Most strong candidates are not applying anywhere. Recruiters spend hours turning a vague brief into search strings, scanning profiles and writing messages that mostly go unanswered. A sourcing agent converts the brief into criteria, searches networks and talent pools, ranks people against the role with a stated rationale, drafts individual outreach and passes positive replies to the ATS. In the EU it is a regulated activity: the people are not in a funnel they entered, so GDPR Art. 14 notification applies, and ranking people for recruitment is high-risk under the AI Act.
Problem & value
- Today: sourcers and recruiters iterate Boolean searches in LinkedIn Recruiter, GitHub and talent databases, copy details into spreadsheets, write messages by hand and chase replies. Shortage roles (engineering, skilled trades, healthcare) are filled mainly from passive candidates.
- AI value: faster search from brief to shortlist, semantic matching beyond keyword titles, consistent personalised outreach at volume, automatic follow-ups and ATS hygiene. Humans keep the relationship and the decisions.
- Evidence: LinkedIn positions its Hiring Assistant as an agent that takes over sourcing and outreach work for recruiters and has moved to a second generation in 2026 [1]. Vendor claims on hours saved or response-rate uplift exist but are mostly self-reported; measure your own baseline.
- Distinct from neighbours: AGENT-008 screens people who applied; AGENT-007 targets buyers. Here the candidates did not ask to be contacted, which drives the legal analysis.
Variants
- In-house talent acquisition: agent inside the existing recruiter licence and ATS.
- Staffing and executive-search agencies: higher volume, talent-pool rediscovery and multi-client separation of data.
- Technical sourcing: GitHub, Hugging Face, Stack Overflow and open-source contribution signals.
- Talent-pool rediscovery: re-ranking silver medallists and past applicants in the own ATS/CRM (lowest legal risk, often the best first step).
- Public sector / university hiring: only advertised procedures; active approach of individuals is often restricted by procurement and equal-treatment rules.
- Private use: not applicable.
How it works
- hiring brief (intake call, JD, hiring-manager notes)
- criteria extraction (must-have / nice-to-have / exclusions; remove protected attributes)
- source search (licensed recruiter APIs, GitHub, own ATS/CRM, talent marketplaces)
- profile normalisation + dedup against ATS and do-not-contact list
- matching & ranking (embeddings + reranker + LLM rationale tied to profile evidence)
- recruiter review of shortlist (human-in-the-loop #1)
- outreach drafting (role-specific, with Art. 14 privacy notice and opt-out)
- recruiter approval of template / first sends (human-in-the-loop #2)
- sequence + reply classification (interested / not now / stop)
- ATS handoff with source, lawful-basis record and retention date
- Criteria extraction: an LLM converts the brief into structured requirements; recruiters confirm. Strip proxies for age, gender, origin or health before ranking.
- Matching: hybrid retrieval (embedding + keyword) followed by a reranker, then an LLM explains fit using only cited profile facts. No inference of personality, emotions or protected traits.
- Agent loop: tool calls for search, enrichment, email/InMail, ATS write-back; spending, volume and platform-rate limits enforced in code, not in the prompt.
- Human-in-the-loop: shortlist approval, template approval, no autonomous rejection; stop requests and objections (Art. 21 GDPR) are executed immediately.
Data preparation
Needed data: the hiring brief and job profile (often a Word file), the ATS and talent pool (past applicants, silver medallists), employer-brand content, and external candidate sources such as professional networks, GitHub or public profiles. In SMBs, applicant data lies in mailboxes, folders and spreadsheets, job profiles are vague, and old applicants have no recorded consent or deletion date.
Preparation steps: - Write clear, skill-based job profiles and must-have versus nice-to-have criteria, see PREP-016 and PREP-019. - Consolidate applicant data into the ATS, remove duplicates and expired records, see PREP-003 and PREP-005. - Check legal basis, purpose and deletion periods before reusing talent-pool data, see PREP-025. - Pseudonymise profiles in test sets and remove protected attributes from ranking inputs, see PREP-022. - Create a small evaluation set of past hires with expert ratings, see PREP-018.
Tools: ATS export or API, spreadsheet, a document parser for CVs (DOC-018 if applicable). Rough share of effort: about 30 percent, much of it legal clarification and criteria definition. Use GUIDE-003 as a checklist.
Implementation paths
Which path for whom
- SMB (A): Sourcing tools with EU hosting and ATS integration exist; recruiting is a standard process and SMBs lack the capacity to build or run their own scraping and ranking.
