The short answer
AI screening is not automatically prohibited or permitted. GDPR applies to personal data; Article 22 can restrict fully automated decisions with legal or similarly significant effects. Automatic exclusion before the final interview can also matter. The AI Act adds obligations depending on the use, role and risk class. A human final hiring decision alone does not make earlier automatic rejections permissible.
Bring your vacancy. In 30 minutes, we discuss which questions reveal experience, motivation and availability, and how you take the personal follow-up forward.
Assess the selection step, not just the AI label
Summarising, asking questions and excluding a candidate are different activities. Map who receives which information and what each outcome does. A score that determines who proceeds in practice may be more than administrative support.
The Dutch Data Protection Authority explains that fully automated assessments with significant effects may fall under GDPR Article 22. Meaningful human intervention requires sufficient knowledge and authority to investigate and change the outcome in practice. A formal approval button is not enough.
When do AI Act rules apply?
The European Commission’s current timeline states: prohibited AI practices and AI literacy have applied since 2 February 2025; general application began on 2 August 2026. For certain high-risk Annex III uses, including employment, it states 2 December 2027. The later date does not suspend existing GDPR obligations.
AI for recruitment and selection, including analysing or filtering applications and evaluating candidates, may fall within the high-risk category. Determine classification using intended use and applicable exceptions; a product name or human final decision does not settle it. Also document provider and deployer responsibilities. Sources checked: 30 October 2026.
A practical checklist before use
- Describe the purpose, job-related criteria and decision-makers.
- Document the legal basis, candidate information and processing chain.
- Assess whether a DPIA is required and who conducts it.
- Check access, retention, security and supplier agreements.
- Test automatic exclusion, unclear answers and potentially unequal outcomes.
- Arrange access, correction, applicable objection rights and a reachable human contact.
- Document AI Act classification and the resulting responsibilities.
Use a test candidate with an unclear answer, such as a differently written certificate name. Record who can recognise, correct and reassess it. This tests the actual journey rather than only a perfect demonstration.
What should you specifically discuss with Red Rocket?
Red Rocket’s existing explanation describes AI qualification that may prevent an invitation without human intervention. That step must be assessed separately; the later personal conversation and final hiring decision do not replace that assessment. Read the privacy and AI explanation and ask about corrections, criteria and data processing.
EU storage and shielding direct identifiers are parts of the configuration, not a general legal certification. This explanation is not individual legal advice or a declaration that a specific use meets all requirements. Discuss the actual use with the responsible privacy or legal specialist and the supplier.
Primary sources for HR and recruiters
Frequently asked questions
Does a human final hiring decision automatically permit AI screening?
No. An earlier fully automated exclusion may also have relevant effects. Assess the actual selection steps and legal conditions.
Does EU storage mean everything complies with GDPR?
No. The use must also be assessed for legal basis, purpose, data minimisation, transparency, security and decision-making.
Can we simply wait until 2027?
No. Existing GDPR rules and already applicable AI Act obligations remain in force. The high-risk timeline is not a general exemption.
