AI in hiring: the rule that is already in force

AI used for recruitment and selection sits in Annex III point 4 of the EU AI Act. That makes it high-risk unless Article 6(3) applies, and Article 6(3) never applies to a system that profiles people. Scoring or ranking candidates is profiling. Under Regulation (EU) 2026/1744, those obligations apply from 2 December 2027.

Recruitment was already regulated. Article 22 of the GDPR has applied since 25 May 2018. It gives a person the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them.

The Data Protection Commission states the test plainly on its own page: processing qualifies where it is "carried out without human intervention and where it produces legal effects or significantly affects you", and "Automated processing includes profiling".

Recital 71 gives the two textbook examples of exactly that: automatic refusal of an online credit application, and e-recruiting practices without any human intervention. Recruitment is one of the two examples the Recital gives.

Two conditions have to be met. Test both against your own process.

The first is that the decision is based solely on automated processing. The DPC's wording is "without human intervention". Profiling counts: under Article 4(4) GDPR, profiling is any automated processing of personal data to evaluate personal aspects relating to a person, in particular to analyse or predict aspects concerning their performance at work, reliability or behaviour. Scoring a candidate against a competency list is profiling on that definition, whatever the tool is called.

The second is effect. The decision must produce legal effects or similarly significantly affect the person. Being screened out of a job you applied for is the textbook case, which is why Recital 71 names it.

Where both are met, Article 22 applies. Where a person really makes the decision, Article 22 does not, though the rest of the GDPR still does.

A person at the end of the pipeline does not settle it. Where a tool ranks four hundred applicants, produces a shortlist of twenty, and a recruiter approves the shortlist, there is human intervention on paper. In practice the recruiter has never seen the three hundred and eighty rejections and has no way to form a view about them.

The DPC's test is whether the processing is carried out without human intervention. A signature at the end of a process is not obviously intervention in the decision. The question the business should be able to answer is a factual one: did the person have the information, the authority and the time to reach a different conclusion, and do they ever reach one?

If the human approval has never once changed an outcome, the safer working assumption is that the decision is automated and Article 22 applies to it. Building the process on the opposite assumption, with no record of the human ever deciding anything, is the version that is hard to defend later.

Article 22 is not an outright ban. The DPC sets out that solely automated processing "is permitted only with your express consent, when necessary for the performance of a contract or when authorised by Union or Member State law".

In a hiring context each of those has limits.

Article 22(2)(c) requires the candidate's explicit consent, and under Article 4(11) any consent must also be freely given, specific, informed and unambiguous. Recital 43 says consent should not be a valid legal ground where there is a clear imbalance between the person and the organisation that controls their data, and it gives a public authority as its example. It also says consent is presumed not to be freely given where a contract or service is made conditional on consent that it does not need. An employer is not a public authority, but the reasoning carries across to hiring for the same reason: the person consenting wants something the person asking controls. A candidate who is told that agreeing to automated screening is the only way to be considered is not in a strong position to refuse, and an employer relying on that consent should be able to explain what happens to applicants who decline.

The contract route in Article 22(2)(a) covers processing necessary for entering into, as well as performing, a contract, so it is not automatically unavailable before somebody is hired. The word doing the work is "necessary". Cheaper and faster is not the same as necessary, and that is the question to answer before relying on it.

The third route requires authorisation in Union or Member State law that lays down suitable safeguards. In Ireland that means section 57 of the Data Protection Act 2018, which permits solely automated decisions where they are authorised by law and suitable measures protect the person. It is drafted for decisions a statute already provides for, not for a private employer choosing to automate its own shortlist. If you cannot name the provision that authorises yours, this is not your route.

Where the process touches special category data, the most sensitive kinds of personal data, the bar rises again. The DPC states that automated decisions using special category data are lawful only with express consent, or where the processing is necessary for reasons of substantial public interest. Article 9(2)(a) calls that consent explicit consent. Article 9(1) covers data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health, sex life or sexual orientation, plus genetic data and biometric data used to identify someone. A tool that infers any of that from a CV, a photograph or a video, even as a side effect, brings your process into that narrower gate.

Clearing one of the exceptions is not the end of it. The DPC states that where an exception applies, "suitable measures must be in place to safeguard your rights, freedoms and legitimate interests", and that these "may include the right to obtain human intervention on the controller's part, the right to present your point of view, and the right to challenge the decision".

Those three are the minimum: a real route to a person, a way for the candidate to put their side, and a way to contest the outcome. All three have to exist in the process itself as well as in the privacy notice.

The transparency duties sit alongside them. Article 13 requires you to tell people, when you collect their data, that automated decision making, including profiling, is happening. You must also give meaningful information about the logic involved, and about the significance and expected consequences of that processing for them. Article 15(1)(h) gives them the right to ask for the same information afterwards. If a rejected candidate writes in, that is the request you will be answering.

A practical consequence: you cannot give meaningful information about the logic of a system whose supplier will not tell you how it scores. Ask the supplier how it scores before you sign.

Some uses of AI in hiring sit outside Article 22.

Article 22 restricts solely automated decisions with legal or similarly significant effects. It does not restrict AI that assists a person who is making the decision. A recruiter who reads every application and uses a tool to summarise, translate, extract structured fields or check qualifications against a list is not making an automated decision.

Nor does it stop you using AI on the parts of hiring that are not decisions about individuals: drafting job descriptions, tidying interview notes, scheduling, or analysing the process afterwards in aggregate.

None of that is unregulated. The processing still needs a lawful basis, a retention period, transparency in your privacy notice, and a supplier who is a processor under a proper contract. It also needs an entry in your Article 30 record of processing. The Article 30(5) exemption for organisations with fewer than 250 staff does not cover it, because screening applicants is not occasional. But it is ordinary data protection work, not the Article 22 gate.

Article 22 has no small-business exemption. A ten-person company automating CV screening is in exactly the same position as a multinational.

The two regimes are stitched together in a few places.

One prohibition is already live. Article 5 of the AI Act bans AI systems that infer emotions of a natural person in the workplace or in education institutions, outside narrow medical and safety exceptions. That has applied since 2 February 2025 and carries the top penalty tier. It is not deferred. Any video interviewing product that scores confidence, enthusiasm or sentiment is the first product to check. Ireland has spread AI Act supervision across several national authorities. The Workplace Relations Commission is one of them, and it is the one that has named workplace AI as within its remit.

From 2 December 2027, Article 26(9) applies to deployers of high-risk systems, meaning the businesses that use them. Where a data protection impact assessment (DPIA) is required under Article 35 GDPR, they must use the information the provider gives them under Article 13 to carry it out. In practice the AI Act assumes there will be a DPIA and tells you what to feed into it.

The DPIA obligation itself is not new either. Article 35(3)(a) GDPR already requires one for a systematic and extensive evaluation of personal aspects based on automated processing, including profiling, on which decisions are based that produce legal effects or similarly significantly affect the person. An automated CV screening process fits that description closely.

Four steps, in order. The first two are about finding out the facts.