Using AI for recruiting is allowed in the EU as long as AI assists and a human decides. Drafting job ads, scheduling, preparing interviews, summarising applications: all fine if you respect data protection and equal treatment. A person decides who is invited, rejected or hired, because Article 22 GDPR generally rules out purely automated rejections. Since 2 February 2025, AI that infers emotions at the workplace is banned, and in the European Commission's reading that includes job interviews. Systems intended to screen, filter or evaluate applications are high-risk under the EU AI Act, with employer obligations from 2 December 2027.
I am a developer, not a lawyer, and this is not legal advice, just the operator's perspective. The legal part covers EU law (AI Act, GDPR) and German law (BDSG, AGG, BetrVG); other EU countries have their own national rules. Sources: EUR-Lex and gesetze-im-internet.de as of 31 October 2026; for the AI Act, the consolidated version of 27 July 2026 (with Regulation (EU) 2026/1744). Quotes from German law are my translations. More on AI at work is on my AI Basics page.
AI in recruiting: what works and what doesn't
What the EU AI Act says about recruiting
High-risk under Annex III point 4. This covers “AI systems intended to be used for the recruitment or selection of natural persons, in particular to place targeted job advertisements, to analyse and filter job applications, and to evaluate candidates”. As I read it, placing targeted ads means showing ads to selected people, not writing them.
“Intended” is the key word. It means the intended purpose the provider states in its instructions and marketing (Article 3(12)). Applicant tracking software with ranking is covered; a general chatbot for ad copy is not.
Careful when you repurpose. Under Article 25(1)(c), anyone who modifies the intended purpose of an AI system, including a general-purpose one, so that it becomes high-risk is treated as a provider under Article 16. My reading: building ChatGPT or Claude into a fixed step that scores and ranks applications gets close to this rule.
Exceptions with a limit. Article 6(3) exempts systems that only perform “a narrow procedural task” or “a preparatory task”. But an Annex III system “shall always be considered to be high-risk where the AI system performs profiling of natural persons”, i.e. automatically evaluates personal aspects such as performance at work (Article 4(4) GDPR). A candidate ranking is, as I understand it, exactly that.
Deployer obligations under Article 26 and when they apply
As an employer using a high-risk system, you are a deployer. Article 26 requires, among other things:
- use according to the provider's instructions (para. 1),
- human oversight by people “who have the necessary competence, training and authority” (para. 2),
- relevant and “sufficiently representative” input data, to the extent you control it (para. 4),
- monitoring and reporting risks (para. 5),
- keeping logs for at least six months (para. 6),
- informing workers' representatives and affected workers in advance (para. 7),
- informing the people it helps decide about, including applicants (para. 11).
From when. Originally these obligations were to apply from 2 August 2026. Regulation (EU) 2026/1744, in force since 27 July 2026, rewrote Article 113: Chapter III Sections 1 to 3, including Articles 6, 16, 25 and 26, apply to Annex III systems from 2 December 2027. It did not change Article 26 itself. All deadlines are in EU AI Act: Overview and Deadlines 2026.
Banned since February 2025: emotion recognition in interviews
Since 2 February 2025, Article 5(1)(f) bans AI systems used “to infer emotions of a natural person in the areas of workplace and education institutions”, except for medical or safety reasons.
According to the European Commission's guidelines on prohibited practices (C(2025) 5052 of 29 July 2025, para. 254), the notion of workplace “should also be understood to apply to candidates during the selection and hiring process”, and “Using emotion recognition AI systems during the recruitment process is prohibited.” The guidelines are not binding. They cover systems based on biometric data such as facial expressions or voice, not sentiment analysis of written text. A video interview tool that claims to read nervousness from face or voice is out.
Article 22 GDPR: the decision stays with a human
Article 22(1) GDPR gives every person “the right not to be subject to a decision based solely on automated processing, including profiling”, with legal or similarly significant effects. Recital 71 names “e-recruiting practices without any human intervention” as an example.
How far this reaches shows in the CJEU's SCHUFA judgment of 7 December 2023 (C-634/21): even an automatically generated probability value can be such a decision if a third party “draws strongly” on it. It concerned credit scoring. My reading for hiring: if you adopt an AI ranking and reject the bottom half unread, you have handed over the decision, even if a person clicks “send”.
