When an algorithm ranks the top ten CVs and discards the rest before a human ever reads them, has a machine made the hiring decision? According to Spain’s Ministry of Labour, the answer is yes. Its guidance on algorithmic information in the workplace uses exactly that scenario and concludes that an automated decision has taken place, even if the surviving candidates later meet a recruiter face to face.
Employers increasingly deploy algorithms and AI systems to publish job ads, rank résumés, run chat or video interviews and even set salary offers. As a candidate, you have the right to know whether an automated system rejected you, to demand that a person review the outcome and to challenge the decision. Europe’s AI Act classifies these systems as high risk, but its core obligations for recruitment do not bite until 2 December 2027. In the meantime, the GDPR is your main lever.
Where AI Enters the Hiring Pipeline
The Ministry’s guidance, published in May 2022 and drafted by a committee of experts, maps four stages where these tools appear. The first is publishing the vacancy, which can be segmented across social networks or platforms so that only certain profiles see it. The second is pre-selection: processing CVs and ranking applicants. The third is the interview, where chatbots request additional information, facial recognition systems operate or psychometric tests generate further indicators about the person. The fourth is hiring, with predictive models used to personalise salary offers.
The AI Act covers the same terrain. Annex III, point 4, treats as high risk any system intended for recruitment or selection, particularly to post targeted job advertisements, analyse and filter applications and evaluate candidates. Recital 57 explains why: such tools can perpetuate historical patterns of discrimination against women, age groups, people with disabilities or candidates of particular origins.
One use is already banned. Article 5 has prohibited, since 2 February 2025, AI systems that infer emotions in the workplace, except for medical or safety reasons. Recital 44 cites the lack of scientific basis for these systems and the power imbalance in employment. The text refers to workplaces and does not explicitly mention selection interviews, so any video tool promising to read your enthusiasm or nervousness should raise red flags.
Your Rights When an Algorithm Says No
The central protection is the right not to be subject to a decision based solely on automated processing that significantly affects you. Article 22 of the GDPR sets this out, and recital 71 cites online recruitment services with no human involvement as an example.
That right has exceptions, and the one most relevant to hiring is where the decision is necessary to enter into a contract. The Spanish data protection authority, the AEPD, addresses this in its guidance on data protection in employment relations: it considers automated decision-making acceptable in high-volume processes for a first screening that excludes anyone lacking an essential requirement, such as a mandatory qualification. But it adds clear limits:
- The algorithm must not discriminate. If it hires far more men than women, it must be modified.
- There must be a human intervention mechanism if the affected person requests it, plus a channel to express an opinion and contest the decision.
- You have the right to receive an explanation of the decision taken.
- Human oversight must be meaningful, not a symbolic gesture.
The Ministry’s guidance agrees: if the reviewer simply replicates what the algorithm decides, the process must be treated as fully automated, and intervention must occur at each partial decision.
Add to this the right to information. Articles 13.2.f, 14.2.g and 15.1.h of the GDPR require disclosure of automated decision-making and, at least in those cases, meaningful information about the logic involved and the envisaged consequences. According to the Ministry, that obligation does not extend to handing over source code.
One warning about a common practice: the AEPD reminds candidates that they are not obliged to allow an employer to probe their social media profiles, and that even a public profile requires a legal basis for processing. Closing your accounts does not necessarily hide everything.
What the AI Act Changes, and When
What changes are the obligations on employers, and later than originally planned. The high-risk regime for Annex III systems, including recruitment, applies from 2 December 2027.
The original date was 2 August 2026. It was postponed by Regulation (EU) 2026/1744, the digital omnibus on AI, published on 24 July 2026, which cites delays in technical standards, guidance and national authorities. The postponement covers Sections 1, 2 and 3 of Chapter III of the AI Act, which house the requirements for these systems and the obligations of those who deploy them.
Once in force, Article 26.11 will require an employer using such a system to decide about people to inform them that they are exposed to it. Article 26.7 also requires informing workers’ representatives before a high-risk system is used in the workplace. Article 86 grants a right to clear explanations about the system’s role in a decision that harms you, though only to the extent that right is not already covered by other EU law such as the GDPR.
What You Can Ask For in Practice
- Before applying: read the privacy clause in the job posting. If it mentions automated decisions, it must explain the logic and consequences.
- If you are rejected: ask in writing whether an automated decision was involved, what criteria the system used and for a human to review your application. You can state your case and contest the outcome.
- To see what data they hold: exercise your right of access, which includes information about automated decisions.
- If they do not respond or the answer is inadequate: you can lodge a complaint with the AEPD.
The European delay leaves candidates with the same rights they already had, which are considerable but depend on being claimed. Few applicants realise that an automatic rejection at the first screening counts as an automated decision. Until the AI Act forces employers to disclose, transparency in hiring will remain request-driven, and asking is how you make a company test whether its filter survives scrutiny.