Screening job applications with AI: what EU data protection law, France’s CNIL and the AI Act require

In one sentence: A recruiter may use AI as an aid, but a tool that rejects candidates whose applications no person has examined falls under the very restrictive regime of Article 22 of the GDPR, and AI systems that filter job applications are classed as high-risk under the EU AI Act.

This guide is for HR teams, recruitment agencies and owners of small businesses who do their own hiring in France or elsewhere in the EU. It does not rest on any trial of software: it sets out what the reference texts say, mainly the recruitment guide of the CNIL (Commission nationale de l’informatique et des libertés, France’s data protection authority), the General Data Protection Regulation (GDPR) and the EU AI Act, then suggests a way to apply them. It does not replace advice from your data protection officer or a lawyer. Other practical guides are in the Guides section.

Who is concerned outside France

The core rule is European. Article 22 of the GDPR gives every person “the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her”. It allows three exceptions: the decision is necessary for entering into a contract, it is authorised by Union or Member State law with suitable safeguards, or it rests on the person’s explicit consent. In the first and third cases, the controller must at least offer the right to obtain human intervention, to express a point of view and to contest the decision.

The AI Act is a regulation, so it applies directly in every Member State. Under its Article 2, it covers deployers established or located in the EU and providers that place AI systems on the EU market, wherever they are based. Guidance on Article 22, by contrast, comes from each national data protection authority. The CNIL’s reading leans on EU-level guidelines on automated decision-making (WP251rev.01, adopted by the Article 29 Working Party and last revised on 6 February 2018), which the CNIL attributes to the European Data Protection Board, the body that brings together the EU’s national authorities. If you recruit in another EU country, check whether its own authority has published guidance.

In France, the subject is under scrutiny. On 3 April 2026, the CNIL named recruitment among its priority inspection themes for 2026 (page in French). The checks focus on automated decision-making systems, the information given to candidates and retention periods, and mainly target large companies and recruitment agencies because of the volume of applications they handle. The CNIL adds that this theme “will foreshadow” its future role as market surveillance authority for employment under the AI Act (our translation).

What the CNIL says about screening software

Sheet no. 13 of the CNIL recruitment guide (in French, published on 30 January 2023) deals with software that sorts, ranks and evaluates applications. Its position is summed up on the CNIL’s English page AI: ensuring GDPR compliance, written in 2022 when the guide was still a draft: because these decisions are “often opaque to candidates, such processes are in principle prohibited by the GDPR”, and their use “is allowed only in exceptional circumstances”. The final guide keeps that position.

The tricky question is when a decision counts as fully automated. For the CNIL, it does when no human is involved, but also when the controller “is unable to explain the reasons for the decision proposed by the algorithm” and then accepted by a person (our translation). The guide adds that a decision that removes a candidate from the process should “in general be considered as significantly affecting them” (our translation). In practice, if your software pre-ranks hundreds of CVs and you only read the top ones, the candidates nobody looked at were excluded by the software alone.

The exceptions are narrow. Consent can justify such a decision only “very rarely” (our translation), the guide explains, because a candidate who refuses may fear losing the job. The CNIL also notes that no French law authorises these systems in recruitment. That leaves necessity for concluding the employment contract, to be read strictly. The EU guidelines give the scenario of a business that “receives tens of thousands of applications” and, “due to the exceptionally high volume of applications”, may need automated means to draw up a shortlist. The CNIL’s advice, if in doubt: do not use tools likely to produce such decisions.

What the AI Act changes for HR tools

Annex III, point 4, of Regulation (EU) 2024/1689 classes as high-risk “AI systems intended to be used for the recruitment or selection of natural persons, in particular to place targeted job advertisements, to analyse and filter job applications, and to evaluate candidates”. It also covers AI used to decide on promotion or termination, to allocate tasks based on behaviour or personal traits, and to monitor and evaluate workers’ performance.

For the employer that uses such a tool (the “deployer”), Article 26 of the AI Act requires that, before putting it into service at the workplace, deployers who are employers “shall inform workers’ representatives and the affected workers that they will be subject to the use of the high-risk AI system”. The same article requires human oversight by people with the “necessary competence, training and authority”, logs kept for at least six months where the deployer controls them, and use of the provider’s documentation for the GDPR impact assessment. Article 86 gives a person affected by a decision based on such a system the right to obtain “clear and meaningful explanations of the role of the AI system in the decision-making procedure”.

The timeline has moved. Regulation (EU) 2026/1744, published in the Official Journal of the EU on 24 July 2026, sets 2 December 2027 as the date from which the high-risk rules apply to Annex III systems, instead of 2 August 2026. Its recital 40 cites “the delayed availability of standards, common specifications, and alternative guidance and the delayed establishment of national competent authorities”. The other dates are set out in our EU AI Act timeline after the 2026 delay.

