Deployment of AI Recruitment Tools in the EU: Employer Obligations Under GDPR and EU AI Act
Employers in the EU using AI-powered recruitment tools face obligations under both GDPR and the EU AI Act, which together impose rules on how candidate data is collected, processed, and used in automated hiring decisions.
Why this matters: If you have applied for a job recently, there is a reasonable chance an AI tool screened you before a human did. In the EU, that now triggers real legal obligations for employers. GDPR already covers candidate data. The AI Act adds a new layer, because hiring tools are classified as high-risk systems. That means employers cannot just plug in a vendor product and call it done. They have to document it, audit it, and take responsibility for outcomes. Job seekers rarely know any of this is happening, which is exactly why the rules exist.
Who should care: Lawyers · Privacy officers · AI governance · Administrators · General readers · Policy
This summary is AI-assisted and may contain errors. It is an original briefing to help you gauge significance quickly — not a reproduction of the source. Always read the linked original before relying on it. See our methodology.