Tools that rank CVs, score interviews or predict fit are now a standard offer to HR teams. In the EU, using them in hiring sits in one of the most tightly regulated corners of the AI rulebook. That is not a reason to avoid them, but it changes what you ask before you sign.

This article is general information and not legal advice. For a specific tool and a specific process, involve your data protection officer and an employment lawyer.

Recruitment is a high-risk use case under the AI Act

The EU AI Act sorts systems by what they are used for, not by how sophisticated they are. Annex III lists employment as a high-risk area, including systems used for recruitment and the selection of candidates: targeted job adverts, filtering applications, evaluating applicants. A CV ranker that outputs a score is in scope as much as a system that runs a whole interview.

Duties are split between the provider, who develops the system and puts it on the market, and the deployer, the employer using it. The heavy engineering and documentation work sits with the provider, but the employer's duties are real and cannot be outsourced. Put your own brand on a bought system, or use it for a purpose it was not placed on the market for, and you can be treated as the provider.

The Act entered into force in 2024 and applies in stages. The timetable for the high-risk obligations has been the subject of political discussion, so have your legal advisers confirm the dates that currently apply.

What the provider should be able to show you

Risk management across the life of the system, not a one-off test.
Data governance for training, validation and test data, including how bias was examined.
Technical documentation and clear instructions for use.
Automatic logging, so what the system did can be reconstructed.
Evidence on accuracy, robustness and cyber security.
Conformity assessment, CE marking and registration in the EU database.
A design that genuinely allows a human to override the output.

What you as the employer have to do

Use the system in line with the provider's instructions.
Give human oversight to named people with the competence, training and authority to overrule it.
Make sure your input data is relevant and sufficiently representative.
Monitor it, suspend use and notify the provider when something goes wrong.
Keep the logs it generates, as far as they are under your control.
Inform employee representatives and affected employees before putting it into use.
Make sure the people operating it have enough AI literacy to know where it fails.
Be ready to explain the system's role to someone affected by a decision based on its output.

GDPR: a machine must not do the rejecting

The GDPR gives people the right not to be subject to a decision based solely on automated processing, including profiling, where it produces legal effects or similarly significantly affects them. A rejection in hiring is generally treated as falling into that category. The exceptions are narrow, and consent is a weak basis in employment because of the imbalance between employer and applicant. So the system may sort, score and recommend, and a person takes the decision to reject.

The word that causes the most trouble is "solely". A recruiter clicking through a ranked list without the information, the authority or the time to disagree is not meaningful human involvement. Oversight becomes real when the reviewer sees the evidence behind a score and is allowed to reach the opposite conclusion.

The rest of the GDPR applies as usual. In hiring that means:

A documented lawful basis, in place before the first CV arrives.
Transparency at collection: what is processed, by whom, for how long, and that an AI system is involved and at which step.
Data minimisation. Do not feed the tool social profiles, photos or background data your criteria do not need.
A deletion rule for applicant data that also covers scores, transcripts and logs.
A data protection impact assessment, which German supervisory authorities expect for AI-based evaluation of applicants.
A processing agreement, plus clarity on sub-processors, hosting location and transfers outside the EU.

Anti-discrimination law does not care that a machine did it

The Allgemeines Gleichbehandlungsgesetz prohibits disadvantaging people in the selection process on grounds such as ethnic origin, gender, religion or belief, disability, age and sexual identity. It applies to applicants, and the employer answers for its own process, including the part a purchased tool performed. A vendor brochure is not a defence. If an applicant presents indications suggesting discrimination, the employer has to show that no breach occurred, and a claim must be raised in writing within a short deadline, currently two months.

The realistic risk is not a tool that asks about ethnicity. It is proxies. Gaps in a career history correlate with parental leave and illness. A language fluency score can penalise origin. A filter on years of experience can work as an age filter. Check what your criteria correlate with, and review outcomes by group where you lawfully can.

The works council is not an afterthought

If your business has a works council, introducing such a tool is rarely a purchasing decision alone. Co-determination under the Betriebsverfassungsgesetz covers technical systems suitable for monitoring the performance or behaviour of employees, and selection guidelines for hiring generally need the works council's agreement in larger businesses.

The usual route is a works agreement: which roles the tool is used for, what data goes in, who sees the output, how long records are kept, that existing staff are not scored through the back door, and who holds oversight. Bring the works council in before you sign.

What to check before you buy

Is the vendor the provider under the AI Act, and can they hand over the documentation, instructions for use and conformity status?
What does the system output: a score, a ranking, a recommendation, or something presented as a decision?
Can a recruiter override it easily, on a path that is visible rather than buried?
Can every score be traced back to the evidence behind it, readably?
What happens to your candidate data afterwards, and is it used to train the vendor's models?
Where is data hosted, who are the sub-processors, and what logs can you export?
What can the vendor show, rather than claim, about discriminatory outcomes?
Can the system run without name, gender, age and origin?

What to document

Criteria and weights per role, dated before screening starts.
The impact assessment and the entry in your record of processing activities.
The works agreement, or how the works council was involved.
Who holds human oversight for each role, and their training.
Per candidate: the output, the evidence, the human decision and its reason.
Vendor documentation, contracts, and a review date.

What to tell candidates

Say it plainly in the job advert or the applicant privacy notice, in normal language rather than a legal appendix: that an AI system supports the process, at which step, what it evaluates, that a person decides, how to ask for a human review, how long data is kept, and who to contact. And when you reject someone, do not name the tool as the reason: if a person decided, the reason lies in the criteria.

How Persohap is built for this

Persohap is built so the human step is the real one. Every applicant's CV is screened against criteria the recruiter defines and weights: the AI drafts a first set, the recruiter rewords and weights them before any CV is read. Screening is blind to name, gender, age and origin. Only the candidates the recruiter picks are invited to an AI-led interview, which runs over one link with no account needed. Each interview returns a transcript and a scorecard whose scores quote the transcript passage that produced them, with a recommendation of advance, hold or reject and a confidence value, so a reviewer can disagree and point at the reason. A person makes the hiring decision; the system never decides. Data is hosted in Frankfurt, Germany.

See how screening and interviews work in Persohap