Regulators will look at automated candidate screening in 2027: what to put in place now

Picture this: you are the privacy officer at a Dutch municipality. HR uses a recruitment system that gives every application a match score. Anyone who stays below the threshold or gives the wrong answer to a knock-out question automatically receives a rejection email. A recruiter only looks at the candidates above the line. It is fast, and so far nobody has asked questions about it.

That may change in 2027. On 11 November 2026 the European data protection authorities chose exactly this kind of system as the topic of their next joint enforcement action.

What the EDPB decided

At its November plenary the EDPB chose the topic for its sixth coordinated enforcement action. According to the news item of 11 November 2026, the action concerns automated decision-making in recruitment, including AI-driven decision-making. More specifically, the authorities will look at the right not to be subject to a decision based solely on automated processing, and at the related right of access, in the use of tools that screen candidates automatically.

In such a joint action the participating authorities examine the same topic in their own country and then pool the results. Which authorities take part is not yet settled: they join voluntarily in the coming weeks. Whether the Dutch Data Protection Authority (AP) will take part is therefore not yet known. The action itself starts in the course of 2027. That gives you a few months to answer the three questions below.

Question 1: does the system decide without a person?

Article 22 GDPR gives everyone the right not to be subject to a decision based solely on automated processing where that decision produces legal effects or similarly significantly affects them. The GDPR names recruitment itself as an example: recital 71 mentions e-recruiting practices without any human intervention. The automatic rejection email in the example fits that exactly.

The score itself counts too. In SCHUFA (C-634/21) the Court of Justice held that automatically calculating a credit score is itself an automated decision where a third party draws strongly on it to enter into a contract. That case was about a credit score produced by another company; the Court did not rule on recruitment. The reasoning does readily extend to a match score: if the recruiter only looks at candidates above the line, the score in effect decides who drops out.

A person who reviews the outcome must be able to change it. In its report on the Dutch Tax Administration of 11 November 2026 the AP found that the Tax Administration could not show meaningful human intervention in algorithmic decisions where the law requires it. You can read it in our overview of GDPR enforcement. So record who reviews the rejections, what that person sees and how often they change the system's outcome.

Question 2: is it allowed, and which safeguards apply?

A decision based solely on automated processing is only allowed in three cases (Article 22(2) GDPR): it is necessary for entering into or performing a contract, a law authorises it with suitable safeguards, or the data subject gave explicit consent. In the first and the last case you must at least offer human intervention, let the candidate express their point of view and let them contest the decision (paragraph 3).

For a Dutch municipality the statutory route is narrow. Article 40 of the Dutch GDPR Implementation Act (UAVG) makes an exception for automated decisions needed for a legal obligation or a task in the public interest, but expressly not for decisions based on profiling. A match score that assesses candidates for suitability is, as a rule, profiling: the GDPR names the evaluation of performance at work, reliability and behaviour in so many words in the definition (Article 4(4) GDPR).

Our advice: at a municipality, have every rejection taken by a person who has seen the application itself, and use the score at most as an aid. Then there is no decision based solely on automated processing. Make sure this also works that way in practice, not only in the policy.

Question 3: can you explain it when a candidate asks?

A rejected candidate can make an access request. With automated decision-making you must then also give meaningful information about the logic involved and about the significance and the envisaged consequences (Article 15(1)(h) GDPR). In Dun & Bradstreet Austria (C-203/22) the Court of Justice made clear what that means: you explain the procedure and principles actually applied in an intelligible way. If you invoke a trade secret of the supplier, the supervisory authority or the court decides after balancing what is disclosed.

In practice you need that explanation from your supplier. Ask now which data the score is based on, which factors weigh most and how a candidate can improve their score, and record in the contract that you receive this information within the time limit for an access request.

The DPIA: probably already mandatory

A tool that automatically assesses or ranks candidates generally falls under item 15 of the AP's DPIA list: systematic and extensive evaluation of personal aspects based on automated processing, with the evaluation of performance at work, reliability or behaviour as examples. A DPIA is then mandatory (Article 35 GDPR). If you do not have one yet, that is the first step. How to approach a DPIA for an AI system is set out in our guide to DPIAs for AI systems.

What the AI Act adds

AI systems intended to be used for the recruitment or selection of people, in particular to analyse and filter job applications and to evaluate candidates, are listed in Annex III, point 4(a). The exception in Article 6(3) does not help here: an Annex III system that performs profiling is always high-risk. Under Regulation (EU) 2026/1744 those obligations apply from 2 December 2027.

For the municipality as deployer this means, among other things:

• Use in line with the instructions and human oversight by people with the necessary competence, training and authority, and the necessary support (Article 26). Also use the information the provider must supply for your DPIA (paragraph 9).
• Informing candidates that the system is used on them (Article 26(11)).
• A FRIA before putting the system into use, because a municipality is a body governed by public law (Article 27). Where the DPIA already covers a part, you may refer to it. More on that in the FRIA for municipalities.
• A right to explanation for anyone affected by the decision (Article 86), to the extent Union law does not otherwise provide for it. Where the decision falls under Article 22 GDPR, the explanation under Article 15(1)(h) GDPR from question 3 takes precedence. Where a person takes the decision based on the score, Article 86 is precisely the route to an explanation.

If the system is already running before 2 December 2027, the transitional rule of Article 111(2) applies: the high-risk obligations only apply after a significant change in design. Systems intended to be used by public authorities must comply by 2 August 2030 in any case. That is no reason to wait: the GDPR questions above apply now, and so does the AI literacy of the people working with the system (Article 4).

Bank and school, briefly

For a bank the same three GDPR questions apply. If a bank wants to reject automatically, it must be able to substantiate an exception under Article 22(2) GDPR, for example that the decision is necessary for entering into a contract. That has to be genuinely necessary, not merely convenient, and the safeguards of paragraph 3 then apply. A bank does not need a FRIA for recruitment: it is not a body governed by public law, as a rule does not provide public services within the meaning of Article 27, and recruitment does not fall under Annex III, point 5(b) or (c). The DPIA remains necessary.

For a school the FRIA depends on the legal form of the board. If it is a body governed by public law, such as a municipality or a public legal entity, a FRIA is needed. A foundation providing publicly funded education is probably a private entity providing public services: recital 96 of the AI Act names education in so many words. So assume a FRIA is needed, unless you can substantiate why not.

What to do now

1. Map which recruitment tools you use and where a rejection happens without a person, including with knock-out questions.
2. Record who reviews each rejection and what that person sees.
3. Ask your supplier for the explanation you must give in response to an access request, and put that obligation in the contract.
4. Draw up or update the DPIA, and already note the AI Act classification in it (Annex III, point 4(a)).
5. Update the privacy notice for candidates so that it mentions the existence of automated decision-making, the logic involved and the envisaged consequences (Article 13(2)(f) GDPR).

To check which obligations under the GDPR and the AI Act apply to your own recruitment tool, use the free case check. More on Article 22 GDPR for systems that act on their own is in AI agents and Article 22 GDPR.

What remains open

• Who takes part. Authorities join in the coming weeks. Whether the AP takes part is not yet known.
• What the action looks like. The EDPB has not yet published a questionnaire or set-up.
• Article 86 and Article 15 GDPR. Article 86 of the AI Act only applies to the extent Union law does not otherwise provide for the right to explanation. How the two relate in recruitment has not yet been decided by the Court.