Compliance guide

AI hiring assessments under GDPR and the EU AI Act: what actually holds up

Three rules decide whether an AI hiring assessment is lawful in the EU. This guide states them first and explains them after, so you can hand it to a Datenschutzbeauftragter without apology.

First, GDPR Article 22: candidates may not be subject to purely automated rejection. A human must hold real decision power, not rubber-stamp the machine; the CJEU's SCHUFA ruling (C-634/21) closed the rubber-stamp loophole. Second, the EU AI Act: recruitment AI is high-risk under Annex III, and deployer obligations, including human oversight and transparency, apply from 2 December 2027 following the Digital Omnibus deferral. Third, in Germany: works-council co-determination (BetrVG 87(1) no. 6 and 95(2a)) governs deployment, and rejected-candidate data follows a six-month retention window derived from the AGG 15(4) claim period.

A compliant assessment therefore needs: explicit informed consent, a human decision with a written reason on every candidate, evidence the candidate can request, EU data residency, and deletion timelines that hold.

Article 22 in practice: what human-in-the-loop must mean

After SCHUFA, oversight means the reviewer sees the evidence, can disagree, and leaves a reason. A confirm button clicked in bulk is not oversight, and regulators know the difference. In practice this shapes the product: scores must arrive with their evidence attached (quotes, clips, criteria), the reviewer interface must make disagreement as easy as agreement, and the written reason must be stored with the decision.

The EU AI Act timeline for hiring tools

Recruitment and selection systems are high-risk by classification, not by assessment of your particular use. From December 2027, deployers owe human oversight, instructions-for-use compliance, monitoring and record-keeping. Building the oversight workflow now is materially cheaper than retrofitting it under deadline, and it doubles as your Article 22 answer today.

Germany specifically

Works-council co-determination applies twice: BetrVG 87(1) no. 6 covers any technical system capable of monitoring behaviour or performance, which proctoring is, and 95(2a) covers AI used in selection guidelines. Deployment without agreement is a real legal risk, and retrofitting agreement is painful. Bring the Betriebsrat a documentation pack early: capture scope, decision authority, retention, appeal path. For retention itself, the six-month window aligned to AGG 15(4) is standard practice for rejected candidates, extended only by consent.

Proctoring without overreach

Consent-first capture, disclosed scope, and a hard rule: integrity observations never carry automated consequences. An observation (a paste event, a window change, a long silence) is evidence for a human, not a verdict. Tools that auto-flag and auto-reject fail both Article 22 and any serious works-council review.

Data residency

EU hosting removes the transfer problem for candidate data entirely: no adequacy analysis, no supplementary measures, no Schrems exposure. For German buyers this is usually worth more than any US certification.

Twelve questions to ask any assessment vendor

1. Can any candidate decision occur without a named human?
2. Where exactly is candidate video stored, and in which jurisdiction?
3. What is your deletion timeline for rejected candidates?
4. Can a candidate request the evidence behind their assessment?
5. What happens to a score when an integrity flag is raised?
6. Is consent obtained before any recording starts, and how is it evidenced?
7. Can the assessment run entirely in our language and under our brand?
8. What does the works-council documentation pack contain?
9. Which sub-processors touch candidate data?
10. Is the human reviewer's reason stored with the decision?
11. Can we export everything if we leave?
12. What is your breach-notification commitment?

How Savvanta implements this

Human confirmation with a written reason on every decision. No automated rejection exists in the product. Quoted evidence per score. Consent before any capture, an equipment check with a proven upload. Hosted in Germany. ISO 27001 compliant; SOC 2 on the roadmap, stated plainly. Retention defaults aligned to the six-month window.

Frequently asked questions