Two European texts now govern the use of AI in recruitment: the GDPR, in force since 2018, and the AI Act, whose Annex III classifies systems used for recruitment among high-risk uses. Here is what that means in practice, without unnecessary legal jargon.
Article 22 of the GDPR: the decision stays human
This text prohibits decisions producing legal effects, or significantly affecting you, from being based solely on automated processing — save for tightly framed exceptions. In practice, for a recruiter: a score, a CV analysis or an interview transcript can inform a decision, but cannot replace it. A human must remain able to challenge or review the outcome.
The AI Act: a framework for high-risk systems
Annex III of the AI Act explicitly classifies AI systems used for recruitment — CV screening, candidate assessment, job ad targeting — as high-risk uses. That classification creates obligations for providers and users alike: system documentation, effective human oversight, and information for the people concerned.
What it means day to day
- Traceability — being able to explain why a profile was scored or ranked a certain way.
- Real human oversight — not a box ticked at the end of the process, but a recruiter who can genuinely step in.
- Candidate information — knowing they are dealing with an automated system, and being able to ask for a human contact.
These obligations are not side constraints: they shape how a recruitment tool must be built from the outset, rather than being added afterwards. That is the logic that has guided Fabskill's design since 2018.