AI Impact Assessment: Candidate Screening

Version 1.3 · Last Updated: November 1, 2026 · Assessment date: November 1, 2026 · Owners: the CEO and the CTO · Review: every 6 months

This is the customer-facing summary of Lighthouse's internal AI impact assessment for candidate screening. It is Lighthouse's own assessment, not legal advice. Each customer remains responsible for its own legal analysis and its duties as employer.

What the assessment covers

How Lighthouse uses AI to parse, classify and score job applications, what data that involves, where it is processed, which laws apply, the risks to candidates, and the controls in place.

How resume screening works

A resume is parsed into a structured profile by an OpenAI model, pinned to a dated version and run at temperature 0. The same provider labels each employer's industry and normalizes locations. The profile has no fields for sex, race, age, disability, religion or national origin, and the system is not designed to use them.
Lighthouse's scoring engine, which is deterministic code rather than a model, scores the profile against the posting's scorecard; language models do not score candidates. Because parsed fields such as industry and seniority feed the rules, the independent bias audit Lighthouse commissions each year evaluates the whole pipeline, parsing plus scoring. A summary of the audit is published at https://www.lighthousehiring.ai/assets/docs/lighthouse-bias-audit-2026.pdf. The component scores and the matched requirements behind each score are stored and shown to platform users.
The customer's platform users make hiring decisions. Customers can also build automations that move candidates between stages based on the score. No automation is on by default: a customer user creates, reviews and activates each one, per job posting, and Lighthouse does not configure them. A stage, including a rejection stage, is a list for the customer's users to review, and moving a candidate there is not by itself a rejection. Whether to automate, and whether to email a candidate from an automation, is the customer's decision, under terms that require meaningful human review before any adverse decision.

Lighthouse does not train or fine-tune models on customer or candidate data.

Data sent to AI providers

OpenAI

OpenAI receives:

The text of each resume, for parsing.
For AI-written fit summaries, the candidate's resume or parsed profile and their score.
Job and location details.

Resumes typically contain:

Name and contact details, such as email address, phone number and location.
Work history: employers, job titles, dates, and descriptions of duties and achievements.
Education: institutions, qualifications and dates.
Skills, certifications and languages.
Links, such as a professional networking profile or portfolio.
Other details a candidate chooses to include, such as interests or volunteer work.

What a resume contains varies from candidate to candidate; OpenAI receives whatever text the candidate's resume includes.

Google Gemini API (paid tier)

Gemini is used for assistance features for platform users, including:

Drafting and formatting job descriptions, and filling in job posting details from an uploaded job description.
Drafting the search criteria a scorecard is built from, and suggesting scorecard improvements.
Suggesting interview questions.
Drafting campaign emails.
Searching past applicants.

Candidate data sent:

The scorecard optimizer, a chat assistant that proposes scorecard changes, sends details for up to 8 applicants at a time (job titles, employers, industries, tenure, education, stage and score), without names or contact details.
The other features send no individual candidate's data.

Under the terms in force, neither provider uses this data to train its models. Staff use of AI tools, including Anthropic's Claude, is governed by Lighthouse's AI governance policy, and candidate personal information is not entered into general-purpose AI assistants.

Where data is processed

Component	Location
Application services (Google Cloud)	United States (us-central1, us-east1 and us-east4)
Candidate apply site (Google Cloud)	United States (us-central1)
Database (Supabase)	United States
Automation platform (Railway)	United States
OpenAI	United States by default
Google Gemini API	No processing-location guarantee

Lighthouse relies on PIPEDA's accountability principle and on provider data processing terms for processing outside Canada. Our transfer assessment is written so that it can also support a customer's assessment under section 17 of Quebec's private-sector privacy act. It finds the protection adequate under the contracts in force for our cloud, database and automation providers and for OpenAI, and adequate for the limited, pseudonymous data sent to the Gemini API. Access by US authorities under US law is a residual risk we accept and review every year with this assessment.

Laws that apply to AI screening

Lighthouse complies with all of the laws below, as they are stated by their legislatures and interpreted by their regulators, wherever they apply to Lighthouse as a service provider to its customers and as the developer of its screening system. Lighthouse also supports each customer in meeting its own obligations as employer. The notes under each law show how it relates to the platform; they are not a complete statement of the law. The list covers the principal laws relevant to AI screening and is not exhaustive.

When a job is created in the platform, the platform identifies AI and automated-hiring disclosure rules from the job location and presents them to the platform user with suggested wording for the job description.

Canada

PIPEDA: organizations need consent and a valid purpose to collect and use personal information in hiring. Lighthouse acts as a service provider to the customer, which stays in control of candidate information.
Canadian Human Rights Act: prohibits employment discrimination on protected grounds, including through AI-driven decisions; our annual bias audit tests scoring for such disparities.
Ontario Employment Standards Act (Working for Workers Four Act, 2023): employers with 25 or more employees must disclose in job postings any use of AI to screen or select applicants. This is the employer's duty; the platform's disclosure rules include Ontario postings.
Quebec Law 25: an automation that rejects a candidate and tells them so, based on the score, is a decision based exclusively on automated processing under section 12.1. The customer that makes it must inform the candidate and offer a review; Lighthouse stores the score factors needed to explain the decision.

