AI in recruitment: What is allowed when AI reads CVs and applications?
Short answer
You may use AI to read and sort applications, but it is high-risk under Annex III of the AI Act, and from 2 December 2027 the requirements for human oversight, logs and informing applicants apply. GDPR already requires that an applicant is not rejected by a machine alone. Remove name, age, gender and anything else that isn't relevant before the AI reads the CV, let a person decide on every candidate with reasons, and tell applicants that you use AI.
What it looks like
The AI reads the applications without names and ages:
| Customer | Location | Topic | |
|---|---|---|---|
| Sarah Murphy | sarah.murphy@example.com | Cork | Refund |
| Daniel Kelly | daniel.kelly@example.com | Galway | Delivery |
| Claire Walsh | claire.walsh@example.com | Limerick | Complaint |
| Thomas Camilleri | thomas.camilleri@example.com | Sliema | Delivery |
| Emma Byrne | emma.byrne@example.com | Dublin | Refund |
Enquiry Hi, my name is Sarah Murphy and I returned order 7012345678 two weeks ago, but I still haven't received my money. Please transfer it to IE29 AIBK 9311 5212 3456 78. Kind regards, Sarah
| Customer | Location | Topic | |
|---|---|---|---|
| [PERSON_1] | [EMAIL_1] | [STED] | Refund |
| [PERSON_2] | [EMAIL_2] | [STED] | Delivery |
| [PERSON_3] | [EMAIL_3] | [STED] | Complaint |
| [PERSON_4] | [EMAIL_4] | [STED] | Delivery |
| [PERSON_5] | [EMAIL_5] | [STED] | Refund |
Enquiry Hi, my name is [PERSON_1] and I returned order [ID_1] two weeks ago, but I still haven't received my money. Please transfer it to [IBAN_1]. Kind regards, [PERSON_1]
Sarah Murphy and Emma Byrne are waiting for a refund and should get a reply today. Thomas Camilleri has waited 10 days for a parcel. Suggested reply to Sarah Murphy: "Dear Sarah Murphy, thank you for your patience. Your money is on its way and will be in your account within 5 working days."
[PERSON_1] and [PERSON_5] are waiting for a refund and should get a reply today. [PERSON_4] has waited 10 days for a parcel. Suggested reply to [PERSON_1]: "Dear [PERSON_1], thank you for your patience. Your money is on its way and will be in your account within 5 working days."
| Candidate | Born | ID number | Employer | Experience |
|---|---|---|---|---|
| Louise Brennan | 1985-03-12 | 1234567TA | Shannon Timber Ltd | 12 |
| Michael Doyle | 1992-11-02 | 2345678KB | Liffey Logistics Ltd | 4 |
| Maria Borg | 1988-06-21 | 0123488M | Grand Harbour Metals Ltd | 9 |
| David Fenech | 1979-01-30 | 0456779M | Valletta Pharma Ltd | 18 |
CV Louise Brennan has 12 years' experience in budgeting and monthly reporting at Shannon Timber Ltd. She implemented a new ERP system and leads a team of three. Contact: louise.brennan@example.com.
| Candidate | Born | ID number | Employer | Experience |
|---|---|---|---|---|
| [PERSON_1] | 40–49 years | [ID_1] | [VIRKSOMHED_1] | 12 |
| [PERSON_2] | 30–39 years | [ID_2] | [VIRKSOMHED_2] | 4 |
| [PERSON_3] | 30–39 years | [ID_3] | [VIRKSOMHED_3] | 9 |
| [PERSON_4] | 40–49 years | [ID_4] | [VIRKSOMHED_4] | 18 |
CV [PERSON_1] has 12 years' experience in budgeting and monthly reporting at [VIRKSOMHED_1]. The person implemented a new ERP system and leads a team of three. Contact: [EMAIL_1].
Louise Brennan and Maria Borg have more than 5 years' experience and should be invited to interview; ask Maria Borg about experience with ERP systems. Michael Doyle has 4 years' experience; the requirement is 5. A person makes the decision.