- Enterprise (B): Own ATS, talent pool and employer-branding rules need integration, and a high-risk classification calls for control over ranking logic, logs and bias tests.
- Developer (B): Cloud APIs with embeddings and a reranker allow quick prototypes, while data from professional networks is subject to platform terms and GDPR.
Path A — Buy (recommended for most SMBs)
- Network-native: LinkedIn Hiring Assistant (add-on to LinkedIn Recruiter, available in English, German and French, further languages announced) [1][2].
- Sourcing platforms: hireEZ, Juicebox, Gem, SeekOut, Findem, Fountain, agents; EU/DACH-origin options include ATS-integrated sourcing in Personio, Softgarden, Teamtailor (Sweden), Join, Prescreen and Workable-type ATS add-ons (verify current features).
- Check: EU data residency, which data sources are licensed vs scraped, DPA and sub-processor list, configurable lawful-basis and Art. 14 notice templates, audit log, bias testing evidence and AI Act provider documentation.
- Choose A when: under ~10 recruiters, no in-house ML team, ATS already integrates.
Path B — Build on cloud APIs
- Models: an EU-hosted frontier or EU-provider LLM (Mistral, or Claude/GPT/Gemini via EU regions) for brief parsing, rationale and drafting; text embeddings plus a reranker for matching.
- Data: licensed sources only: LinkedIn Talent Solutions / Recruiter System Connect partner integrations, GitHub REST/GraphQL API within its terms, own ATS API [3]. Do not scrape sites whose terms forbid it.
- Orchestration: n8n, Temporal or an agent framework; write-back to ATS (Greenhouse, Lever, Personio, SmartRecruiters APIs); email via the company domain with SPF/DKIM.
- Choose B when: you need custom ranking logic, multi-source pools or tight ATS integration.
Path C — Self-host (open source)
- Models: open-weight LLMs (Mistral, Qwen, Llama, gpt-oss class) via vLLM or Ollama; BGE/E5 or Qwen3 embeddings and an open reranker; Qdrant/pgvector for the pool index.
- Stack: self-hosted n8n or Langflow, Postgres, own ATS (e.g. OpenCATS/Frappe-style) or API bridge.
- Hardware: HW3 for a 30-70B model serving several recruiters; HW2 suffices with a ~8-14B model for drafting and rationale. Value mainly for sovereignty over a candidate pool.
Path D — Custom training
Rarely justified. A fine-tuned ranker on your own hire/no-hire history risks encoding past bias and needs a validity and fairness study; prefer retrieval + rules. Fine-tune only for response prediction on thousands of own outreach events, with bias auditing.
State of the art (2026)
- Agentic sourcing is productised: LinkedIn announced Hiring Assistant 2 on 29 September 2026, with a free automatic upgrade for English-language customers from November [1]; specialist tools bundle search, enrichment, scoring and sequencing in one agent.
- Semantic and natural-language search replaced much Boolean craft; ranking quality depends on profile completeness, which is weakest for people who rarely update profiles.
- Limits: stale or self-reported profiles, hallucinated rationale, systematic bias against non-linear careers and women (documented in earlier automated tools), outreach fatigue, platform rate limits and terms that forbid automation or scraping. Reply rates for generic AI messages decline as volume rises; no independent benchmark of "hire quality" exists.
Shared resources & combinations
- Capabilities shared with AGENT-008 (matching, embeddings, reranker), AGENT-007 (outreach sequencing, enrichment), AGENT-011 (profile dedup/hygiene) and CONV-017 (candidate chat).
- Natural chain: AGENT-033 sources and contacts, CONV-017 handles questions, AGENT-008 screens applicants, AGENT-009 onboards the hire, AGENT-025 monitors and evaluates the agent fleet.
- One vector index and LLM server (HW2/HW3) can serve all recruiting use cases.
Effort, cost & KPIs
- Path A: days to weeks; per-seat licences (LinkedIn Hiring Assistant is an add-on that needs a Recruiter seat; LinkedIn publishes no list price; a third-party estimate for the UK in 2026 is around GBP 1.6-2.1k per licence per year [7]).
- Path B: 2-4 months incl. legal review, ATS integration and bias testing; cost driven by licensed data access, not tokens.
- Path C: 3-5 months; GPU server plus operations.
- KPIs: time-to-shortlist, qualified-shortlist acceptance rate by recruiter, outreach response rate, positive-reply-to-interview rate, time-to-hire, opt-out/complaint rate, selection-rate ratio across gender/age groups (adverse-impact check), share of contacts with logged Art. 14 notice.
