AI can help employers write job descriptions, summarise CVs, rank applicants, schedule interviews and support hiring decisions. But recruitment involves decisions that can have a major impact on people’s lives.
That makes AI in recruitment an important area for both the GDPR and the EU AI Act.
Start with the use case
“Using AI in recruitment” can mean very different things.
Examples include:
- Drafting a vacancy
- Summarising CVs
- Extracting skills from applications
- Ranking candidates
- Analysing tests
- Screening video interviews
- Recommending candidates
- Automatically rejecting applications
The risk depends heavily on what the system actually does.
Using AI to improve the wording of a vacancy is very different from allowing an algorithm to decide who gets an interview.
What personal data enters the AI system?
Before using an AI tool, identify the information you intend to provide.
A CV may contain names, addresses, work history, education and other personal information. It may also contain photographs or sensitive information volunteered by the candidate.
Apply data minimisation.
If the task can be performed without identifiable candidate data, consider whether you need to upload the full CV at all. The same question applies when you paste a CV into a general AI assistant.
What does the provider do with the data?
Ask:
- Is candidate data retained?
- For how long?
- Is it used to train or improve models?
- Who can access it?
- Where is it processed?
- Are subprocessors involved?
- Can the data be deleted?
- What contractual protections apply?
Do not assume that because an AI tool is well known, it is automatically suitable for confidential recruitment data. Where the provider processes candidate data on your behalf, you will normally also need a data processing agreement.
Add the AI provider to your Third Party Dossier
If an external AI provider processes candidate data, make sure the provider is included in your Third Party Dossier. Document what the provider does, which personal data it receives, where the data is processed, whether subprocessors are involved and which contractual and data transfer arrangements apply.
This ensures that the AI tool is treated like any other external provider processing personal data and does not become an undocumented part of your recruitment process.
GDPR automated decision-making
The GDPR contains specific rules concerning decisions based solely on automated processing that produce legal effects or similarly significantly affect individuals.
A fully automated decision to reject a job applicant can therefore raise serious issues.
Whether a particular process falls within these rules depends on how the system and human involvement actually work.
Adding a person at the end of the process does not solve the problem if that person simply accepts the algorithm’s recommendation. Where the automated output is effectively decisive and the human adds no genuine assessment, the processing remains within Article 22 GDPR. See can AI automatically reject a job applicant? for what that means in practice.
The AI Act matters too
The EU AI Act regulates AI systems according to risk.
Certain AI systems intended to be used for recruitment or selection, for example to analyse and filter applications or evaluate candidates, are classified as high-risk under the Act.
High-risk status brings substantial obligations under the AI Act, and which of them fall on you depends on whether your organisation acts as provider, deployer or in another regulated role.
On timing: these high-risk obligations were due to apply from 2 August 2026, but Regulation (EU) 2026/1744 deferred that date to 2 December 2027 for the standalone Annex III systems that cover recruitment. The Article 50 transparency obligations were not deferred and apply now. See GDPR and the AI Act in recruitment for how the two frameworks fit together.
Bias and accuracy
AI systems can reproduce or amplify patterns in the data and criteria they use.
An employer should therefore consider:
- Whether the criteria are job-relevant
- Whether outputs are accurate
- Whether particular groups may be disadvantaged
- How errors can be detected
- How candidates can challenge decisions
- Whether human reviewers understand the system’s limitations
GDPR accuracy and fairness principles remain relevant even when the processing is performed by software.
Assess before you deploy
Depending on the nature and risk of the processing, a Data Protection Impact Assessment may be required under the GDPR.
Do the assessment before deployment, not after complaints arrive.
AI Act compliance may require additional risk management, documentation, human oversight and other measures.
AI should support a controlled recruitment process
The right question is not “Can AI save us time?”
It is:
Can we use this particular system for this particular recruitment task in a lawful, transparent and controlled way?
GDPRWise helps organisations map the personal data, providers, purposes and risks involved in their processing activities, providing a structured GDPR foundation when new tools such as AI are introduced.
GDPRWise maps your processing activities and external providers, so a new recruitment AI tool is documented and assessed instead of quietly added to the process.