Quick answer: Putting candidate data into an AI assistant is not illegal in itself, but how you do it matters. Use a business plan that keeps your data out of model training, tell candidates how you use their data, keep a person in charge of hiring decisions, and check the AI hiring rules where you recruit. Consumer plans of ChatGPT and Claude can use chats for training unless the user opts out; their business plans do not by default.
Dates to know: Illinois AI notice rules took effect January 1, 2026. California’s automated decision rules apply from January 1, 2027, as does Colorado’s rewritten AI law. The EU’s high risk employment rules were pushed to December 2, 2027.
Note: this is a plain English overview, not legal advice. Have employment counsel review your setup.
Is it legal to put candidate resumes into ChatGPT or Claude?
Generally yes, with conditions. US law has no blanket ban on processing candidate data with AI. The risk comes from three places: your AI vendor’s data terms, the privacy notice you gave candidates, and AI hiring laws that apply when AI helps make an employment decision. Staffing firms carry more exposure than most employers because, as the ASA’s general counsel has noted, their candidate databases can be tens of thousands deep, in a Jackson Lewis interview.
Do ChatGPT, Claude and Copilot train on your data?
It depends on the plan. The pattern across vendors is consistent: consumer tiers train by default and business tiers do not, according to a review of vendor pages as of October 9, 2026 by Digital Applied.
| Plan type | Examples | Trains on your data by default? |
|---|---|---|
| Business and enterprise | ChatGPT Business and Enterprise, Claude Team and Enterprise, Gemini in Workspace, Copilot for work | No |
| Consumer, paid or free | ChatGPT Free and Plus, Claude Free, Pro and Max, personal Gemini | Yes, unless the user turns it off |
For Claude specifically, Anthropic changed its consumer terms in 2025 so that chats can train models if users allow it, with retention extended to five years for those users, and said the change does not apply to Claude for Work, which covers its Team and Enterprise plans, per Anthropic’s announcement. OpenAI’s enterprise privacy page states that it does not train on business data, per OpenAI enterprise privacy.
The practical rule for an agency: agency data goes only into a business plan you control. That is also the first rule in our agency AI policy template, and we compare the plans in our assistant comparison.
Does MCP change the privacy picture?
Yes, in two ways. First, scale: an MCP connection lets the AI read live records from your ATS rather than the one resume you pasted, so more candidate data passes through the AI provider. Second, the bridge itself: if you use a third party MCP service, such as the options in our Bullhorn MCP guide, that company also handles your candidate data and needs to be in your vendor review.
Limit what each connection can reach. Leave out sensitive fields such as pay history, medical notes and background checks, and connect through an account with narrow permissions. Our guide to protecting your database covers the settings.
Which AI hiring laws apply to staffing agencies?
These are the main ones to know in 2026. Staffing firms recruit across state lines, so a single desk can be covered by several.
| Law | Who it covers | What it requires | Status |
|---|---|---|---|
| NYC Local Law 144 | Employers and employment agencies using automated employment decision tools for NYC roles | Annual independent bias audit, published results, notice to candidates | In force since 2023 |
| Illinois HB 3773 | Employers with Illinois employees or applicants | No discriminatory AI use, no zip codes as a proxy, notice when AI is used in employment decisions | In force since January 1, 2026; notice rules not yet final |
| California CCPA ADMT rules | Mid to large businesses deciding about California residents | Risk assessments, notice, opt out and access rights for automated decisions | Compliance by January 1, 2027 |
| Colorado SB 26-189 | Deployers of automated decision tools in consequential decisions | Disclosure and human review rights | Replaced the original AI Act; effective January 1, 2027 |
| EU AI Act | Anyone using AI to screen or evaluate candidates in the EU | High risk obligations for recruitment AI | Delayed to December 2, 2027 |
New York City
Local Law 144 makes it unlawful for an employer or an employment agency to use an automated employment decision tool unless it has had a bias audit within the past year, the results are public and candidates get notice, per the law and its rules. Notice must come ten business days before use, per National Law Review. Employment agencies are named in the law, so staffing firms are squarely covered when AI scores or ranks candidates.
Illinois
Since January 1, 2026, Illinois treats discriminatory AI use and undisclosed AI use in employment decisions as separate civil rights violations. The state’s Department of Human Rights proposed notice rules on May 15, 2026 and withdrew them on June 2, 2026, with no refiling date, per CASRAI’s tracker. The duty to give notice still applies even without detailed rules.
California
California’s privacy regulator finalized rules on automated decision making technology. Covered businesses must comply by January 1, 2027, including risk assessments before using ADMT for significant decisions about people, per Littler’s summary. Separate employment rules on automated decision systems from the state’s Civil Rights Council took effect October 1, 2025, per Inside Privacy.
Colorado
Colorado’s original AI Act never took effect. Governor Polis signed SB 26-189 on May 14, 2026, which repeals and replaces it with a narrower framework built on transparency and consumer rights and pushes the start to January 1, 2027, per Eckert Seamans.
European Union
If you recruit in Europe, GDPR already applies to candidate data, and the EU AI Act treats recruitment AI as high risk. The EU agreed to delay those high risk obligations from August 2, 2026 to December 2, 2027, but did not remove them, per Gibson Dunn.
What should an agency do before using AI on candidate data?
- Move to a business plan. No agency data in consumer AI accounts.
- Inventory every AI tool and connection. The ASA’s legal sponsor Staffing GC recommends inventorying each AI tool, mapping where it is used, scheduling required audits, building candidate notification workflows and standardizing record retention, in ASA’s legal column.
- Update your candidate privacy notice. Say that you use AI tools to process applications and how a person stays involved.
- Keep humans on decisions. Use AI to draft, search and summarize. Be careful before letting it score or rank candidates, which is where most of these laws bite.
- Review third party bridges. Any MCP or integration vendor handling candidate data needs a data processing agreement.
- Watch for hidden instructions. Files from outside can try to steer your AI; see resume prompt injection.
Quick answers
Does ChatGPT Plus train on my data?
By default, consumer ChatGPT plans can use your chats to improve models unless you turn that off in Data Controls. Business plans do not by default.
Does Claude Pro train on my data?
Claude’s consumer plans, including Pro, can use chats for training if the setting is on. Team and Enterprise plans are not covered by that change.
Do staffing agencies count as employers under AI hiring laws?
Often yes. NYC Local Law 144 names employment agencies directly. Other laws vary, so check each one.
Is using AI to summarize a resume an automated decision?
Usually the laws focus on tools that score, rank or filter candidates. A summary a recruiter reads is lower risk, but ask counsel about your exact workflow.
Did the Colorado AI Act take effect?
No. It was replaced by SB 26-189, effective January 1, 2027.
When do EU AI Act hiring rules apply?
December 2, 2027 for standalone high risk systems, after the 2026 delay.
The bottom line
Candidate data and AI can work together legally, but only on business plans, with honest candidate notices, humans on hiring decisions and an eye on the AI hiring laws in each place you recruit. The calendar is filling up: Illinois now, California and Colorado on January 1, 2027, the EU in December 2027. For every guide in this series, see MCP for staffing agencies.
Sources: Jackson Lewis, Digital Applied, Anthropic, OpenAI, NYC Local Law 144, National Law Review, CASRAI, Littler, Inside Privacy, Eckert Seamans, Gibson Dunn, ASA
Free newsletter
Get the Work Insiders weekly
One email a week: the recruiting and HR tech news that mattered, the tools we just added to the directory, and one practical guide. No spam, and you can unsubscribe in one click.