For employers in the US and Europe that use or consider AI to screen job applicants, this guide explains what discrimination law, the GDPR and the EU AI Act require, and how to use screening tools safely.
What you'll learn
- Whether AI resume screening is legal in the US and the EU
- Why the EU AI Act treats hiring AI as high-risk from December 2027, and its exceptions
- What employers must do under the AI Act and the GDPR
- What US federal law and New York City's AI hiring law require
- How biased measured screening tools were, and the safeguards before using one
Using AI to screen resumes is legal in the US and the EU, but the employer answers for what the tool does. US discrimination law applies to any hiring practice with a disparate impact, the GDPR limits rejections decided solely by a machine, and from December 2, 2027 the EU AI Act treats hiring AI as high-risk, with duties for the employers who use it. The risk is measured: in a 2024 study, AI models used to rank resumes favored White-associated names in 85.1% of tests. This guide covers what each law requires, which uses count as high-risk, and the safeguards to set up before a tool sees its first application.
AI tools now promise to read hundreds of applications in minutes and hand back a ranked shortlist. For a small HR team, that is an obvious attraction. It also moves the most legally sensitive step in hiring, deciding who gets considered, into software the employer did not build and cannot fully see.
This guide covers what US and EU law require of employers who use AI to screen applicants, which uses count as high-risk under the EU AI Act, what independent tests found about bias, and the safeguards to put in place first.
Is it legal to use AI to screen resumes?
Yes, but the employer answers for the result. In the US, Title VII makes a hiring practice unlawful if it "causes a disparate impact" on the basis of race, sex or another protected trait and the employer cannot show it is "job related" and "consistent with business necessity".[1] In the EU, the GDPR restricts decisions "based solely on automated processing", and from December 2, 2027 the AI Act treats AI that filters applications as high-risk.[10][5][9]
None of these laws bans the tools. They put the responsibility on the employer, whichever vendor built the software. A tool that ranks candidates is a hiring practice like any test or interview, and its outcomes are judged the same way.
The practical question is therefore not whether AI is allowed, but whether you can show that the tool treats applicants fairly, that a person decides, and that applicants are told. The rest of this guide covers each of those.
Why does the EU AI Act treat hiring AI as high-risk?
The EU AI Act lists recruitment AI as high-risk because it shapes access to work. Annex III names AI systems "intended to be used for the recruitment or selection of natural persons, in particular to place targeted job advertisements, to analyse and filter job applications, and to evaluate candidates".[5] After the Digital Omnibus, the obligations for these systems apply from December 2, 2027.[9]
The Act has an exception. A listed system is not high-risk where it does not pose a significant risk, for example when it performs "a narrow procedural task" or "a preparatory task" for a human assessment.[6] The exception has a hard limit: a listed system is "always" high-risk "where the AI system performs profiling of natural persons".[6]
The GDPR defines profiling as automated evaluation of personal aspects, including predicting a person's "performance at work".[10] Ranking or scoring applicants usually fits that definition, so most resume screening tools will count as high-risk. A tool that only extracts dates and job titles from CVs into a form, for a person to assess, has a better claim to the exception. The intended purpose, as the vendor describes it and as you use it, decides.
What must employers do under the AI Act?
Employers that use high-risk hiring AI become deployers with specific duties. Article 26 requires them to use the system according to its instructions, assign human oversight to people with "the necessary competence, training and authority", keep the logs for "at least six months", and inform the people the system makes or assists decisions about.[7] Applicants affected by such a decision can ask for "clear and meaningful explanations" of the AI's role.[8]
| Duty | What it means for hiring | Article |
|---|---|---|
| Follow the instructions for use | Use the tool only for the purpose and settings the vendor specifies | 26(1)[7] |
| Human oversight | A trained person with authority reviews and can override the tool | 26(2)[7] |
| Representative input data | Job criteria and data you feed in must fit the role and the applicant pool | 26(4)[7] |
| Monitor and keep logs | Watch for problems; keep the system's logs at least six months | 26(5), 26(6)[7] |
| Inform workers' representatives | Tell the works council or other representatives before use at the workplace | 26(7)[7] |
| Inform applicants | Tell applicants that a high-risk AI system is used in decisions about them | 26(11)[7] |
| Explain decisions | Give affected applicants an explanation of the AI's role on request | 86(1)[8] |
The duties assume that the people overseeing the tool understand it. Our guide to the AI literacy obligation covers what the AI Act expects from the staff who use AI. For the duty to inform employee representatives, see our guide on when employees must be consulted about AI, and for the AI Act's other deployer duties our EU AI Act guide for small businesses.
