Which hiring AI uses are off-limits?

Emotion or biometric scoring used to hire, fully automatic rejection without human review, and processing sensitive data without a solid legal basis.

Which framework comes first: GDPR or the AI Act?

They stack. GDPR protects personal data; the AI Act governs the system (risk, transparency, oversight). Compliance with one does not automatically mean compliance with the other.

Can the DPO block the project?

A rigorous DPO does not ban AI: they require framing. Present purpose, legal basis, processor contract, and the human-oversight procedure. A DPIA is often the right format.

Do we need the candidate's explicit consent?

Not always. The legal basis is often pre-contractual steps or legitimate interest. Consent is still required for optional processing with no direct link to the application.

Can a candidate refuse an AI interview?

You can offer a reasonable alternative (equivalent human interview) so you do not exclude candidates discriminatorily. It is also a maturity signal for your process.

Compliance

Is AI in recruitment legal in Europe?

Published on July 1, 2026

Yes, AI in recruitment is legal in Europe — provided you comply with GDPR, the AI Act, and national labour law. It is not a grey zone: it is a demanding but clear framework that many European employers already apply successfully.

This article answers the most common HR leader objection: "Are we allowed to do this?" Spoiler: yes, if you do it right.

Symbol of legality and compliance for AI in European recruitment. — Legality depends not on AI itself, but on how you deploy it.

Short answer

AI in hiring is permitted in Europe. It is governed by GDPR (personal data), the AI Act (high-risk systems), and labour law (non-discrimination, transparency). Prohibited uses include abusive profiling, fully automated decisions without human recourse, and certain invasive biometric or emotion claims.

The European legal framework in three pillars

1. GDPR (since 2018)

All candidate data is personal data. Inform, justify legal basis, limit retention, guarantee rights.

2. AI Act (since 2024 — AI Literacy 2025, Annex III 2027)

Algorithmic hiring systems are high-risk (Annex III). Specific Annex III obligations for recruitment have been postponed to 2 December 2027. By contrast, AI Literacy has applied since February 2025. See our AI Act for recruiters article.

3. Labour law and non-discrimination

Algorithms that reproduce historical bias can engage employer liability — even without discriminatory intent.

Diagram of three legal pillars governing AI in European recruitment. — GDPR + AI Act + labour law: complementary frameworks, one rigour requirement.

What is permitted

AI voice or async interviews with prior candidate information;
Scoring on explicit job criteria defined by recruiters;
Automatic answer summaries to speed human review;
AI-assisted pre-screening with final human validation;
Soft skills analysis from behavioural answers (not opaque emotion engines);
Controlled retention of recordings with limited duration and security.

What is prohibited or strongly discouraged

Automatic rejection without human contestation;
Emotion or biometric scoring without solid justification;
Generalised profiling beyond role assessment;
Data collection without legal basis or candidate information;
Using sensitive data to filter candidates;
Subliminal manipulation (banned by the AI Act).

Five conditions to stay lawful

Inform candidates before the AI interview.
Document evaluation criteria and scoring logic.
Supervise: a human validates every pass/reject decision.
Secure data (encryption, EU hosting, Article 28 contract).
Audit outcomes regularly for discriminatory effects.

Go further

For operational GDPR guidance, see AI-assisted recruitment: how to stay GDPR compliant and our GDPR and AI in recruitment overview. HiLucy is built for this legal framework — explore the platform.

Frequently asked questions

Is AI in recruitment legal in Europe?: Yes, if it complies with GDPR, the AI Act, and labour law: no solely automated decisions, no emotion analysis used to decide, candidate transparency, and documented criteria.
Which hiring AI uses are off-limits?: Emotion or biometric scoring used to hire, fully automatic rejection without human review, and processing sensitive data without a solid legal basis.
Which framework comes first: GDPR or the AI Act?: They stack. GDPR protects personal data; the AI Act governs the system (risk, transparency, oversight). Compliance with one does not automatically mean compliance with the other.
Can the DPO block the project?: A rigorous DPO does not ban AI: they require framing. Present purpose, legal basis, processor contract, and the human-oversight procedure. A DPIA is often the right format.
Do we need the candidate's explicit consent?: Not always. The legal basis is often pre-contractual steps or legitimate interest. Consent is still required for optional processing with no direct link to the application.
Can a candidate refuse an AI interview?: You can offer a reasonable alternative (equivalent human interview) so you do not exclude candidates discriminatorily. It is also a maturity signal for your process.

Want to move from reading to action? See how Hi Lucy automates your voice AI interviews and your approach to interviews powered by artificial intelligence.