Screening candidates with AI is legal in the EU, and the EU AI Act treats it as a high-risk use with specific duties for whoever uses it. Regulation (EU) 2024/1689 lists AI systems that analyse and filter job applications or evaluate candidates as high-risk, and since its July 2026 amendment those rules apply from 2 December 2027. For an employer or a recruitment agency, compliance comes down to using the system as its provider instructs, assigning a trained person to oversee it, keeping its logs, telling candidates and, where it applies, workers' representatives. The GDPR adds one more rule that already applies: a rejection should not rest on the AI output alone.
What is AI candidate screening
AI candidate screening is the use of an AI system to analyse, filter, rank or score candidates against the requirements of a role, so that a recruiter reviews a shorter, ordered list instead of every profile or application.
AI candidate screening takes several forms in day-to-day recruiting:
- Ranking sourced profiles: an AI system reads candidate profiles found through sourcing and orders them by fit with the brief.
- Filtering applications: an AI system sorts inbound applications and separates those that meet the must-have criteria.
- Scoring candidates: an AI system assigns a score or a fit level to each candidate for a specific role.
- Summarising candidates: an AI system condenses a profile or a CV into the points a recruiter needs to decide.
Where screening fits in the wider hiring process is covered in our guide to AI recruitment.
Is AI candidate screening high-risk under the EU AI Act?
Yes. AI candidate screening is high-risk under the EU AI Act because Annex III, point 4(a), of Regulation (EU) 2024/1689 covers AI systems intended for the recruitment or selection of people, in particular "to analyse and filter job applications, and to evaluate candidates". Article 6(2) classifies every Annex III system as high-risk.
Article 6(3) lets some Annex III systems out of that category when they only perform a narrow procedural or preparatory task, but it closes the door for most screening tools: an Annex III system is always high-risk when it performs profiling of natural persons, and ranking or scoring candidates against a role usually means profiling them.
The AI Act splits the duties between two roles. The provider develops the AI system and places it on the market under its own name. The deployer uses the AI system under its own authority: in AI screening, the employer or the recruitment agency running the tool.
When do the AI Act rules on AI screening apply? The 2026 timeline
The AI Act's high-risk obligations for AI candidate screening apply from 2 December 2027. Regulation (EU) 2026/1744, the Digital Omnibus on AI of 8 July 2026, moved that date for Annex III systems; the European Commission states that the amendment entered into force on 27 July 2026.
Two parts of the EU AI Act already apply to anyone screening with AI. The prohibited practices of Article 5 have applied since 2 February 2025. The AI literacy duty of Article 4 has applied since the same date and, as reworded by the July 2026 amendment, asks providers and deployers to take measures to support the AI literacy of the staff who operate AI systems, without guaranteeing a specific level for each person.
What employers and agencies must do when they screen with AI
Employers and recruitment agencies that screen candidates with a high-risk AI system act as deployers, and Article 26 of the EU AI Act sets out their obligations. From 2 December 2027, a deployer must:
- Use the AI system according to its instructions for use, with appropriate technical and organisational measures (Article 26(1)).
- Assign human oversight to people with the necessary competence, training and authority to question the AI system's output (Article 26(2)).
- Make sure the input data is relevant and sufficiently representative for the role, to the extent the deployer controls that data (Article 26(4)).
- Monitor how the AI system works and inform the provider if something goes wrong; if using it as instructed could present a risk, suspend its use and inform the provider (Article 26(5)).
- Keep the logs the AI system generates automatically for at least six months, where they are under the deployer's control, unless other Union or national law says otherwise (Article 26(6)).
- Inform workers' representatives and the affected workers before using a high-risk AI system at the workplace, when the deployer is their employer (Article 26(7)).
- Inform candidates that they are subject to a high-risk AI system when it is used to make or help make decisions about them (Article 26(11)).
What to ask your AI screening provider
The provider of a high-risk AI screening system carries most of the technical obligations, and a deployer can only use the system correctly with the provider's documentation. Article 16 of the EU AI Act requires the provider to meet the high-risk requirements, run a conformity assessment, draw up an EU declaration of conformity, affix the CE marking and register the system.
