AI in hiring: the rule that is already in force

AI used for recruitment and selection sits in Annex III point 4 of the EU AI Act, so it will be high-risk. Those obligations now apply from 2 December 2027. A lot of Irish employers have filed the whole subject under that date.

The problem is that recruitment was already regulated. Article 22 of the GDPR has applied since 25 May 2018. It gives a person the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them.

The Data Protection Commission states the test plainly on its own page: processing qualifies where it is "carried out without human intervention and where it produces legal effects or significantly affects you", and "Automated processing includes profiling".

Recital 71 gives the two textbook examples of exactly that: automatic refusal of an online credit application, and e-recruiting practices without any human intervention. Recruitment is not an edge case here. It is one of the two cases the drafters had in mind.

Two conditions have to be met, and both are worth testing honestly against your own process.

The first is that the decision is based solely on automated processing. The DPC's wording is "without human intervention". Profiling counts: under Article 4(4) GDPR, profiling is any automated processing of personal data to evaluate personal aspects relating to a person, in particular to analyse or predict aspects concerning their performance at work, reliability or behaviour. Scoring a candidate against a competency list is profiling on that definition, whatever the tool is called.

The second is effect. The decision must produce legal effects or similarly significantly affect the person. Being screened out of a job you applied for is the paradigm case, which is why Recital 71 names it.

Where both are met, Article 22 applies. Where a person really makes the decision, Article 22 does not, though the rest of the GDPR still does.

This is where most processes fail, and it is a commercial point rather than a legal technicality.

The common response to Article 22 is to put a person at the end of the pipeline. The tool ranks four hundred applicants, produces a shortlist of twenty, and a recruiter approves the shortlist. On paper there is human intervention. In practice the recruiter has never seen the three hundred and eighty rejections and has no way to form a view about them.

The DPC's test is whether the processing is carried out without human intervention. A signature at the end of a process is not obviously intervention in the decision. The question a controller should be able to answer is a factual one: did the person have the information, the authority and the time to reach a different conclusion, and do they ever reach one?

If the honest answer is that the human approval has never once changed an outcome, the safer working assumption is that the decision is automated and Article 22 applies to it. Building the process on the opposite assumption, with no record of the human ever deciding anything, is the version that is hard to defend later.

Article 22 is not an outright ban. The DPC sets out that solely automated processing "is permitted only with your express consent, when necessary for the performance of a contract or when authorised by Union or Member State law".

Each of those is narrower than it looks in a hiring context.

Consent has to meet the GDPR standard: freely given, specific, informed and unambiguous. Recital 43 says consent is presumed not to be a valid legal ground where there is a clear imbalance between the data subject and the controller, giving a public authority as its example. An employer is not a public authority, but the reasoning carries across to hiring for the same reason: the person consenting wants something the person asking controls. A candidate who is told that agreeing to automated screening is the only way to be considered is not in a strong position to refuse, and an employer relying on that consent should be able to explain what happens to applicants who decline.

The contract limb in Article 22(2)(a) covers processing necessary for entering into, as well as performing, a contract, so it is not automatically unavailable before somebody is hired. The word doing the work is "necessary". Cheaper and faster is not the same as necessary, and that is the question to answer before relying on it.

The third limb requires authorisation in Union or Member State law that lays down suitable safeguards. In Ireland that means section 57 of the Data Protection Act 2018, which permits solely automated decisions where they are authorised by law and suitable measures protect the person. It is drafted for decisions a statute already provides for, not for a private employer choosing to automate its own shortlist. If you cannot name the provision that authorises yours, this is not your route.

Where the process touches special category data, the bar rises again. The DPC states that automated decisions using special category data are lawful only with express consent or where the processing is necessary for reasons of substantial public interest, which Article 9(2)(a) frames as explicit consent. Article 9(1) covers data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health, sex life or sexual orientation, plus genetic data and biometric data used to identify someone. A tool that infers any of that from a CV, a photograph or a video, even as a side effect, brings your process into that narrower gate.

Clearing one of the exceptions is not the end of it. The DPC states that where an exception applies, "suitable measures must be in place to safeguard your rights, freedoms and legitimate interests", and that these "may include the right to obtain human intervention on the controller's part, the right to present your point of view, and the right to challenge the decision".

Those three are the minimum architecture: a real route to a person, a way for the candidate to put their side, and a way to contest the outcome. All three have to exist in the process, not just in the privacy notice.

The transparency duties sit alongside them and are easy to forget. Article 13 requires you to tell people, at the point you collect their data, that automated decision making including profiling is happening, and to give meaningful information about the logic involved and the significance and envisaged consequences. Article 15(1)(h) gives them the right to ask for the same information afterwards. If a rejected candidate writes in, that is the request you will be answering.

A practical consequence: you cannot give meaningful information about the logic of a system whose supplier will not tell you how it scores. That is a procurement question, and it is easier to ask before you sign than after a candidate asks you.

It is worth being clear about the space that remains, because it is larger than the anxious reading suggests.

Article 22 restricts solely automated decisions with legal or similarly significant effects. It does not restrict AI that assists a person who is making the decision. A recruiter who reads every application and uses a tool to summarise, translate, extract structured fields or check qualifications against a list is not making an automated decision.

Nor does it stop you using AI on the parts of hiring that are not decisions about individuals: drafting job descriptions, tidying interview notes, scheduling, or analysing the process afterwards in aggregate.

None of that is unregulated. The processing still needs a lawful basis, a retention period, a record in your Article 30 register, which the under-250 exemption in Article 30(5) does not reach because screening applicants is not occasional, transparency in your privacy notice, and a supplier who is a processor under a proper contract. But it is ordinary data protection work, not the Article 22 gate.

Article 22 has no small-business exemption. A ten-person company automating CV screening is in exactly the same position as a multinational, minus the compliance department.

The two regimes are stitched together in a few places, and knowing which is which saves arguing about the wrong deadline.

One prohibition is already live. Article 5 of the AI Act bans AI systems that infer emotions of a natural person in the workplace or in education institutions, outside narrow medical and safety exceptions. That has applied since 2 February 2025 and carries the top penalty tier. It is not deferred. Any video interviewing product that scores confidence, enthusiasm or sentiment is the first product to check, and in Ireland the Workplace Relations Commission is one of the national competent authorities under the distributed model the Government adopted, and it is the one that has named workplace AI as within its remit.

From 2 December 2027, Article 26(9) requires deployers of high-risk systems to use the information provided by the provider under Article 13 to carry out a data protection impact assessment under Article 35 GDPR where that obligation applies. In practice the AI Act assumes there will be a DPIA and tells you what to feed into it.

The DPIA obligation itself is not new either. Article 35(3)(a) GDPR already requires one for a systematic and extensive evaluation of personal aspects based on automated processing, including profiling, on which decisions are based that produce legal effects or similarly significantly affect the person. An automated CV screening process is close to a direct description of that.

Four steps, in order. None of them is expensive, and the first two are only finding out what is true.