The AEPD warns a company considering AI to analyse CVs: transparency, impact assessment and effective human intervention

The Spanish Data Protection Agency (AEPD) has sent a warning to a company in connection with the possible deployment of an artificial intelligence tool intended for the screening and evaluation of applications in recruitment and internal mobility processes. The Agency's note, dated 23 September 2026, explains that the system would be used to analyse CVs, assign scores and, where appropriate, prioritise applications, and that it could directly influence decisions relating to access to employment and professional promotion. The tool would not yet have been put into operation, although the company had already informed its staff about its forthcoming implementation.

What an AEPD warning is

The Agency recalls the legal nature of the measure: the warning provided for in Article 58.2.a) of the General Data Protection Regulation (GDPR) is a preventive measure that the supervisory authority may adopt when it considers that planned processing operations may infringe the Regulation. Its adoption does not imply a declaration that the recipient entity has committed an infringement. The GDPR attributes to the Agency the power to warn a controller or processor preventively when the planned processing operations could infringe the GDPR, so that the controller can draw the appropriate criteria from it and, where appropriate, adapt the data processing it intends to carry out to the rules.

Data protection by design and by default

The AEPD's central message is that the incorporation of AI tools into recruitment and people-management processes can contribute to improving their efficiency and quality, but that to take advantage of them with safeguards, data protection must be integrated from the initial configuration of the project, reconciling innovation with the effective protection of the rights and freedoms of individuals. This approach takes shape, among other aspects, in data protection by design and by default: integrating data protection principles and safeguards from the initial phases of the conception of a technological project makes it possible to identify and adopt the measures appropriate to its characteristics and risks.

In this regard, the Agency points out that the company must adopt appropriate technical and organisational measures and assess the risks that the processing may entail for candidates and employees. And it adds a specific requirement: if the processing could entail a high risk to their rights and freedoms, the corresponding data protection impact assessment must be carried out beforehand.

Transparency and effective human intervention

The AEPD highlights the importance of transparency when a tool evaluates applications and provides a score on their suitability for a position: candidates and employees must receive clear, accessible and understandable information about the processing of their personal data and about the role the tool plays in the evaluation process.

On human intervention, the company stated that the final decision would correspond to a person. The Agency qualifies what that statement requires: for human intervention to be effective, the person making the decision must be able to critically assess the information or score provided by the system and make their own decision, without simply automatically assuming the result generated by the AI tool. Merely formal supervision does not satisfy the safeguard.

The note also recalls that the GDPR establishes the right of individuals not to be subject to decisions based solely on automated processing when they may produce legal effects or affect them in a significant way, and specifies that in this case its possible application will depend on how the tool actually works and on the degree of human intervention in the decision.

A system that can influence access to employment

The Agency's description of the planned system illustrates why this type of tool concentrates supervisory attention: a system intended to analyse CVs, assign scores and prioritise applications is not a simple administrative filter, but a tool that "could directly influence decisions relating to access to employment and professional promotion". That potential justifies designing the safeguards before deployment, not afterwards: the note itself stresses that the tool would not yet have been put into operation, which places the Agency's intervention at the moment when corrective measures are still possible.

The case also has an internal component: the company had informed its staff about the forthcoming implementation of the system, which shows that the intended scope also includes internal mobility and the professional promotion of those already on the payroll, not only external recruitment processes.

Why it matters to HR departments and their advisers

The warning traces the perimeter of what the supervisory authority expects before activating an algorithmic screening system: prior risk analysis, impact assessment if high risk is present, clear information to candidates and employees, and mechanisms that guarantee that the human decision is real and not an automatic reflection of the system's score. For firms advising companies on the digitalisation of human resources, the document offers a checklist applicable to any AI tool in recruitment - and a sample that the Agency is using the preventive warning as an instrument of early intervention, before the processing begins.

The safeguards, one by one

In order, the safeguards the Agency requires for this type of tool form a scheme applicable to any AI project in human resources:

• Prior risk assessment: adoption of appropriate technical and organisational measures and assessment of the risks for candidates and employees.
• Impact assessment: mandatory before deployment if the processing may entail high risk.
• Reinforced transparency: clear, accessible and understandable information about the processing and about the tool's function in the evaluation.
• Effective human intervention: the person deciding must be able to critically assess the result and make their own decision.
• Right against exclusively automated decisions: the GDPR recognises the right not to be subject to decisions based solely on automated processing when they produce legal effects or significantly affect the individual.

The warning as an instrument of early supervision

The case shows the practical use of a little-visible GDPR tool: the preventive intervention of the supervisory authority before processing begins. Unlike the sanctioning procedure, which acts on infringements already committed, the warning allows the Agency to set criteria when the project is still in the evaluation phase, so that the controller can "draw the appropriate criteria from it and, where appropriate, adapt the data processing it intends to carry out to the rules". For organisations, the reading is direct: consulting and documenting the safeguards in the design phase is not only good practice, but the way to avoid the authority's first reaction arriving when the system is already running.

Frequently asked questions

Has the AEPD sanctioned the company?

No. It has sent it a warning, a preventive measure under Article 58.2.a) of the GDPR that does not imply declaring that the entity has committed an infringement.

What does the Agency require regarding human intervention?

That it be effective: the person deciding must be able to critically assess the system's score and make their own decision, without automatically assuming the result.

When is an impact assessment needed?

When the processing may entail a high risk to the rights and freedoms of candidates and employees, the data protection impact assessment must be carried out beforehand.

Related reading

• The AEPD decalogue for AI assistants and agents
• The AEPD policy on generative AI in law firms
• AI Regulation and digital omnibus: the calendar for firms
• Council of Europe Framework Convention on AI

Sources

• AEPD, "La Agencia recuerda las garantías para utilizar IA en el análisis de currículums" (23 September 2026): https://www.aepd.es/prensa-y-comunicacion/notas-de-prensa/agencia-recuerda-garantias-para-utilizar-ia-en-analisis-curriculums