Before signing, an agency or a talent acquisition team can ask the AI screening provider for:
- The instructions for use, which the deployer will have to follow under Article 26(1).
- The human oversight measures the AI system supports, such as reviewing and overriding a ranking.
- The logs the AI system records and how the deployer can export and keep them.
- The data the AI system evaluates and how the provider limits discriminatory outcomes.
- The provider's plan for 2 December 2027: conformity assessment, CE marking and registration.
AI Act obligations for AI screening, side by side
The EU AI Act obligations for AI candidate screening split between the provider of the AI system and the employer or agency that deploys it, and they start on different dates:
| Obligation | Who meets it | Applies from | Source |
|---|---|---|---|
| No AI inference of emotions at the workplace | Provider and deployer | 2 February 2025 | Article 5(1)(f) |
| Measures to support staff AI literacy | Provider and deployer | 2 February 2025 (reworded in July 2026) | Article 4 |
| Conformity assessment, CE marking, registration | Provider | 2 December 2027 | Article 16 |
| Use according to the instructions for use | Deployer | 2 December 2027 | Article 26(1) |
| Human oversight by trained people | Deployer | 2 December 2027 | Article 26(2) |
| Logs kept for at least six months | Deployer | 2 December 2027 | Article 26(6) |
| Inform candidates about the high-risk AI system | Deployer | 2 December 2027 | Article 26(11) |
| Human intervention in automated decisions | Controller (employer or agency) | Already applies | GDPR Article 22 |
What the AI Act prohibits in recruitment
The EU AI Act prohibits the use of AI systems to infer the emotions of a natural person in the workplace, except for medical or safety reasons. The ban is in Article 5(1)(f) and has applied since 2 February 2025.
For AI candidate screening, the compliant alternative is to evaluate what the role requires: skills, experience, location and other criteria that can be explained to the candidate. A screening process built on those criteria stays within Annex III, where the AI Act allows it with the obligations above.
What GDPR Article 22 adds to AI screening
Article 22 of the GDPR gives candidates the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significantly affects them. The practical rule for AI candidate screening is that a person reviews any rejection before it is final.
Where an exception allows a fully automated decision, Article 22(3) requires at least the right to obtain human intervention, to express a point of view and to contest the decision. The rest of what the GDPR asks of a sourcing workflow, from lawful basis to retention, is in our guide to GDPR-compliant sourcing tools.
How to screen candidates with AI compliantly, step by step
A compliant AI candidate screening workflow keeps the AI on the reading and ordering and leaves every decision with a recruiter. Five steps cover it:
- Write criteria tied to the role. List the must-have and nice-to-have requirements before the AI screens anyone, and leave out anything that is not needed for the job; our article on unconscious bias in recruitment shows which criteria tend to slip in.
- Let the AI rank, not reject. Use the AI system's output to order the list, and have a recruiter review every candidate it places at the bottom.
- Record each decision. Note who reviewed each shortlist, which candidates were discarded and why, and keep the AI system's logs.
- Inform the candidate. Tell candidates that AI helps screen their profile or application, and how they can ask for a human review.
- Train the reviewers. Make sure the recruiters who oversee the AI understand how it ranks and when to overrule it.
The full selection process around these steps, from sourcing to interview, is in our step-by-step guide to AI-powered candidate selection.
How HeyTalent handles AI screening of LinkedIn profiles
HeyTalent screens LinkedIn profiles with AI variables that the recruiter defines, such as "has worked at a payments company", and orders the candidates by those criteria, while the recruiter reviews the list and decides who moves forward. That split matches the compliant workflow above: the AI reads and ranks, a person decides.
HeyTalent Agent Mode turns a brief into a LinkedIn search with advanced filters, reads each profile and shows the closest matches in a table. The recruiter sees each step live, adjusts the list and the messages, and only then launches the campaign.
The volume a recruiter reviews stays manageable. According to HeyTalent's own data, it has analysed more than 100,000 unique LinkedIn profiles, and a typical search list gathers about 49 candidates, a size a recruiter can check one by one.