, at the time of writing we found no basis to say that recruitment AI is automatically classified as high risk. But the list can be amended, and the law's general obligations (transparency, data protection, non-discrimination) still apply. See also Vietnam's AI Law 2025: what businesses need to prepare.
Keep a human in the hiring decision
The rule is simple: AI prepares, people decide. In practice, decisions to invite, reject, make an offer or decline all need review and sign-off by an authorised person who can overrule the AI's suggestion. Article 8(2) of Decree 142/2026/ND-CP uses the same test to keep a system off the proposed high-risk list: a mechanism that lets an authorised person independently review, intervene, reject or change the system's output before it takes effect.
See how to design review points in Human-in-the-loop.
- Do not let AI send automatic rejection emails without human review.
- Reviewers must see the reasons and data the AI relied on, not just a number.
- Record who reviewed, when, and whether they accepted or overruled the AI.
- Regularly review cases where reviewers overruled the AI to find systematic errors.
Control table for AI in recruitment
The table groups controls by use case. It is practical guidance and does not replace legal advice.
| Use case | Main risk | Suggested controls | Related basis |
|---|---|---|---|
| Drafting JDs and job ads | Discriminatory requirements | List of prohibited criteria; human review before posting | Labour Code 2019 Art. 3(8), Art. 8 |
| Reading and extracting CVs | Over-collection; sharing data with third parties | Extract only needed fields; tools with a data processing agreement | Law 91/2025 Art. 3, Art. 25 |
| Ranking and screening | Bias, poor explainability | Clear criteria; human decides; check pass-through rates by group | Labour Code 2019 Art. 8; AI Law 2025 |
| Scheduling and messaging | Wrong answers about results or pay | Approved templates; hand off when out of scope | Company rules |
| Onboarding Q&A | HR data leakage | Approved documents only; access control; cite sources | Law 91/2025 Art. 25(2) |
| Storing candidate files | Keeping data too long | Clear retention period; delete when not hired unless agreed | Law 91/2025 Art. 25(1) |
| Video interviews, biometrics | Sensitive data | Limit use; impact assessment; separate consent | Decree 356/2025 |
Consent and retention: getting it right
The law requires the applicant's consent and deletion of files when the person is not hired, unless otherwise agreed. In practice this becomes a few concrete changes to the application form and the ATS.
- State clearly on the form: what data is collected, for what purpose, whether AI assists screening, how long it is kept and who can see it.
- Separate consent to keep the file for future roles from consent to process it for the current role; do not pre-tick it.
- Set automatic deletion for unsuccessful applications, with an exception only where the candidate agreed to retention.
- Do not ask for information that does not serve recruitment (for example marital status or plans to have children).
- Log access to candidate files; restrict AI Agent permissions to the minimum (see access control and audit logs for AI Agents).
A suggested rollout path
Illustrative example: an 80-person company uses AI to draft JDs and send interview schedules, while CVs are still read by the hiring manager, and the application form states a six-month retention period if the candidate agrees. This starting point removes repetitive work without putting AI into the choice of people.
EYC designs and integrates AI automation workflows with human review points and data access control. If you need a specific hiring workflow reviewed, contact EYC.
- Step 1: List the hiring steps and mark which ones produce decisions about people.
- Step 2: Start with low-risk use cases: JD drafting, scheduling, onboarding Q&A.
- Step 3: Review tools: where data is stored, whether your data is used for training, whether a data processing agreement exists.
- Step 4: Update notices and consent forms under Law 91/2025 and Decree 356/2025.
- Step 5: If you use ranking, require a human reviewer and periodically compare pass-through rates across candidate groups.
- Step 6: Train recruiters on AI's limits and on recording the reasons for decisions.
Frequently asked questions
Can AI automatically reject candidates?
Vietnamese law currently has no provision that specifically bans this, but the employer remains responsible if the outcome is discriminatory under the 2019 Labour Code and must process candidate data under Law 91/2025. The safe approach is for AI to suggest and an authorised person to decide.
Do we have to delete CVs of unsuccessful candidates?
Yes. Under clause 1 of Article 25 of the 2025 Personal Data Protection Law, the recruiter must delete or destroy information an applicant provided if they are not hired, unless otherwise agreed with that person, for example if the candidate agrees to be kept on file for future roles.
Is recruitment AI a high-risk AI system in Vietnam?
The early-2026 draft list proposed this with a threshold of 500 workers a year. The official list in Decision 33/2026/QD-TTg (effective 15 August 2026), covers six sectors and does not include labour or employment. Watch for amendments to the list.
Can we paste CVs into a public AI chatbot to summarise them?
Avoid it if the tool has no data processing agreement and it is not covered in the notice to candidates. CVs are personal data; sharing them with third parties must match the stated purpose and comply with Law 91/2025.
What should we not ask candidates?
Information that does not serve the recruitment purpose and may lead to discrimination, such as marital status, plans to have children or religion, unless it stems from the specific requirements of the job as permitted by law.