Hiring is getting harder for small businesses.
Not because good people have disappeared. Not because every candidate is dishonest. Not because AI is automatically bad.
It is getting harder because everyone can now sound qualified.
AI can clean up a resume, polish a cover letter, strengthen screening answers, rehearse interview responses, and improve work examples. In some cases, it can help a genuinely strong candidate present themselves more clearly. In other cases, it can create a very convincing version of someone who cannot actually do the work.
That means the old hiring signals are getting weaker.
A clean resume does not prove skill. A polished cover letter does not prove judgment. A confident interview answer does not prove someone can operate inside your business.
Small businesses need to rethink hiring for the AI era.
The Problem Is Not AI. The Problem Is Blind Trust.
The point is not that every candidate using AI is dishonest.
That is not true.
Some of your best candidates will use AI well. In many roles, that is exactly what you want. You may want someone who can use AI to research faster, write clearer updates, explain technical work to clients, summarise information, or improve their own output.
The issue is that polish is no longer enough.
Before AI, a strong application might have been a useful signal. It showed communication ability, effort, attention to detail, and some level of competence. Now, much of that polish can be generated or heavily assisted.
That does not make the candidate bad. It just means the application is no longer the evidence.
It is a set of claims.
Your hiring process needs to verify those claims.
A Bad Hire Costs More Than the Salary
For a large company, a bad hire is painful. For a small business, it can be brutal.
It costs payroll. It costs time. It costs team energy. It costs customer trust. It slows momentum. It creates extra work for the owner. It can take months to realise the fit is wrong, and by that point the damage may already be done.
Small businesses also usually do not have large HR departments, recruitment teams, compliance processes, or layers of hiring checks. The owner or a small leadership team is often reviewing applications, interviewing, checking references, and making the final decision while still running the rest of the business.
That is why the process matters.
You cannot rely on instinct alone when AI has made applications harder to read. You need a simple system that tests skill, judgment, communication, honesty, and access risk before the person is fully inside the business.
Both Sides Are Using AI
Candidates are using AI. Employers are using AI. Recruiters are using AI. Job platforms are using AI.
That is the reality now.
Candidates may use AI to improve resumes, tailor cover letters, prepare for interviews, answer screening questions, or produce writing samples. Employers may use AI to summarise applications, score resumes, filter candidates, write job descriptions, and manage early screening.
There is nothing automatically wrong with that.
The risk is when either side pretends AI is not involved, or when the process becomes too automated to test what actually matters.
Gartner reported that only 26% of job applicants trust AI to evaluate them fairly. That should make employers pause. If you use AI in your hiring process, transparency and human review matter.
The candidate experience still matters. You are not just screening people. You are showing them how your business works.
AI Can Make Weak Candidates Look Stronger
AI is very good at making text sound more competent.
That creates a problem.
A candidate may have limited experience but submit a strong-looking resume. They may write a convincing answer to a screening question using AI. They may rehearse interview responses until they sound polished. They may submit work examples that were heavily assisted or generated.
Some of that is acceptable, depending on the role.
The real question is whether they understand the work.
Can they explain how they got to the answer? Can they talk through trade-offs? Can they spot mistakes? Can they revise based on feedback? Can they apply judgment when AI gives them something plausible but wrong?
That is what your hiring process needs to test.
The Resume Is a Starting Point, Not Proof
Treat the resume as a claim document.
It tells you what the candidate says they have done. It does not prove they can do it in your business.
That mindset changes the process.
Instead of asking, “Does this resume look strong?” ask:
Can we verify the claims?
Can they explain the work in detail?
Can they show previous results?
Can they describe a mistake or trade-off?
Can they talk through how they solved a real problem?
Can they demonstrate the skill in a small task?
This protects you from being impressed by polish.
A strong resume can still be useful. But it should open the door to verification, not replace verification.
Role Clarity Comes First
Before you test candidates, get clear on the role.
Many hiring problems start before the job ad is even posted. The business knows it needs help, but it has not clearly defined what problem this person is being hired to solve.
That makes it much harder to assess candidates.
Start with role clarity.