Can AI reject applicants on its own under the GDPR?
Not without strict conditions. Article 22 of the GDPR gives people the right "not to be subject to a decision based solely on automated processing" that "similarly significantly affects" them, and recital 71 names "e-recruiting practices without any human intervention" as an example.[10] Where an exception applies, such as consent or necessity for a contract, applicants keep at least the right "to obtain human intervention", to give their view and to contest the decision.[10]
The human review has to be real. A recruiter who clicks "reject" on every candidate the tool scored low has not made a decision; the tool has. Give reviewers time, the application itself, and the authority to move a candidate up.
What do US laws require?
US federal law judges AI screening by its outcomes, and some cities and states add rules for the tools themselves. Under Title VII, an applicant can challenge a screening practice that disproportionately excludes a protected group, and the employer must then show the practice is job-related and a business necessity.[1] Using a vendor's tool does not move that burden to the vendor.
New York City has the best-known tool-specific law. Since July 5, 2023, Local Law 144 has barred employers from using an automated employment decision tool unless it had a bias audit within the past year, a summary of the audit is public, and candidates or employees received notice.[2] Compliance has been thin: a 2024 study by researchers who checked 391 employers found 18 that had posted audit reports and 13 that had posted transparency notices.[3]
The study's authors caution that a missing audit does not prove a violation, because the law lets employers decide whether their tool is in scope.[3] Other states and cities have passed or proposed their own rules on AI in hiring. Check the law where your applicants live before a tool starts scoring them.
What does German law add for applicants?
Germany shows how far European applicant protection can go. Under the General Equal Treatment Act (AGG), applicants count as employees for anti-discrimination purposes, and an employer that discriminates owes damages and compensation.[12] For a candidate who would not have been hired even without discrimination, compensation is capped at three months' salary; for one who would have been, there is no cap in the law.[12]
The burden of proof is what makes AI risky there. Once an applicant proves indications that suggest discrimination on a protected ground, the employer must prove there was none.[12] An employer that cannot explain why its screening tool ranked a candidate low will struggle to carry that burden.
German works councils also have a say. Selection guidelines for hiring need the works council's agreement, and since the law was updated this applies explicitly when AI is used to draw them up.[13] A screening tool that applies fixed criteria to every applicant is, in effect, such a guideline.
How biased are AI resume screeners?
Measured screening models have shown strong bias. In a study presented at the 2024 AAAI/ACM Conference on AI, Ethics, and Society, University of Washington researchers ran more than 500 publicly available resumes against 500 job descriptions through AI models used for document ranking; the models favored White-associated names "in 85.1% of cases", and Black men were disadvantaged in up to 100% of comparisons.[4]
The study's authors published a correction in August 2026 after an independent team found a bug: the results for gender comparisons were inverted. The race and intersectional results were unaffected and were replicated by the Salzburg University team.[4] The study tested ranking models in a research setup, not any specific commercial product.
An AI that screens 500 CVs in a minute can also turn away the same group of people 500 times.
The lesson for employers is that bias in a screening model is systematic, not occasional. A biased human screener affects the applications on their desk; a biased model applies the same skew to every application it ranks. That is why the AI Act asks for representative input data and monitoring, and why the safeguards below include testing on your own data.[7]
Is AI for job ads or interview scheduling also high-risk?
Some of it is. Annex III names AI used "to place targeted job advertisements" as high-risk, so a tool that decides which people see your job ad falls in the category.[5] Using an AI chatbot to draft the text of a job ad does not, because it neither targets people nor evaluates them.
Interview scheduling and answering applicants' questions about the process are closer to "a narrow procedural task", which can fall outside the high-risk label.[6] The test is whether the tool influences who moves forward. A scheduling assistant that only books times is procedural; one that decides which candidates get a slot is not.
These uses still have other duties. A chatbot that talks to applicants has to make clear that they are dealing with an AI, under Article 50 of the AI Act, and any processing of applicants' data needs a GDPR basis.[11] Lower risk does not mean no rules.
How do you use AI in hiring safely?
