Where AI sits in the hiring process
Almost every employer above a certain size runs an applicant tracking system, an ATS. The international names are Workday, Oracle Taleo, SAP SuccessFactors, Greenhouse, Lever and SmartRecruiters. In Europe you are just as likely to meet Personio from Munich, Teamtailor from Stockholm or Recruitee from Amsterdam, especially at small and mid-sized companies.
The ATS is not mainly a judge. Its first job is administration: storing applications, removing duplicates and pulling structured data out of your CV. Name, employers, job titles, dates, education, skills, languages. That extraction step is what people mean by keyword screening, and it has existed since the 1990s.
The second step is what changed. Newer systems use language models to summarise a CV and score how well it fits a specific ad, rather than counting how often the word "Python" appears. That handles context better and behaves less predictably. A recruiter may also use AI to draft the ad, to search a database of past candidates, to run a first-round chat, or to transcribe and summarise an interview.
| Stage | What the software typically does | What you can influence | Rule that applies |
|---|---|---|---|
| Application intake | Extracts name, employers, dates and skills from your file | Layout, file format, standard headings | GDPR: data must be accurate, and you can access it |
| First screening | Ranks or scores the CV against the ad text | Terms taken from the ad, evidence with numbers | AI Act Annex III: high-risk, human oversight required |
| Online assessment | Timed tests, coding tasks, game-based scoring | Practice, time management, accessibility requests | GDPR Article 22 if scoring is fully automated |
| Video interview | Transcription, summaries, in some products voice or expression analysis | Structured answers, notice about recording | AI Act Annex III and Article 86 explanation right |
| Final decision | Usually human, sometimes guided by a score summary | Ask how the decision was reached | GDPR Article 22 right to human intervention |
What the AI Act says about CV screening
Recruitment is one of the areas where the EU has drawn a hard line. Annex III of the AI Act lists systems used "for the recruitment or selection of natural persons, in particular to place targeted job advertisements, to analyse and filter job applications, and to evaluate candidates" as high-risk. That covers CV filters, candidate ranking tools and AI interview analysis. It does not cover a spell-checker in Word.
High-risk status brings duties for both the company and the vendor: risk management, data governance, technical documentation, logging, accuracy checks, human oversight, and clear information for the people affected. Article 26 also requires employers to inform workers' representatives before such a system is put into use in the workplace.
For a candidate, the most useful provision is Article 86, the right to an explanation. If a high-risk system contributes to a decision that significantly affects you, you can ask the employer for a clear and meaningful explanation of the role the system played. Penalties for breaching high-risk obligations reach €15 million or 3% of global annual turnover, whichever is higher.
On timing, the original application date for the Annex III high-risk rules was 2 August 2026, but that deadline was deferred. The Digital Omnibus on AI, adopted as Regulation (EU) 2026/1744, was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026, pushing back the timetable for the high-risk obligations. As of today those obligations are therefore not yet fully in force. The Annex III classification of recruitment and selection tools as high-risk is unchanged by the Omnibus.
Your GDPR rights during a hiring process
The AI Act sets rules for the tool. The GDPR sets rules for your data, and these rights apply whether or not AI is involved.
- Right to be informed (Articles 13 and 14). If a company collects data about you, including from LinkedIn or a recruiter database, it has to tell you, normally within one month.
- Right of access (Article 15). You can ask for a copy of your application data and for information about the logic involved in automated processing.
- Article 22. You have the right not to be subject to a decision based solely on automated processing that significantly affects you. Recruitment decisions usually qualify. You can ask for human intervention, state your view and contest the outcome. In practice most employers keep a person in the loop, which is why this right is harder to use than it looks.
- Deletion. Failed applications should not be kept forever. Many European employers store them for six to twelve months, with consent or another legal basis. You can ask for deletion at any time.
A short written message is enough: "Please confirm whether an automated system was used to assess my application, what data it processed, and how I can request human review." In Czechia the supervisory authority is ÚOOÚ; every EU country has its own data protection authority, and you can complain to the one where you live or work.