What problem is this person being hired to solve? What work will they actually own? What does success look like in 30, 60, and 90 days? What skills are truly required? What is only nice to have? What kind of judgment does the role require?
This should be more than a job description. It should be a job scorecard.
A job description says what the person will do. A job scorecard says what success looks like.
That distinction matters because you are hiring for outcomes, not just activity.
Build a Job Scorecard
A good job scorecard helps both sides.
It helps the business assess candidates against the real needs of the role. It also helps the candidate understand what will be expected after they join.
The scorecard should include the purpose of the role, the main outcomes, the tools they will use, the level of client contact, the decisions they will own, and the results expected in the first 30, 60, and 90 days.
Avoid vague goals like “support the team” or “help with admin.”
Be specific.
For example, instead of saying “manage customer follow-up,” say “respond to new support tickets within one business day, update the CRM after each interaction, and escalate unresolved issues using the support process.”
That gives you something to test during hiring.
It also gives the new hire a clearer start.
Use Proof Over Polish
Once the role is clear, the next principle is proof over polish.
Do not stop at a clean cover letter. Ask for examples. Ask candidates to walk you through their work. Ask where they made decisions. Ask what went wrong. Ask how they handled trade-offs.
Polished candidates often have prepared answers. That is fine. But a real candidate should be able to go deeper.
If someone says they managed a CRM migration, ask what system they moved from, what data caused problems, what fields had to be cleaned, what the team resisted, and what they would do differently next time.
If someone says they improved social media performance, ask which metric changed, what content they tested, what failed, what they stopped doing, and what they learned.
If someone says they are good with AI, ask them how they use it, when they do not use it, how they check outputs, and where they think AI creates risk.
Real experience has texture.
AI polish often goes thin when you ask for detail.
Add a Small Work Sample
A work sample is one of the best ways to test what is real.
It does not need to be long. In fact, it should usually be small, focused, and respectful of the candidate’s time.
The task should reflect the actual role. If you are hiring for customer support, give them a realistic support scenario. If you are hiring for operations, give them a small messy workflow to organise. If you are hiring for content, give them a short brief and ask for a draft plus a note explaining their thinking. If you are hiring for technical support, give them a real-world problem and ask how they would approach it.
The important part is not only the final answer.
The important part is the process.
Can they explain what they checked? Did they ask clarifying questions? Did they make reasonable assumptions? Did they use AI? Did they review the AI output? Did they spot the risk? Did they communicate clearly?
That tells you much more than a resume.
Consider Screen-Recorded Tasks
For some roles, a screen-recorded task can be useful.
You give the candidate a small task and ask them to record their screen while they complete it. They do not need to perform live. They can complete it in their own time, but the recording should show the process.
This helps you see how they think.
Do they understand the tool? Do they get stuck and recover? Do they use AI thoughtfully? Do they copy and paste blindly? Do they check the answer? Do they explain what they are doing? Do they notice when something looks wrong?
This can be especially helpful for technical, operational, spreadsheet, design, editing, or admin-heavy roles.
If the work sample is genuinely useful to the business, consider paying candidates for the task. That is fairer and tends to create a better candidate experience.
Be Clear About AI Use
Do not pretend AI is not part of the process.
Be upfront about your rules.
Can candidates use AI in the assessment? Should they disclose what they used? Are there parts of the test where AI is allowed? Are there parts where it is not allowed? Do you want them to explain how they used it?
This matters because AI use is not automatically a negative signal.
A candidate who uses AI well may be stronger than a candidate who refuses to use it at all, depending on the role. But the candidate needs to show judgment.
You want to know whether they understand when AI helps, when it should be checked, and when it should not be used.
A useful question is:
“Did you use AI at any point in this application or assessment? If so, what did you use it for, what did you change, and how did you verify the output?”
That question tests honesty, fluency, and judgment at the same time.
Test Judgment, Not Just Output
AI can help candidates produce an answer.
Your job is to test whether they understand it.
This is especially important in technical or knowledge-work roles. A candidate may get the correct answer because they used the right AI tool with the right prompt. That still does not prove they understand the problem.