One ban already applies. Since 2 February 2025, Article 5 of the 2024 regulation prohibits the use of AI systems “to infer emotions of a natural person in the areas of workplace and education institutions”, except for medical or safety reasons.

If you recruit in France: the labour code

French employers also have to comply with the Code du travail, France’s labour code. According to the CNIL guide, Articles L. 1221-6 to L. 1221-9 require that information asked of a candidate has a “direct and necessary link” with the job (our translation), that recruitment methods are relevant to that purpose, and that the candidate is expressly informed of them before they are used. For tools based on “learning” algorithms, the CNIL says the recruiter must check their relevance, including how they were trained. In France, the workers’ representatives mentioned by the AI Act usually sit on the comité social et économique (CSE), the elected staff council.

The step-by-step guide

1. Take stock. In your record of processing activities, list every feature of your tools that sorts, ranks, scores or rejects applications: the CNIL asks recruiters to identify and document processing likely to produce fully automated decisions. Ask the vendor for a written description of how it works. In the bad practice case described by the CNIL, a company buys an off-the-shelf tool whose workings are not explained, which prevents it from checking that the tool is relevant.

2. Put a human back on every rejected application, or check that you really fall within the necessity exception. The guide’s good practice case involves several hundred applications received through one detailed online form, identical for all candidates and more reliable than CVs of varying shapes, with candidates told from the outset that a first automated sort may take place.

3. Inform candidates. State whether there is an automated decision, its logic, its consequences and the right to obtain human intervention. The CNIL recommends giving candidates two dates: the one from which they should consider their application rejected, and the one until which they can ask for a human review, both before the hiring is finalised.

4. Carry out a data protection impact assessment (DPIA) that addresses the risk of discriminatory bias, avoid any profiling based on sensitive data or on variables correlated with it, and involve your data protection officer if you have one. Set retention periods too: for a pool of candidates kept for future openings, the guide recommends no more than two years after the last contact.

5. Keep generative AI to tasks without candidate data. In its Q&A on the use of generative AI systems, the CNIL writes that helping employees draft content “will be less risky than using a system to assist decision making about customers, candidates or citizens”. It advises users to “never share confidential information such as personal data” when using a consumer service. A leak at a provider shows why: see what to check after the Notion AI leak at Fireworks. For the GDPR right to object when your own data feeds AI training, see our guide on how to object to AI training in France and the EU. A language model can also produce plausible errors: proofread everything.

6. Prepare for 2 December 2027. If an AI tool takes part in filtering or evaluating candidates, plan how you will inform workers’ representatives and the affected workers, and ask the provider for the instructions for use the AI Act requires it to supply to deployers under Article 13.

Three prompt templates to adapt

These templates are for drafting, not for assessing people. Replace the square brackets with your own details, without any name or CV.

Prompt template to adapt, not tested by Le Latent, for a skills-based job advertisement:

You are a recruiter. Write a job advertisement for the role of [job title], on a [contract type], based in [location].
Responsibilities: [list of responsibilities].
Skills and qualifications genuinely required: [list].
Constraints: mention only criteria directly linked to the job; no reference to age, sex, origin, family situation, appearance or any other criterion unrelated to the role. Flag any wording that could be read as discriminatory.
Format: 250 words at most, neutral tone, responsibilities as a bulleted list.

Prompt template to adapt, not tested by Le Latent, for a candidate privacy notice (to be checked by your data protection officer):

Draft a privacy notice for job applicants, in plain English, using only the details below. Do not invent anything: if a detail is missing, write [TO BE PROVIDED].
Controller: [name and contact details]. Data protection officer: [contact details].
Purpose: managing recruitment for the role of [job title].
Tools used: [description of each recruitment method or tool].
Automated decision: [yes or no; if yes, its logic and consequences].
Right to obtain human intervention: [how to exercise it, address].
Date from which the application should be considered unsuccessful: [date]. Deadline to request a human review: [date].
Retention period: [period].

Prompt template to adapt, not tested by Le Latent, for an interview grid shared by all candidates:

Propose a structured interview grid for the role of [job title], based on this list of skills: [list].
For each skill: two open questions about work situations, and observable indicators to assess it.
Exclude any question about private life, health, family, opinions or any topic not directly linked to the role.

What remains to be checked

The CNIL guide dates from January 2023, before the AI Act was adopted, so it does not cover the obligations specific to that regulation. Conversely, the AI Act does not replace the GDPR, which still applies to candidates’ data. Recital 40 of Regulation (EU) 2026/1744 asks the Commission to have guidance, standards, common specifications and codes of practice in place in due time: the practical details for high-risk systems may still be clarified before December 2027.