Formatting rules that still matter
Layout
Single column. Standard headings: Work experience, Education, Skills, Languages. Two-column designs with sidebars still lose content in some older parsers, and no design credit is worth a missing job title. Put your email and phone number in the body text, not only in a header or footer, because some systems drop those fields.
File format
Follow the instructions in the ad. If there are none, a text-based PDF is the safe default; use .docx when a portal asks for it. Never send a scan or a photograph of a CV. Keep dates in one format, usually MM/YYYY, and explain gaps of more than a year in a single line.
Language
Mirror the vocabulary of the ad. If it says "customer success", do not write "client happiness". Semantic matching handles synonyms better than it did five years ago, but industry terms still carry weight. Spell out an abbreviation once, then use the short form.
What not to do
No white text, no 1-point fonts, no hidden keyword blocks. Parsers extract that text and recruiters can see it. It is one of the fastest ways to be removed on purpose rather than by accident.
Photos and personal details
A photo is normal in Germany, Austria and parts of Central Europe and unusual in the UK, the Netherlands and the Nordics. Some employers deliberately strip names and photos before the first review to reduce bias, and some public-sector roles use anonymised applications. If the ad mentions an anonymous process, follow that format exactly.
Using AI on your own CV
Using AI to write your CV is not a problem in itself. Using it to invent is. The useful jobs are structural: turning a list of duties into results, cutting three pages down to two, translating a Czech CV into business English, checking that dates match, or drafting a cover letter you then rewrite in your own words.
The real risk is register. Language models default to phrases like "results-driven professional" and "passionate about driving impact", and a recruiter who reads forty documents a day spots the pattern within seconds. Replace every abstract claim with something checkable: a budget you managed, a number of users, a percentage, a deadline you met.
Keep a master document with everything you have done, then cut a version for each application. Anything on the page should be something you can talk about for five minutes in an interview. If you want to build that habit with better tools, our AI courses cover document work with AI in plain language.
European hiring tools worth knowing
| Tool | Based in | Where it sits in the process |
|---|---|---|
| Personio | Munich, Germany | HR suite and ATS, common with SMEs in DACH |
| Teamtailor | Stockholm, Sweden | ATS used by startups and scale-ups |
| Recruitee | Amsterdam, Netherlands | ATS for mid-market companies |
| Codility | London, United Kingdom (offices in Poland and Germany) | Technical screening tests |
| TestGorilla | Amsterdam, Netherlands | Skills and aptitude assessments |
| HireVue | United States, sold across the EU | Video interviewing and assessments |
European vendors are subject to the same rules as everyone else selling into the EU, and the vendor's own compliance documentation is what an employer relies on. That matters for you mainly in one way: if a company uses a tool from outside the EU, your data still travels under GDPR transfer rules, and the privacy notice has to say so.
Checklist before you press send
- One column, standard section headings, contact details in the body.
- File format as requested; a text PDF if the ad says nothing.
- Dates in MM/YYYY, with a one-line note on any gap over a year.
- Every claim carries a number, a scope or a name.
- Skills from the ad appear both in a Skills list and inside your bullet points.
- No hidden text, no white fonts, no keyword blocks.
- Read the privacy notice: who processes your data, where it is stored, how long it is kept.
- If you want to know whether a machine decided, ask in writing and cite Articles 15 and 22 of the GDPR.
Questions readers ask
Can a company reject me without a human ever reading my CV?
GDPR Article 22 protects you against decisions based solely on automated processing that significantly affect you, and the AI Act requires human oversight for high-risk recruitment systems. In practice, most employers keep a person in the loop, sometimes only to confirm a ranking. If you want to know what happened in your case, ask the employer in writing and refer to Articles 15 and 22.
Should I tell a recruiter that I used AI to help write my CV?
There is no general EU rule that forces you to declare it. Employers may ask directly, and if they do, do not lie about it. The practical test is whether you can defend every line of the document in an interview.
Is my application data safe if the ATS vendor is outside the EU?
Transfers outside the EU are allowed only with a legal basis under GDPR Chapter V, usually an adequacy decision or standard contractual clauses. The company's privacy notice should state where your data goes and how long it is kept. If it does not, ask. You can also complain to your national data protection authority.