The line between establishing facts and deciding is drawn in What Can an AI Lead Role Decide?
Applicant data: German law and the CJEU
In Germany, applicants count as employees under section 26(8) of the Federal Data Protection Act (BDSG). Under section 26(1), their data may be processed where necessary “for the decision on establishing an employment relationship”.
Since 2023 that provision comes with a caveat. On 30 March 2023 (C-34/21), the CJEU ruled on an almost identical rule from the state of Hesse: national employee data rules “must be disregarded” if they do not meet Article 88 GDPR. Rules that merely repeat the necessity test appear to add nothing beyond Article 6(1)(b) GDPR (para. 81). The court did not rule on section 26 BDSG itself. Have the legal basis in your privacy notice checked.
As of 31 October 2026, Germany has no separate employee data protection act; a Green party motion of 23 September 2026 (Bundestag printed paper 21/8145) calls on the government to present a draft.
In practice: CVs only go into tools with a data processing agreement, and only what the task needs. How to strip data first is explained in AI and Privacy: What the AI Gets to See.
German anti-discrimination law and the burden of proof
Under the General Equal Treatment Act (AGG), applicants count as employees too (section 6(1)). Nobody may be disadvantaged on grounds of race or ethnic origin, sex, religion or belief, disability, age or sexual identity (sections 1 and 7), job ads included (section 11).
The tricky part is the burden of proof under section 22 AGG: if an applicant proves indications of discrimination, you have to prove there was no breach. Compensation for not being hired is capped at three months' salary (section 15(2)) if the person would not have been hired anyway; the claim must be made within two months of the rejection.
Studies on AI ranking CVs differently by name are summarised in AI Bias Explained: Why AI Gets It Wrong. If you cannot show your selection criteria, rebutting the presumption gets hard. That is my assessment, not a ruling.
Works council: sections 87, 94 and 95 BetrVG
If your German business has a works council, hiring selection guidelines need its consent, under section 95(2a) BetrVG also when AI is used. A questionnaire applicants fill in, including as a form or chatbot, can be a personnel questionnaire, which then also needs its consent under section 94(1). For tools that can monitor behaviour or performance, it co-determines under section 87(1) no. 6. Details are in AI and the Works Council in Germany.
How to use AI in recruiting properly
An example: a twelve-person trade business hiring an office assistant gets forty applications. A possible process:
- Criteria first. Set three to five objective criteria before opening any application.
- AI for text. Let AI draft the ad and check it for stereotypes. Good briefs are in Prompt Templates: 12 Copy-and-Paste Briefs for Small Businesses.
- Data minimisation. If the AI summarises applications: only in a tool with a data processing agreement, without photo, date of birth or irrelevant details.
- A human reads every application. The AI may point to passages matching your criteria. You decide who moves on and note one sentence of reasoning.
- Separate review. I have a house rule for every result: whoever produced something does not check it. Have a second person review rejections.
- Be transparent. Say in your applicant privacy notice what you use AI for.
Buying an applicant tracking system with AI? Ask the provider in writing whether it is classified as high-risk and whether it infers emotions from video or voice. What applies if something still goes wrong is covered in Who Is Liable When AI Makes a Mistake?
Frequently asked questions
Can I write a job ad with ChatGPT or Claude?
Yes, wording an ad is not selecting people. Check it against anti-discrimination rules (in Germany section 11 AGG): no age limits, nothing favouring a sex or origin.
Can AI pre-sort applications?
Ranking or filtering is exactly the use Annex III point 4 of the AI Act lists as high-risk, plus Article 22 GDPR and anti-discrimination law. A summary a person reads next to the full application is different from a ranking used to reject people. This is not legal advice; get advice for your specific case.
Do I have to tell applicants that AI is involved?
For high-risk systems yes, under Article 26(11) AI Act from 2 December 2027. Under Article 13 GDPR, purposes and legal basis already belong in your privacy notice today, for automated decisions also the logic involved.
What to do next
This week, write down where AI already plays a part in your hiring and who decides there. Team rules belong in an AI Usage Policy for Small Teams, and staff using AI need AI literacy under the AI Act. We discuss how other businesses use AI in my community AI Employee Framework. Membership does not replace a legal review.
Your first AI employee up and running within an hour
Join the community$5/month founding price, first 50 members