Ask follow-up questions.
Why did you choose that approach?
What did you rule out?
What would you check next?
What could go wrong?
How would you explain this to a client?
What part of the AI output did you not trust?
What would you do if the first solution failed?
The goal is not to catch people out for using AI. The goal is to understand whether they have the judgment to use AI safely and effectively.
Use a Short First Interview
A simple 15-minute first interview can still be useful.
The purpose is not to run a full technical assessment. It is to check whether the person can communicate, whether the basic fit feels plausible, and whether there is enough there to continue.
This is where human contact becomes more important, not less.
When every application looks polished, a short human conversation can help you check whether the candidate is real, whether they can communicate clearly, and whether the person behind the application matches the written material.
Keep it simple.
Ask a few practical questions. Ask about something in their resume. Ask why they applied. Ask how they approach work. Ask something conversational that is not scripted.
Then decide whether they should move to the next stage.
Use Structured Interviews
Unstructured interviews can feel natural, but they are not always fair or useful.
A structured process makes it easier to compare candidates. It also reduces the chance that you are influenced by polish, confidence, or personal preference.
A simple structure might be:
First interview: culture and communication.
Second interview: competency and work sample.
Third interview: commitment, expectations, and fit.
After each stage, score the candidate against the same criteria. Keep notes. Decide in advance what good looks like.
That structure helps small businesses avoid making hiring decisions based only on who interviewed best.
In the AI era, interviewing well is easier to rehearse. The process needs to go deeper than that.
Verify Identity and References
Candidate fraud is becoming a bigger issue.
Gartner has predicted that one in four candidate profiles worldwide will be fake by 2028. That does not mean one in four people applying to your business today are fake, but it does show the direction of travel.
Small businesses need to take identity and reference checks more seriously.
Does the LinkedIn profile match the resume? Do the dates make sense? Do the references confirm the work? Does the candidate’s location, work history, and availability line up? Are there unexplained inconsistencies?
For higher-risk roles, identity verification may become more important. That includes roles with access to customer data, finance systems, code, sensitive documents, email accounts, CRM records, or admin controls.
This is not about paranoia.
It is about not handing access to the wrong person.
Be Careful With Agencies and Freelance Platforms
Agencies and freelance platforms can be useful. They can also create confusion if you do not know who is actually doing the work.
Sometimes you interview one person, but a different person completes the tasks. Sometimes a freelancer is really a small agency. Sometimes that is fine, as long as everyone is clear about it.
The key is transparency.
If you are hiring an agency, know that you are hiring an agency. Understand who will do the work, who manages quality, who has access to your systems, and what happens if someone on their team changes.
If you are hiring an individual contractor, make sure the person you interviewed is the person doing the work.
This matters because hiring is not only about output. It is also about trust, communication, data access, and accountability.
Hiring Is Also a Systems Decision
Hiring is not only a people decision. It is a systems decision.
When someone joins the business, they may need access to email, files, calendars, CRM records, client information, project tools, passwords, documents, payment systems, websites, analytics, or support platforms.
That access carries risk.
Before hiring, ask what tools the person will need. What do they need on day one? What should they only receive after trust is built? Can access be limited by role? Are business-owned accounts being used? Can you remove access quickly if the hire does not work out?
This should be part of the hiring plan, not an afterthought.
SixFive’s Google Workspace services can help small businesses structure users, groups, shared drives, access, and offboarding properly so every new hire does not become a permissions mess.
Do Not Share Passwords in Spreadsheets
If your onboarding process involves sending passwords in a spreadsheet, stop.
That is not a hiring process. That is a security problem.
Every person should have their own account wherever possible. Shared accounts should be avoided. If passwords need to be shared, use a proper business password manager. That way access can be granted, removed, audited, and controlled properly.
This becomes even more important when hiring contractors, offshore support, agencies, or remote team members.
The issue is not whether you trust the person today.
The issue is whether the business can control access tomorrow.
If you want to check where your business stands on access, passwords, devices, data, email security, and backup, start with the Small Business Cyber Profile.