United States

NYC Local Law 144: Lighthouse commissions an independent bias audit of its scoring every year; the most recent was completed in August 2026, with a lowest impact ratio on the final score of 0.976 across sex and race categories, including intersectional categories that combine sex and race, on a synthetic balanced dataset. The summary is published at https://www.lighthousehiring.ai/assets/docs/lighthouse-bias-audit-2026.pdf. Candidate notice is the employer's duty; the platform's disclosure rules include New York City postings.
California: the Civil Rights Council's automated-decision system regulations require that AI tools in employment decisions do not cause unlawful disparate impact and that employers keep records of their use; the California Privacy Rights Act gives residents rights over their personal information. Lighthouse stores the component scores and matched requirements behind each score, which supports a customer's records.
Illinois Artificial Intelligence Video Interview Act and Maryland HB 1202: cover AI analysis of video interviews and facial recognition in interviews; Lighthouse does neither.
Connecticut, Virginia and Utah consumer privacy acts: largely exclude applicant and employee data; we track them for changes.

European Union and United Kingdom

GDPR and UK GDPR: Lighthouse has no customers or hiring in the EU or UK, so the GDPR does not apply to its processing.
EU AI Act: employment screening is high-risk under Annex III; Lighthouse would be the provider and customers the deployers where the system is used in the EU, which it is not.

Laws we monitor

Colorado (SB 26-189, Automated Decision-Making Technology): signed on 14 May 2026, it repeals and replaces the Colorado AI Act (SB 24-205) and applies to consequential decisions, including employment decisions, made on or after 1 January 2027. It covers technology that materially influences such a decision. Developers must give deployers documentation on intended and inappropriate uses, known limitations and appropriate human review, tell them of material changes, and keep compliance records for 3 years; deployers must give notice, explain adverse outcomes and offer human review. Lighthouse is assessing how the law applies to its platform.

Lighthouse re-assesses its obligations before entering a new jurisdiction.

Risks to candidates and the controls in place

Risk	What the risk means	Control
A parse error lowers a score	The model misreads or leaves out information in a resume, so the candidate's profile, and the score built from it, understate their experience.	Any change to the parse model, prompt, output format or settings passes a blind evaluation and model comparison before release, and a worse result blocks the release unless the CTO accepts it with a written reason. Every parse uses a dated model version and automatic output checks.
Scoring disadvantages a protected group	Candidates of a particular sex, race or other protected group receive systematically lower scores than comparable candidates outside that group.	An independent auditor tests the pipeline, parsing plus scoring, for disparities between demographic groups every year, covering the changes made since the previous audit. Owner: the CTO.
A candidate is moved or rejected by a customer automation with no person involved	A candidate's stage changes, or they are told of a decision, based only on their score, without a person reviewing it.	An automation acts only once a customer user activates it, and customer terms require meaningful human review before any adverse decision.
A customer does not tell candidates AI is used	Candidates apply without being told that AI is used to process their application, where the law requires notice.	Disclosure rules identified from the job location and presented to the platform user with suggested wording; customer terms place notice on the customer.
A model-written summary reaches the wrong recipient	An AI-written assessment of a candidate is sent to the candidate, or to another recipient it was not intended for.	The platform does not insert fit summaries into messages addressed to candidates; summaries are intended for hiring managers and other recipients the customer chooses. Owner: the CTO.
A scoring adjustment acts as a proxy for a protected characteristic	A scoring rule that looks neutral, such as one based on years in a role or time since a role was held, disadvantages a group defined by a protected characteristic, such as sex or race.	Adjustments for tenure and for time since a role was held are set per scorecard, drafted by AI from the job description and the platform user's answers, and editable by platform users at any time; the annual bias audit tests the whole pipeline, parsing plus scoring, for disparities by sex and race. Owner: the CTO.
A scorecard requirement is not related to the job	A candidate is scored on a requirement that does not reflect what the job actually needs.	The customer's platform users review the search criteria each scorecard is built from and can edit its requirements at any time. The bias audit measures disparities and does not assess job-relatedness, which remains the employer's responsibility.

Candidate rights and data retention

Candidate data is retained for up to six years, in line with our privacy policy, and deleted earlier on a formal request from the candidate or the customer. Candidates can send access, correction and deletion requests to the employer, or directly to Lighthouse at support@lighthousehiring.ca. Lighthouse acts on the requests it receives and involves the employer as required where a request concerns a customer's candidate data. Lighthouse deletes candidate and application records following a written procedure, and removes resume files from storage on request.

When this assessment is reviewed

Lighthouse reviews this assessment every 6 months, before customer security reviews, and whenever a model, provider, processing region or candidate-facing automation changes.

Sign-off

Approved by the CEO and the CTO on November 1, 2026.

Lighthouse AI Impact Assessment: Candidate Screening (summary)