A company can explore AI tools to organise job applications, but it should not turn an automatic score into an unquestionable decision. The Spanish Data Protection Agency (AEPD) issued a warning in September 2026 about a CV-analysis project and recalled that data protection must be built in from the design stage. Before deploying anything, review purpose, necessity, bias and human oversight.
What did the AEPD warn about regarding AI in recruitment?
On 23 September 2026 the Spanish Data Protection Agency reported a warning addressed to a company that was evaluating a system to analyse CVs and assign scores. The note acknowledges that AI can contribute to efficiency, but insists on building data protection safeguards in from the start.
The message is not that every HR automation is forbidden. Nor is it a general permission to rank people with any model. The decisive point is which information is processed, for what purpose, with what impact and who decides.
Imagine an accountancy firm with several administrative vacancies. It receives applications by email, downloads attachments, looks for availability and coordinates interviews. There is organisational work that can be simplified without handing a machine the decision about who deserves an opportunity.
Now change the scenario: the system reads the CVs, assigns a "suitability" number and automatically rejects anyone below a threshold that nobody can explain. That is where the risks of discrimination, misreadings and decisions that affect real people appear.
The difference between the two designs is not settled by a "responsible AI" label. It is settled by documenting the use, limiting the functions and setting up real controls. A tool that seems to save time can create more problems if the team cannot correct its mistakes.
Source: AEPD, safeguards for using AI in CV analysis, 23/09/2026. It also appears in the official index of press releases. Accessed: 09/10/2026.
Which administrative tasks can be simplified?
It helps to separate managing applications from evaluating people. The first contains repetitive tasks that do not necessarily require inferring personal traits. The second can have significant consequences and demands a far more rigorous assessment.
In a small recruitment process, these needs can appear:
- Confirm receipt of an application without promising an interview.
- Record the date and the position the person is applying for.
- Stop emails or documents getting lost between shared inboxes.
- Tell the team that an application still needs reviewing.
- Propose interview times and record a confirmation.
- Apply the retention period that the company has defined in line with the regulations.
These functions are not exempt from obligations: they still process personal data and require controls. But their purpose is different from predicting the quality of a person through statistical patterns.
For example, an automation can create an internal task when an application arrives at a designated address. It does not need to deduce age, origin, family situation or other sensitive attributes. The less data it uses to solve the problem, the easier it will be to explain and supervise the workflow.
It can also detect unanswered applications or duplicate interviews. That improvement is measured by the order of the process, not by promises about hiring.
You need to design what happens when the file does not open, the email contains another person's data or a candidate asks to exercise a right. The process must remain manageable by humans and not depend on the model always answering correctly.
Why can scoring candidates be a problem?
A score seems objective because it is expressed as a number. Yet the number depends on criteria, data and design decisions. If the system favours certain words, career paths or CV formats, it can penalise valid applications without the team noticing.
Imagine a company that needs a customer service person who can work in two languages. A system trained on generic descriptions might give more weight to certain technical expressions than to the practical experience of resolving incidents. That example is hypothetical, but it shows why the criterion has to be checked against the real work.
Another difficulty is data quality. A CV can omit relevant experience, contain abbreviations or present information in a layout that an extractor misreads. If the result is used to exclude, a reading error can turn into an unfair decision.
The European AI Regulation, Regulation (EU) 2024/1689, includes AI uses in employment and recruitment within its framework of high-risk systems, with nuances and exceptions that must be examined according to the specific function. Not every system involved in human resources automatically has the same legal classification.
The GDPR also applies. Even for an internal tool, the company must justify purpose, necessity and safeguards.
The goal is not to get an algorithm to simply imitate the organisation's historical decisions. If those decisions contain bias, automating them can reproduce it. Human oversight has to be able to challenge the result, not just click accept.
Source: European Commission, Annex III of the AI Act. Accessed: 09/10/2026.
What does the GDPR require you to review before deploying the system?
The GDPR requires an appropriate legal basis for processing and principles such as data minimisation, purpose limitation, accuracy and transparency. The specific application depends on the process and the tool. Adding a generic checkbox to a form is not enough.
Before signing up, ask where the data is hosted, which provider has access to it, whether it is used to train models, how long it is kept and how access or erasure requests are handled where relevant. The answers must appear in verifiable contractual and technical documentation.
You need to consider whether a data protection impact assessment is required under Article 35 of the GDPR. Article 22 must also be analysed where decisions are based solely on automated processing with legal or similarly significant effects. Not every automatic recommendation triggers that article by itself, but ignoring it would be imprudent.
A nominal human review is not enough if the person lacks the information, time or authority to change the outcome. If a tool recommends rejecting someone, the person in charge should be able to review the grounds and correct errors. When that is not possible, the system may not be suitable for that use.
If it involves an external provider, check the data processing agreement where relevant, international transfers, security measures and deletion mechanisms. Do not send real CVs to a public AI tool before those conditions have been clarified.
The information given to candidates must be understandable and in line with the applicable obligations.
Sources: GDPR, Regulation (EU) 2016/679 and AEPD innovation resources (in Spanish). Accessed: 09/10/2026.
How do you design a responsible pilot in a small business?
Start with a problem you can describe without talking about algorithms: "applications reach three mailboxes and we do not know who has replied". That wording lets you study an organisational solution before considering automatic classification.
Then define what the system will do and what is expressly out of scope. It can record the arrival of an email, assign a task and remind someone of a pending reply. It does not have to evaluate personality, infer protected characteristics or decide who gets an interview.
Use test data or properly prepared examples to validate the process. Check corrupted attachments, duplicate names, withdrawn applications and messages sent in error. Design a way to stop the workflow and correct records without losing the history that is needed.
Agree who is responsible for reviewing incidents. If the provider changes its model or the conditions of the service, the company must know how to detect it and assess whether it affects its safeguards. A pilot does not end when it "works" once; it ends when you understand how it fails.
Avoid imposing disproportionate infrastructure. Sometimes a clear form and a shared calendar are enough. Automate only what solves a real need with risks you can control.
Before scaling, review the pilot with the people responsible for recruitment and data protection. Document decisions, limits, incidents and acceptance criteria. If you cannot explain the system simply, it is not yet ready to take part in sensitive decisions.
How have we approached it at meiika?
At meiika we approach custom systems and self-management agents starting from specific tasks and their limits. In a recruitment process, the first step would be to separate administrative management from evaluating applications.
We do not present any scoring tools of our own for people, HR clients or recruitment results that are not documented. If a project requires assessing candidates with AI, its legal fit, risks and applicable safeguards must be reviewed with specialist professionals before deployment.