Automated recruitment decisions selected for coordinated EU scrutiny in 2027

What happened?

On 11 November 2026, the European Data Protection Board selected automated decision-making in recruitment, including AI-driven decisions, for its 2027 coordinated enforcement action. The focus is the right not to be subject to decisions based solely on automated processing and the related right of access.

National supervisory authorities may join voluntarily. The action is due to launch during 2027; the announcement gives no exact starting date and does not say that every employer in Estonia will be inspected.

What does this mean for your business?

For employers subject to the GDPR, the question is what the recruitment system actually does. Does it help a person assess applications, or does it effectively decide who progresses? Article 22 concerns solely automated decisions producing legal or similarly significant effects.

This is not a blanket ban on AI-assisted recruitment. Article 22 contains exceptions, but their conditions and safeguards must be assessed separately. Selecting an enforcement topic does not itself create a new legal obligation.

Who is affected?

Employers, recruitment agencies and businesses using candidate-screening software, particularly tools that rank or automatically reject applicants.

What should you do?

Magilex recommends mapping the data used, who makes each decision and whether a human reviewer can genuinely change the result. Ask the supplier to explain automated screening and its role in the workflow.

Review candidate privacy information and how access requests or challenges are handled. Where an Article 22 exception is relied on, document the basis and the required safeguards. A supplier assurance alone does not assess your particular workflow.

Key dates

11 November 2026 — the EDPB announced the selected enforcement topic.

2027 — planned launch year. The announcement sets no new common calendar deadline for employers.