[PERSON_1] and [PERSON_3] have more than 5 years' experience and should be invited to interview; ask [PERSON_3] about experience with ERP systems. [PERSON_2] has 4 years' experience; the requirement is 5. A person makes the decision.
| Supplier | Contact | Account | Expires |
|---|---|---|---|
| Atlantic Components Ltd | Peter Walsh | IE64 IRCE 9205 0112 3456 78 | 2027-01-31 |
| Malta Data Hosting Ltd | Anna Grech | MT84 MALT 0110 0001 2345 MTLC AST0 01S | 2026-12-31 |
| Midlands Precision Ltd | Simon Nolan | IE12 BOFI 9000 0112 3456 78 | 2028-06-30 |
| Celtic Packaging Ltd | Nicole Ryan | IE02 AIBK 9310 6512 9876 54 | 2027-03-31 |
Terms Atlantic Components supplies specialist components for Project Skellig. The price is adjusted annually by the consumer price index plus 3%. Liability is capped at 10% of the annual contract value. Contact Peter Walsh about any changes.
| Supplier | Contact | Account | Expires |
|---|---|---|---|
| [VIRKSOMHED_1] | [PERSON_1] | [IBAN_1] | 2027-01-31 |
| [VIRKSOMHED_2] | [PERSON_2] | [IBAN_2] | 2026-12-31 |
| [VIRKSOMHED_3] | [PERSON_3] | [IBAN_3] | 2028-06-30 |
| [VIRKSOMHED_4] | [PERSON_4] | [IBAN_4] | 2027-03-31 |
Terms [VIRKSOMHED_1] supplies specialist components for [PROJEKT_1]. The price is adjusted annually by the consumer price index plus 3%. Liability is capped at 10% of the annual contract value. Contact [PERSON_1] about any changes.
Atlantic Components Ltd renews automatically unless it is terminated by 31 October. It is important for an internal project, so renegotiate the price rather than terminate. Celtic Packaging Ltd also renews automatically; the deadline is 31 December.
[VIRKSOMHED_1] renews automatically unless it is terminated by 31 October. It is important for an internal project, so renegotiate the price rather than terminate. [VIRKSOMHED_4] also renews automatically; the deadline is 31 December.
Fictional data. Applicants' names, dates of birth and ID numbers stay in the EU.
A person decides on every candidate:
Case facts
Louise Brennan
- Current title
- Senior controller
- Experience
- 12 years
- CV
- Louise Brennan has 12 years' experience in budgeting and monthly reporting at Shannon Timber Ltd. She implemented a new ERP system and leads a team of three. Contact: louise.brennan@example.com.
The AI’s recommendation
Invite to interview
Reasoning: 12 years' experience in budgeting and reporting, has implemented an ERP system and comes from a manufacturing company.
The AI is unsure about:
Audit log
- Decisions are saved here with the time and a timestamp.
Fictional data. Decide the cases and see the log.
Solutions for your situation
See how GoalCube is used for applicants, apprentices and interns and candidates from staffing agencies.
What to do
- Register the use as high-risk.And have a responsible person confirm it before the AI gets any data.
- Tell the applicants.In the job advert or the acknowledgement email.
- Remove what isn't relevant.Name, date of birth, address, photo, gender.
- Let the AI recommend – with reasons.And flag where it is unsure.
- Let a person decide on every candidate.Approve, choose a different decision or ask for more information.
- Keep the log.Who decided what, when and why.
What the law says
- Annex III, point 4(a), AI Act
- AI for recruitment and selection is high-risk.
- Article 5(1)(f) AI Act
- Emotion recognition in job interviews is prohibited.
- Article 22 GDPR
- The right not to be rejected by a decision based solely on automated processing.
Questions and answers
Can we use ChatGPT to sort CVs?
Yes, with a business plan, but it is high-risk. Remove personal details, register the use, and let a person decide.
Can the AI analyse video interviews?
Not for emotions – that is prohibited. Transcription and summaries may be allowed, but it is still recruitment.
Do we need a DPIA?
Usually yes, when AI systematically assesses applicants.
Sources
Written by The GoalCube editorial team. Last updated 11 October 2026. GoalCube helps you follow the EU AI Act and GDPR. It is not legal advice.
Be among the first.
We expect to launch in November 2026. Join the waitlist and we’ll let you know when you can get started.