People & change
Involve management, the hiring department leads, the recruiters or HR team as daily users, the data protection officer and legal early, since collecting profiles of people who did not apply is legally delicate (information duties under Art. 14 GDPR, platform terms). A DPIA is likely (systematic evaluation of people at scale); sign an AVV with every provider (GUIDE-005).
Works council: yes, if one exists. Besides §87(1) no. 6 and §90(1) no. 3 BetrVG, §95(2a) requires selection guidelines to be agreed when AI is used in hiring; §80(3) allows engaging an AI expert (GUIDE-004). Candidate ranking is a high-risk use under Annex III of the AI Act, with duties applying from 2 Dec 2027 after the Digital Omnibus (GUIDE-014); Art. 50 transparency applies to candidate-facing chatbots since 2 Aug 2026.
Support AI literacy (Art. 4 AI Act) for recruiters, including bias awareness and the limits of rankings (GUIDE-006). Start with one or two roles and a small recruiter group (GUIDE-009). Typical concerns: discrimination and impersonal outreach. Address them with documented criteria, regular bias checks, personalised wording approved by a human, and the rule that the agent never rejects anyone: people make every selection decision (GUIDE-008).
Risks, regulation & compliance
- EU AI Act: AI systems used to target job advertisements, analyse and filter applications or evaluate candidates are high-risk under Annex III point 4(a) [4]. Obligations on deployers include human oversight, logging, informing workers and candidates and data governance; providers need conformity assessment. Application dates for Annex III were pushed back by the 2026 digital simplification package (reported as 2 Dec 2027); verify the final text. Art. 4 AI literacy already applies. Art. 5 prohibitions: no emotion recognition in the workplace, no biometric categorisation inferring sensitive traits, no social scoring; do not infer personality, mood or health from photos, voice or social media.
- GDPR: data not obtained from the person triggers Art. 14: tell them who you are, purpose, source, lawful basis and rights at first contact and at the latest within one month [5]. Public availability is not consent; legitimate interest (Art. 6(1)(f)) needs a documented balancing test, data minimisation to role-relevant facts, short retention for non-responders (delete) and honouring objection (Art. 21). Art. 22 limits solely automated decisions with significant effect; keep humans deciding. A DPIA is usually required for profiling at scale. Special-category data (Art. 9) must not be collected.
- Other law: unsolicited electronic messages may fall under ePrivacy/UWG rules (in Germany, cold contact by email or phone to candidates is restricted; postal or in-network messages are safer); platform terms of service; national works-council co-determination (e.g. BetrVG s. 87); anti-discrimination law (AGG). DPA opinions vary by member state: check your authority.
- Mitigations: licensed data only, DPIA and LIA, bias audit before go-live and quarterly, suppression list synchronised with the ATS, rate limits, prompt-injection filtering on profile text, full audit log.
Getting started
- Define scope with HR, legal and the works council: sources allowed, lawful basis, retention, notice text.
- Pilot talent-pool rediscovery inside your own ATS (existing relationship, lowest risk).
- Run one tool trial (e.g. LinkedIn Hiring Assistant or an EU ATS add-on) on two live roles, with recruiters approving every shortlist and message.
- Complete the DPIA and legitimate-interest assessment; add the Art. 14 notice and opt-out to every first message.
- Track KPIs and adverse-impact ratios for 3 months before scaling volume.
Sources
- LinkedIn — Hiring Assistant 2 announcement — https://news.linkedin.com/2026/hiring-assistant-2
- LinkedIn Talent Solutions — Hiring Assistant product page — https://business.linkedin.com/hire/hiring-assistant
- GitHub Docs — REST API and acceptable use — https://docs.github.com/en/rest
- Regulation (EU) 2024/1689 (AI Act), Annex III point 4 — https://eur-lex.europa.eu/eli/reg/2024/1689/oj
- GDPR Art. 14, information where data are not obtained from the data subject — https://gdpr-info.eu/art-14-gdpr/
- EDPB — guidelines and opinions on legitimate interest and AI models — https://www.edpb.europa.eu/our-work-tools/general-guidance/guidelines-recommendations-best-practices_en
- HeroHunt — LinkedIn Hiring Assistant 2: features, cost, limits (third-party) — https://www.herohunt.ai/blog/linkedin-hiring-assistant-2-2026-features-cost-limits/