AI-driven recruitment: what GDPR Article 22 and the AI Act already require

Automated CV screening, candidate scoring, and AI-augmented video interviews are explicitly listed among the CNIL's priority enforcement themes for 2026. This is not one item among many in the long list of AI-related obligations, it is one of the areas the French regulator has stated it will focus its attention on, with a direct check against GDPR Article 22 and the AI Act's high-risk system regime.

GDPR Article 22, in force since 2018, prohibits a decision producing legal or significant effects on a person, such as rejecting them from a hiring process, from resting solely on fully automated processing, with narrowly defined exceptions. A human being must be able to weigh in on the final decision, not just in theory, but through a genuine exercise of validation or challenge. The AI Act adds a further, AI-specific layer, explicitly listing recruitment among the high-risk uses in its Annex III, which imposes stronger documentation, effective human oversight, and clear information for affected candidates.

For an SMB using a candidate-screening tool, the question is not binary. A simple keyword filter that pre-sorts CVs based on specific terms raises fewer questions than generative-AI-based scoring, which evaluates and ranks profiles on more opaque criteria. But as soon as a tool automatically ranks, rates, or eliminates candidates, regardless of technical sophistication, attention to Article 22 and the AI Act's high-risk regime becomes relevant.

Three concrete checks let an SMB assess its position without necessarily commissioning a full legal audit. The first is confirming a human recruiter genuinely validates the final decision, and not just the ranking the tool suggests without ever questioning it. The second is verifying candidates are clearly informed that an automated tool is used in processing their application. The third is making sure the company can explain, if challenged, the actual criteria behind a given outcome, which requires at least minimal documentation of the tool and its rules.

This topic is not theoretical in 2026. The CNIL demonstrated, in the first quarter of the year alone, its ability to impose heavy sanctions for data-processing failures, with more than fifty million euros in fines already issued, notably against Free, fined 42 million euros, and France Travail, fined 5 million euros, for security shortcomings. Its new AI Act enforcement powers push the ceiling for possible sanctions to 35 million euros or 7% of global turnover, a level that in theory applies to any company, whatever its size.

One point deserves clarifying, often misunderstood by SMBs that outsource recruitment to a tool supplied by a third-party vendor, an applicant-tracking-system publisher or a specialized platform. The company using that tool in its own recruitment process remains responsible for its compliance, the vendor carries only a shared, limited liability tied to its own technical role. A contract with a supplier does not transfer responsibility for how the tool is used.

This vigilance should not discourage the use of AI in recruitment, which remains, for an SMB facing a high volume of applications, one of the most cost-effective use cases in the short term. Compliance does not forbid automating the screening, it sets the terms under which it happens, a real human validation point and transparent candidate information, both compatible with meaningful time savings for HR teams.

This is what the Framing step of the IMPACT method must specifically document for each tool involved in an HR decision, its associated human validation point, and the information actually given to affected candidates about the use of automated processing. Recruitment is not an AI use case like any other, it is one of the few areas where the law has long set a clear limit on full automation, and where the regulator now has both the means and the intent to enforce it. A five-business-day diagnostic checks your HR tools for compliance before any audit.