Build Access in Stages
Do not give a new hire access to everything on day one.
Start with what they need to do the first part of the job. Then expand access as the role requires and trust is built.
This is called least-privilege access. In plain English, it means people should only have access to what they actually need.
That principle protects the business if the hire does not work out, if the person makes a mistake, or if the account is compromised.
It also forces the business to be clearer about roles.
If you do not know what access a person needs, the role may not be defined clearly enough yet.
Offboarding Starts at Onboarding
Before someone joins, you should already know how you would remove them.
That may sound negative, but it is responsible.
If the hire leaves, what accounts need to be disabled? What passwords need to be rotated? What files need to be transferred? What devices or data need to be returned? What client conversations need to be reassigned? What automations, inboxes, calendars, groups, and shared drives are they connected to?
A clean offboarding process is much easier when onboarding was clean.
If access was informal, offboarding becomes guesswork.
That is how former staff, contractors, or agencies keep access months after they should not.
Use Recruiters Where the Risk Is High
Professional recruiters may become more valuable in the AI era, especially for small businesses hiring for critical roles.
A good recruiter is not just forwarding resumes. They are helping validate candidates, assess fit, check signals, manage the process, and reduce the owner’s workload.
That can be worth paying for when the role is important, the cost of a bad hire is high, or the business does not have time to properly screen a large number of candidates.
Recruiters are also adapting to candidate fraud, AI-generated applications, and identity concerns.
For every role, paying a recruiter may not make sense. But for roles with client trust, sensitive access, technical responsibility, or operational impact, the extra layer can be valuable.
Create an AI-Era Hiring Filter
Small businesses do not need a huge HR machine. They do need a better filter.
A practical AI-era hiring filter should include six parts.
First, role clarity. Know what problem the person is being hired to solve and what success looks like.
Second, proof over polish. Treat the resume as claims, not evidence.
Third, work samples. Give a small, relevant task that shows skill and judgment.
Fourth, AI rules. Be clear about whether AI can be used and ask candidates to explain how they used it.
Fifth, identity and reference checks. Confirm that the person and their work history are real.
Sixth, access control. Decide what systems they need and how access will be granted and removed.
That filter will not make hiring perfect.
But it will make it much harder to be fooled by a polished application.
What to Ask Before You Hire
Before offering the role, ask a few practical questions.
What evidence do we have that this person can do the work?
Have we seen their process, not just their output?
Do they understand the role and the business problem?
Did they use AI responsibly?
Can they explain their decisions?
Have we checked identity and references?
What systems will they need access to?
Can we limit that access?
Can we remove access quickly if needed?
What does success look like in the first 30, 60, and 90 days?
If those answers are weak, slow down.
The cost of a bad hire is usually higher than the cost of a slightly longer hiring process.
The Bottom Line
AI has changed hiring.
It has made good candidates easier to support, but it has also made weak or fake candidates easier to polish. That means small businesses need to stop trusting applications at face value and start testing what is real.
Do not hire based only on the resume. Do not trust polish without proof. Do not ignore identity checks. Do not skip references. Do not hand over access without a plan.
The best candidates will still stand out, but not because their cover letter sounds perfect.
They will stand out because they can explain their work, show judgment, use AI honestly, complete realistic tasks, communicate clearly, and earn trust through evidence.
What to Do Next
Before your next hire, build a simple hiring scorecard.
Define the role, the outcomes, the required skills, the work sample, the AI rules, the reference checks, and the access plan before the job goes live.
If your business is already using AI but does not have clear rules around tools, data, access, or human review, start with the AI Readiness Audit. It will help you see whether your systems, documentation, and rules are ready for AI to support the business properly.
If your concern is access, passwords, devices, email security, data, and offboarding, take the Small Business Cyber Profile.
You can also review SixFive’s Digital Roadmap if you need help mapping your tools, workflows, permissions, and systems before the next person joins the business.
How Secure Are You, Really?
Choosing a secure platform is only step one. Your configuration is what matters most. Take our 20-question assessment to uncover hidden blind spots in your access and data protection before they become risks.
Start My free Cyber Assessment