For every AI Act duty and date in recruitment, read our full guide to the EU AI Act and recruitment.
On this page: Key takeaways · What does the GDPR require when AI screens CVs? · Can AI reject a candidate automatically? · Is AI CV screening high risk under the AI Act? · When do the AI Act rules apply to CV screening? · What does this mean for frontline hiring and staffing agencies? · How Radius helps · FAQ
Key takeaways
- No EU law bans AI CV screening, but the GDPR applies today and the AI Act treats it as high risk from 2 December 2027.
- A solely automated rejection is allowed only in narrow cases, with safeguards.
- Our advice: keep a person reviewing every candidate the tool would turn away.
What does the GDPR require when AI screens CVs?
Four rules in the GDPR, which has applied since 25 May 2018, do most of the work today.
- Tell candidates who processes their data, why, on what legal basis, who receives it, how long it is kept and what their rights are (Articles 13 and 14). For solely automated decisions with significant effects, add "meaningful information about the logic involved".
- Respect objections. Where you rely on legitimate interests, candidates can object on grounds relating to their situation, including to profiling, and you must then stop unless you show compelling legitimate grounds that override their interests, or need the data for legal claims (Article 21).
- Limit automatic decisions (Article 22, below).
- Assess the risk first. Article 35 requires a data protection impact assessment (DPIA) before systematic and extensive automated evaluation of people that leads to decisions with significant effects, so AI that evaluates candidates will in most cases need one. The DPIA list of the Dutch data protection authority (Autoriteit Persoonsgegevens) includes profiling such as assessing work performance (Staatscourant 2019, 64418).
Can AI reject a candidate automatically?
Only in narrow cases, and with safeguards for the candidate.
Article 22 gives candidates the right not to be subject to a decision based solely on automated processing that significantly affects them, such as an automatic rejection, unless the decision is necessary for entering into a contract, authorised by EU or national law, or based on explicit consent. Under the contract or consent exception, candidates must at least be able to get human intervention, give their view and contest the decision; under the law exception, that law must set the safeguards.
Whether an exception covers your process is a question for legal advice. Our view is simpler: a tool should never say no on its own (why).
Illustrative example. An agency's filter rejects every order picker CV that does not mention a forklift certificate, and the rejection email goes out that evening unseen. That is very likely a solely automated decision. Queueing those CVs for a recruiter to check with the candidate makes that far less likely.
The same CV filter, with and without a person
The filter rejects
- An order picker CV does not mention a forklift certificate
- That evening the rejection email goes out, unseen
- Very likely a solely automated decision
A recruiter checks
- The same CV, with no certificate mentioned
- It waits in a queue for a recruiter
- The recruiter checks with the candidate
- Far less likely to be a solely automated decision
Our view: a tool should never say no on its own.
Is AI CV screening high risk under the AI Act?
Yes. Annex III names it, and the exception is narrow.
Annex III, point 4(a) of the AI Act, Regulation (EU) 2024/1689, lists as high risk AI systems intended "to analyse and filter job applications, and to evaluate candidates". The European Commission gives CV sorting software for recruitment as an example (European Commission, updated 19 October 2026).
Article 6(3) exempts an Annex III system that does not pose a significant risk of harm, "including by not materially influencing the outcome of decision making". The exemption never applies where the system profiles people, meaning automated evaluation of personal aspects such as performance at work (GDPR Article 4(4)). A tool that reads CVs to judge who fits a vacancy will usually do exactly that, and a recruiter's approval at the end does not, on its own, change the classification.
When do the AI Act rules apply to CV screening?
The high risk duties apply from 2 December 2027.
The Digital Omnibus on AI, Regulation (EU) 2026/1744, published in the Official Journal on 24 July 2026 and in force since 27 July 2026, moved the date for Annex III systems, including recruitment, from 2 August 2026 to 2 December 2027.
What applies to AI CV screening, and when (as of 22 October 2026)
| Rule | What it means for CV screening | Applies from |
|---|---|---|
| GDPR Articles 13, 14, 21, 22, 35 | Tell candidates, respect objections, limit automated rejections, DPIA in most cases | Already applies (25 May 2018) |
| AI Act Article 4 | Take measures to support AI literacy of staff using the tool | 2 February 2025 (wording amended 27 July 2026) |
| AI Act Article 50(1) | Its provider must design a screening chatbot to tell candidates they are talking to AI, unless obvious | 2 August 2026 |
| AI Act Article 6, Annex III, Article 26 | High risk classification and deployer duties | 2 December 2027 |
From that date, Article 26 requires organisations using a high risk hiring tool to follow the vendor's instructions, assign trained people with authority to oversee it, check the input data they control, monitor it, keep the logs under their control for at least six months (subject to data protection law) and tell candidates it is used.
See how Match shows a recruiter the evidence for each requirement instead of a filter's verdict.
What does this mean for frontline hiring and staffing agencies?
Volume turns small design choices into legal exposure.
Frontline CVs can be short and silent about certificates the candidate holds, so a filter that rejects on what is missing rejects people for what they did not write, many times a day.
Five checks before you switch on AI CV screening
- Can the tool reject without a person reviewing? Then take legal advice on Article 22, or switch that off.
- Does your privacy notice say that AI reads CVs, why, and how to object?
- Does your DPIA cover this tool and this use?
- Do reviewing recruiters have the training, time and authority to overrule the output?
- Has your vendor said whether the tool is high risk, and what its instructions for use say?
How Radius helps
Radius Hire is the AI hiring platform for frontline roles. It starts from a short, structured interview and the evidence for each requirement rather than a CV filter.
- Radius never rejects a candidate on its own. A recruiter reviews the evidence, can overrule anything Radius presents and makes every hiring decision (Match).
- Candidates are told at the start that the AI Interviewer is automated and that a person reviews the result.
- Candidate data is hosted in the EU and processed under a data processing agreement, and the employer sets how long it is kept (Trust and compliance).