AI CV Screening: Is “A Human Makes the Final Decision” Enough?

On 23 September 2026, the Spanish Data Protection Authority (AEPD) published a warning to a company that was planning to use an AI tool to screen and score job applications. The authority acted despite the tool not being yet live in the country, which is an uncommon practice, very telling of the attention these topics are receiving from a regulatory point of view.

The decision is short and there was no fine or penalty, but it is still worth a close read, because recruitment is probably the most popular use case of artificial intelligence tools across companies from all industries.  After all, who does not want to find the perfect candidate for a vacancy? 

In this article, we take a closer look at what the AEPD said and what it means for organisations with similar plans.

A Warning Before the Fact

The tool was designed to analyse CVs, assign scores and prioritise candidates, both for external hiring and for internal mobility. It was a group-wide project, developed centrally by the group. In December 2025, the Spanish company informed its workers' representatives that the tool was coming. It described the tool as a support tool and said a person would always take the final decision. During the investigation, the company explained that the tool scores each candidate on how well they match the requirements of the role, it does not analyse sensitive personal characteristics, and it is audited regularly.

The AEPD opened an investigation in January 2026 and responded with a warning under Article 58 para. 2 lit. a of the GDPR. This provision allows a supervisory authority to warn a controller that planned processing is likely to infringe the Regulation: a chance to fix things before processing starts.

The GDPR Does Not Ban the Tool

The AEPD acknowledges that AI can make recruitment more efficient and consistent and says plainly that the GDPR does not prevent its use. What the GDPR requires is safeguards that match the risks:

1. Data protection by design and by default (Article 25): safeguards belong in the design, selection and configuration of the tool, not bolted on at go-live.
2. A data protection impact assessment (Article 35): if the processing is likely to be high-risk, it must be assessed before it begins.
3. Transparency (Articles 12 to 14): candidates and employees must receive clear, accessible information about the processing, and specifically about the role the tool plays in the evaluation.

None of this is new, but it is nonetheless interesting to see it applied to a new and popular processing operation.

A Starting Point, Not an Answer

Article 22 of the GDPR gives individuals the right not to be subject to a decision based solely on automated processing, including profiling, where that decision has legal or similarly significant effects. Decisions about who gets a job or a promotion are an obvious example. 

The usual corporate response is to give their DPO assurances that the AI only scores, but the ultimate decision lies with a human. While that explanation is obviously important, it does not settle the question. After all, how do we know that the human actually looked critically at the machine's result? Faced with more than a hundred applications, is the recruiter doing anything more than rubber-stamping the algorithm's verdict? 

The AEPD underscores that human intervention must be real and effective: the recruiter must be able to critically assess the score produced by the AI and reach their own decision. But this is easier said than done. First, we all suffer from automation bias: we tend to trust what machines tell us. And on top of that, some vacancies attract more applications than any human could realistically review. That was true long before AI, but it was perceived differently. A recruiter who simply ignored a particular application was hardly controversial. The same recruiter passing over the same application because the AI rated it poorly is another matter.

The AI Act Can Wait. The GDPR Cannot.

AI systems used to filter job applications and evaluate candidates are high-risk under Annex III, point 4 of the AI Act. Following the Digital Omnibus on AI (Regulation (EU) 2026/1744), the obligations for these systems apply only from 2 December 2027. Some organisations have taken that delay as breathing room but forget that this is, first and foremost, a data protection topic. GDPR rules on transparency, impact assessments and automated decisions already cover most of what matters in recruitment and, importantly, data protection authorities do not need the AI Act to start enforcement procedures.

What Companies Should Do Now

1. Start early: criteria, thresholds and filters are design decisions with legal consequences. Involve data protection and compliance at the configuration stage.
2. Show the reasoning, not just the number: a bare “94%” in green letters gives the impression of an objective measure and invites deference. Recruiters should see which criteria the candidate met or missed, so they can check the score against the CV.
3. Make disagreeing easy: recruiters need the authority and the time to depart from the ranking. If going against the score requires a justification but following it does not, the process nudges towards formal rubber-stamping.
4. Train against automation bias: people tend to trust a machine that seems to work. Training should explain to recruiters what the tool cannot see, where it tends to go wrong and when they are expected to overrule it. Include specific material for your recruitment team in your AI Literacy suite. 

If you are planning to bring AI into your hiring or internal mobility processes and want to know where you stand, FIRST PRIVACY and the other companies of the DSN GROUP are happy to help.

This article provides general information and does not replace case-specific legal advice.