The AEPD warns: a human taking the final decision is not enough if an algorithm screens the CVs
Human oversight of automated recruitment must be able to change the outcome, rather than merely endorse a score. That is one of the warnings in the AEPD's note of 23 September about a proposed CV analysis system.
Human oversight of automated recruitment must be able to change the outcome, rather than merely endorse a score. That is one of the warnings in the AEPD's note of 23 September about a proposed CV analysis system.
Action before deployment
The company had told its staff about the future tool, but the system was not yet in use. Its planned function was to assess profiles and rank candidates, with potential effects on hiring and internal mobility.
The agency says the responsible person must be able to critically examine the algorithm's information. It also identifies the need to explain the processing of data and the tool's role to candidates and workers.
Risk assessment must begin at the design stage. Where processing may create a high risk to people's rights, a prior impact assessment will be necessary.
The preventive warning under GDPR article 58.2.a does not amount to a finding of an infringement. Nor does the note prohibit all AI in human resources: it requires safeguards to be built in before use. It is revisited here as background to elEconomista's report of 3 November, not as a new rule issued today.
Sources: official AEPD note of 23 September 2026 and elEconomista of 3 November. Consulted on 4 November.
Related links
- Agentic AI and data protection: the AEPD's position
- Algorithms and non-discrimination: Law 15/2022
- The AEPD's generative AI policy for law firms
The official warning is dated 23 September 2026; this article covers the press report of 3 November.
Fuentes
- eleconomista.es. Accessed 4 November 2026.
- AEPD, nota oficial de 23 septiembre 2026. Accessed 4 November 2026.
The specific data in this article come from the official sources cited.