Use AI to prepare decisions, not to make them, and check the tool on your own data before it touches real applicants. These steps address the duties in US discrimination law, the GDPR and the AI Act at once.[1][7][10]
Define the job criteria first
Ask the vendor for evidence
Test on your own data
Keep a person on every rejection
Tell applicants and representatives
Log and review
For step 3, a simple first check compares selection rates between groups. A rule of thumb often used in US employment discrimination cases flags a group whose selection rate falls below 80% of the highest group's rate; nearly all audits published under New York City's law reported ratios above that line.[3] Passing the rule of thumb is a starting point for a closer look, not proof of fairness.
When does a custom screening agent make sense?
A custom agent makes sense when you want AI to do the reading and sorting while your criteria, your records and your people stay in control. An agent can summarize each application against criteria you set, flag missing information and draft replies, while a person makes every decision. That keeps the tool closer to the AI Act's preparatory-task exception and meets the GDPR's human-intervention safeguard by design.[6][10]
The approval step is the core of such an agent. Our guide on approval workflows in an AI agent system shows how an agent prepares and a person decides, with nothing sent to an applicant before that. For the general choice between buying a screening product and building around your own process, see what a custom agent is and when to build one.
Frequently asked questions
Is it legal to use AI to screen resumes? Yes, in the US and the EU, but the employer is responsible for the result. In the US, a screening practice that disproportionately excludes people by race, sex or another protected trait can violate Title VII unless it is job-related and a business necessity. In the EU, the GDPR limits rejections decided solely by a machine, and from December 2, 2027 the AI Act treats AI used to filter applications as high-risk.
Is AI in hiring high-risk under the EU AI Act? Yes. Annex III of the AI Act lists AI used to place targeted job ads, analyze and filter applications, and evaluate candidates as high-risk. A system can escape that label if it only performs a narrow procedural or preparatory task, but never if it profiles people. Since the Digital Omnibus, the obligations for these systems apply from December 2, 2027.
Do employers have to tell applicants that AI is used? In New York City, employers must give candidates notice before using an automated employment decision tool, and publish a bias audit. In the EU, the AI Act requires deployers of high-risk AI that makes or assists decisions about people to inform them, and the GDPR requires information about automated decision-making and the logic involved. Telling applicants how AI is used is the safe default everywhere.
Can an AI reject a job applicant automatically? In the EU, a rejection based solely on automated processing is restricted by Article 22 of the GDPR, which names e-recruiting without human intervention as an example. Where such a decision is allowed, applicants have at least the right to human intervention and to contest it. In practice, a person should review every AI-suggested rejection before it is sent.
Notes
- 42 U.S. Code § 2000e-2, Unlawful employment practices, subsection (k), Legal Information Institute, accessed October 16, 2026.
- New York City Department of Consumer and Worker Protection, Automated Employment Decision Tools (AEDT), Local Law 144 of 2021, enforced from July 5, 2023, accessed October 16, 2026.
- Wright, Metcalf, Matias et al., Null Compliance: NYC Local Law 144 and the Challenges of Algorithm Accountability, arXiv:2406.01399, June 3, 2024, accessed October 16, 2026.
- Wilson and Caliskan, Gender, Race, and Intersectional Bias in Resume Screening via Language Model Retrieval, Proceedings of the 2024 AAAI/ACM Conference on AI, Ethics, and Society, arXiv version 3 of August 30, 2026 with erratum, accessed October 16, 2026.
- AI Act Service Desk, Annex III: High-risk AI systems, point 4(a), accessed October 16, 2026.
- AI Act Service Desk, Article 6: Classification rules for high-risk AI systems, paragraph 3, accessed October 16, 2026.
- AI Act Service Desk, Article 26: Obligations of deployers of high-risk AI systems, accessed October 16, 2026.
- AI Act Service Desk, Article 86: Right to explanation of individual decision-making, accessed October 16, 2026.
- AI Act Service Desk, Article 113: Entry into force and application, consolidated text as at July 27, 2026, accessed October 16, 2026.
- Regulation (EU) 2016/679 (GDPR), Articles 4(4), 13(2)(f) and 22, and recital 71, accessed October 16, 2026.
- AI Act Service Desk, Article 50: Transparency obligations, accessed October 16, 2026.
- German General Equal Treatment Act (AGG), sections 6, 7, 15 and 22, in German, accessed October 16, 2026.
- Works Constitution Act (BetrVG), section 95, in German, accessed October 16, 2026.
