Have a person review automated job rejections. EU regulators check this in 2027.

Someone applies for a job at 23:40 and has a rejection email at 23:44. Nobody at the company read the application. A knock-out question ("Do you hold a driving licence?") or a score below the cut-off in the company's hiring software sent it to the rejected pile, and the software sent the email. On 11 November 2026 the European Data Protection Board (EDPB), the body where Europe's national data protection authorities work together, announced this kind of screening as the subject of its Europe-wide check for 2027 1. Authorities will look at two GDPR rights: a candidate's right not to be rejected by software alone, and their right to be told how the software reached its result. Software may reject a candidate on its own only in narrow cases, such as a volume of applications no team could read 2 3. A company that gets 200 applications for a role will struggle to claim it.

The check has no start date or named targets yet; authorities sign up first and the action launches in the course of 2027 1. In the 2026 round, some authorities ran theirs as formal investigations (my post on the 2026 check), and a company that breaks GDPR can be ordered to change how it processes data, or fined 2. The questions will mostly go to employers, who decide who gets hired. The companies that build hiring software hold most of the answers: which applications their product rejected, and on what basis.

Which screening counts as software rejecting someone by itself?

Any screening where nobody with the power to change the outcome looks at the candidate before the rejection. GDPR's own example of a decision covered by its ban on decisions "based solely on automated processing" (Article 22) is "e-recruiting practices without any human intervention" 2. The rule applies to decisions with legal or similarly significant effects, and the guidelines Europe's regulators apply to automated decisions 4 put decisions that "deny someone an employment opportunity" in that group 3.

Screening tools reject candidates in three common ways:

• Knock-out questions. An answer rejects the application automatically. This is a decision based solely on automated processing.
• A score with a cut-off. Applications below the line are rejected, or moved to a pile a recruiter rejects in bulk without opening. The guidelines say that a person who "routinely applies automatically generated profiles to individuals without any actual influence on the result" does not count as human involvement 3.
• A ranking. A recruiter reads the top 30 of 600 applications and the other 570 receive a rejection. Nobody looked at the other 570, so my reading is that the ranking decided their rejection. The Court of Justice of the EU reasoned the same way about credit scores in 2023: a score counts as the decision when the company using it lets it decide 5.

What counts as real review is defined in the same guidelines. The reviewer has "the authority and competence to change the decision" and considers "all the relevant data" 3. In a recruiting tool, that means a person who sees the application, can move it out of the rejected pile, and leaves a record that they did. I covered how regulators read "solely automated" in more depth in my post on the Uber fine.

Is automatic rejection ever allowed, and on what conditions?

Yes, under one of three exceptions in Article 22(2): the decision is necessary to enter into a contract with the person, it is authorised by EU or national law with safeguards, or the person gave explicit consent 2.

For hiring, the guidelines give their own example of the first exception. A popular employer receives tens of thousands of applications for one position, and may find it "not practically possible" to identify fitting candidates without first sifting by software 3. The test is necessity: if a less intrusive way of reaching the same goal exists, the exception does not apply. A team that receives 200 applications for a role will have difficulty arguing that it could not read them.

Where the employer relies on necessity or consent, it must still give the candidate three things: a way to get a person to look at the decision, a way to give their own point of view, and a way to contest it 2. In practice, the rejection email needs a route to a human.

The exceptions also stop at sensitive data. An automated rejection may not be based on health, ethnic origin or other special categories of data unless the candidate gave explicit consent or a law of substantial public interest allows it, with safeguards (Article 22(4)) 2. A knock-out question about a disability or a health condition falls here.

What must a rejected candidate be told?

The candidate is owed an explanation twice: once when they apply, and again if they ask.

When they apply, the privacy notice must say that automated decision-making takes place, give meaningful information about the logic involved, and say what it means for the candidate (Article 13(2)(f)) 2. A line saying "we may use automated tools to assess applications" gives none of the three.

When they ask, the employer owes the same information about their own case under Article 15(1)(h), normally within one month 2. The Court of Justice set the bar for this in a 2025 credit-scoring case, Dun & Bradstreet Austria. The company that made the decision must describe "the procedure and principles actually applied" so the person can understand which of their data was used and how. One way to do that is to tell them how much their result would have changed if their data had been different. Handing over the algorithm is not enough, and a company that thinks the explanation reveals a trade secret must give it to the regulator or court, which decides how much the person sees 6.

For a candidate rejected by a scored screen, an answer that meets that bar could read:

Your application scored 54 out of 100, and applications below 60 were rejected. The score compared your CV with the job's requirements. Years in a comparable role gave 20 of 40 points: you listed 2, the job asked for 4. Required skills gave 15 of 30: you listed 4 of the 8, and SQL, Tableau, Python and German were missing. Your answers to the screening questions gave 19 of 30. With 4 years in a comparable role, your score would have been 74.

"Our AI assesses each candidate's fit for the role" tells the candidate nothing they can check or contest, including whether the screen weighed something it should not have. That risk is measured: University of Washington researchers swapped only the names on over 550 real CVs and found three large language models favouring white-associated names 85% of the time and Black-associated names 9% of the time.

If the screen is a large language model asked to rate fit, there may be no weight table to read out. The employer still owes an account of the procedure actually applied, so the product has to keep what the system used for each candidate: the inputs, the instructions or scoring rubric the model was given, and its output. A reason the model writes about its own rating is not necessarily what drove it, so it is a weak substitute.

If you hire with screening software, or build it, what should you do before the check?

If you use software to screen job applicants in Europe, or build that software, here is what you can do now. An employer checks the list against its hiring tool's settings; a vendor checks it against its product.

1. List every place a candidate is rejected without a person. Knock-out questions, automatic rejection below a cut-off, rejection emails sent on a timer, and bulk rejection of applications nobody opened.
2. Unless you get applications in volumes no team could read, put a real reviewer in front of each of those rejections, or switch the automatic rejection off. The reviewer sees the application and can overturn the result, and the software records who reviewed what. That record is what an employer shows a regulator.
3. If you do rely on the volume exception, put a route to a person in every automatic rejection, with a way for the candidate to give their side and contest it.
4. Be able to explain each rejection on request. For a scored screen: which data it used, how it weighed them, and what would have changed the result. For a screen built on a large language model: the candidate's inputs, the version of the instructions or rubric the model was given, and its output. Employers should ask their vendor for this export now. Vendors acting for an employer must help it answer (Article 28(3)(e)) 2.
5. When you change a cut-off, a knock-out question or a model, reread the candidate privacy notice and check it still describes how screening works.

If you build hiring software and your product reuses candidate data across customers, for example in a shared talent pool, you may owe candidates these answers yourself: in the 2023 credit-score case, the Court held the company that produced the score to the rule 5. Keeping the notice in step with the product is also what we built Lawcel for: it is a compliance tool that reads your pull requests and flags which of your legal documents a change affects.

Italy and the EU AI Act add hiring rules of their own; I covered them in my post on Italy's AI decree and my post on the AI Act's high-risk list.