It pretty much depends on your field and where you do it. I can only speak for German academia:
Your colleague does not have the title "PhD", he therefore should not use it
If your colleague has finished his PhD thesis, has successfully mastered the exam and only has to publish his thesis in order to receive the certificate, he could use "Dr. des." (Doctor designatus) - however, even though in some fields it has become common to do this, in other fields it is being shunned upon.
If your colleague has not finished his thesis, is currently researching and writing up his thesis, he is a PhD student and should not be called PhD candidate.
The basic idea is: do not present him with a title he has not yet earned the right to carry. Just present him the way he is: PhD-student, researcher - you might introduce him as such in a footnote or wherever you put the information about the authors. "XY is currntly working in the field of YX as part of his PhD research." Sounds fine to me.