AI screening and GDPR in practice

When an application is screened wholly or partly automatically, disclosure duties follow. Under the GDPR the candidate must know that the processing is taking place, what its purpose is, and which legal basis it rests on. For decisions taken solely by automated means with a significant effect on the individual, Article 22 also applies, giving the candidate a right to human intervention, to express their point of view and to contest the decision.

In practice the question is rarely whether a human is present in the process, but whether that human can realistically change the outcome. A recruiter who receives a ranked list and in practice always starts at the top is not performing the kind of individual assessment the provision aims at.

On top of this comes the AI Act. AI systems used for recruitment and selection are classified as high-risk under Annex III, category 4(a), covering CV screening and applicant ranking among other uses. Under Regulation (EU) 2026/1744, published in the Official Journal on 24 July 2026, the application date for obligations on standalone Annex III systems has been postponed to 2 December 2027. The obligations themselves are unchanged: risk management, data governance, technical documentation, logging, human oversight and information to those affected.

The second strand is more mundane and more often overlooked. Where does the data sit, who has access, and how long is it kept?

Four points belong in any vendor agreement. The hosting location, including whether transfers to third countries occur and on what basis. A processing agreement that actually reflects the processing the vendor carries out, rather than a boilerplate text. A deletion deadline for test data and reports tied to the end of the recruitment process rather than to the vendor's own convenience. And a clear answer on whether candidate responses are used to train or improve the vendor's models, and if so on what basis.

That last point has become material faster than many contracts have been updated. Wording about product improvement that was innocuous a few years ago may today cover model training on personal data.

Document which systems are used where in the process, who the vendor is, and what role the system plays in the decision. Describe how the human assessment actually works and what it takes to depart from the system's recommendation. And set a date for reviewing it again.

Source: GDPR Articles 13, 14 and 22, and Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744.