Nobody replaces Workday or SuccessFactors to improve a sift. The implementation cost is enormous, the integration surface reaches payroll and finance, and the business case for replacing a working HR platform because shortlisting is slow does not survive a single finance review. The realistic option is to leave the platform untouched and add screening as a component alongside it.
This is written for enterprise talent acquisition teams who already know they are not migrating, and need to know what adding a layer actually involves.
Why the Platform Is Not the Problem
Workday and SuccessFactors are human capital management systems. Recruiting is one module among core HR, payroll, absence, performance and reporting. They are bought to be a single system of record for the workforce, and they succeed at that.
What they are not is a volume triage tool. A requisition attracting 600 applications produces 600 orderly records, correctly routed, fully auditable, and entirely unread. The platform has done its job. The sift is still a reading exercise, and it is happening in an evening.
The AI features in these platforms are generally assistive, which is a reasonable design choice for a system of record. It does mean the evaluative work sits elsewhere.
What Adding a Layer Involves
Enterprise integration is a governance exercise more than a technical one, and pretending otherwise wastes everybody's time.
The Technical Part
Applications remain in the platform. Candidate documents and the requisition criteria are passed to the screening layer, which returns a score, a per-requirement classification of evidenced, claimed or missing, and a written rationale per candidate. That comes back as structured data attached to the candidate record, and every subsequent stage runs in the platform.
Both platforms support integration patterns for this, and both have partner ecosystems built around exactly this kind of adjacency. The realistic routes are an API integration through your existing integration platform, or a file-based exchange on a schedule. File-based is unglamorous and frequently the fastest path to a pilot.
The Governance Part
This is where the timeline actually lives. Expect a data protection impact assessment, an information security review, a third-party risk assessment, an equality analysis of the selection process, architecture sign-off, and in regulated sectors an operational resilience review. Start these in parallel with the pilot rather than after it.
The Questions Your Review Boards Will Ask
Have the answers before the first meeting, in writing from the vendor.
- Where is candidate data processed and stored, and in which jurisdiction?
- Is candidate data used to train any model, ever, including in aggregate?
- What is the retention period, and can deletion be automated on our schedule?
- Can a per-candidate rationale be exported in response to a subject access request?
- Who are the sub-processors, and what happens when that list changes?
- How is human oversight designed, and can a reviewer actually overturn a score?
- What is the equality analysis, and how often is it reviewed?
- What are the throughput ceilings at our volume?
Questions one, two and four are usually decisive. A vendor who processes candidate CVs outside the UK, or who cannot produce a per-candidate rationale, will not clear a UK enterprise review for a high-volume recruitment use case.
The Regulatory Backdrop
Two threads matter for an enterprise deploying screening technology.
Under UK law the obligations already apply. UK GDPR and the Data Protection Act 2018 constrain automated decision-making, require a lawful basis, and expect a data protection impact assessment for high-risk processing. The Equality Act 2010 applies to selection regardless of what produced the outcome, and public bodies carry the public sector equality duty on top.
Under the EU AI Act, recruitment AI is high-risk under Annex III. The substantive obligations for standalone Annex III systems now apply from 2 December 2027 following the Digital Omnibus amendment, having originally been set for 2 August 2026, with transparency obligations landing earlier on 2 December 2026. If your group has EU entities or you recruit for EU-located roles, that timetable is yours. Check it rather than relying on guidance written before the change.
A Pilot That Will Actually Get Approved
Enterprise pilots fail for predictable reasons: too broad, no defined success measure, and governance started too late.
Scope it narrowly. One business unit, one role family with a genuine volume problem, three to five requisitions, historical applications from roles you have already filled so no live candidate is affected by an unproven process. That last point removes most of the objection and lets you begin while the impact assessment is still in progress.
Define success in advance: does the shortlist contain the people you actually hired, can a hiring manager read and accept the rationale, and what is the elapsed time end to end including manual handling. Anything else is a demonstration rather than a pilot.
What Not to Attempt
Do not try to replace the platform's pipeline. Do not let the integration become a programme before you have evidence the workflow change is worth it. And do not deploy scoring with no human able to overturn it, because that is both an operational risk and the fastest route to a data protection problem.
Frequently Asked Questions
Will This Break Our Existing Integrations?
It should not, because the layer sits adjacent rather than in the transaction path. Confirm in architecture review, particularly if candidate data flows onward to payroll or identity systems.
Can We Use the AI Already Licensed in Our Platform?
Test it on historical requisitions. If it produces a defensible per-candidate rationale against your criteria, use it and save the procurement. If it produces a score nobody can explain, it will not clear the same review board questions listed above.
How Long Does This Take to Approve?
Governance dominates the timeline. Running the impact assessment, security review and equality analysis in parallel with a historical-data pilot is the main lever available.
What About Works Council or Employee Representative Consultation?
Where you have EU entities, note that informing workers and their representatives before deploying a high-risk AI system in the workplace is a discrete obligation under the EU AI Act, separate from data protection. Factor it into the timeline.
Is File-Based Integration Acceptable at Enterprise Scale?
For a pilot, almost always. For production it depends on volume and on your security posture, since file exchange introduces handling considerations an API avoids.
The Position
Keep the platform. Add screening as an adjacent component on historical data first. Get the eight governance answers in writing before your first review board. Define success as shortlist quality and end-to-end elapsed time rather than processing speed.
The organisations that do this successfully treat it as a narrow workflow improvement with a governance workstream attached, not as a technology programme.
This article is general guidance, not legal or architectural advice. Workday and SAP SuccessFactors are products of their respective owners and we have no affiliation with them. Take specialist advice on data protection, equality and AI obligations for your own deployment.
Sources
Information Commissioner's Office. Rights Related to Automated Decision Making Including Profiling.
https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/rights-related-to-automated-decision-making-including-profiling/
Information Commissioner's Office. Data Protection Impact Assessments.
https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/data-protection-impact-assessments-dpias/
Information Commissioner's Office. Guidance on AI and Data Protection.
https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/
The Stationery Office. Data Protection Act 2018.
https://www.legislation.gov.uk/ukpga/2018/12/contents
EU Artificial Intelligence Act. Annex III: High-Risk AI Systems Referred to in Article 6(2).
https://artificialintelligenceact.eu/annex/3/
Publications Office of the European Union. Regulation (EU) 2024/1689 Laying Down Harmonised Rules on Artificial Intelligence.
https://eur-lex.europa.eu/eli/reg/2024/1689/oj
The Stationery Office. Equality Act 2010.
https://www.legislation.gov.uk/ukpga/2010/15/contents
The Stationery Office. Equality Act 2010 Section 149: Public Sector Equality Duty.
https://www.legislation.gov.uk/ukpga/2010/15/section/149
InsightCircle
