EDPB Targets Automated Hiring Decisions in 2027: How Employers and HR Tech Vendors Should Prepare

Europe’s data protection authorities have picked their next joint target: automated decision-making in recruitment, including AI-driven screening tools. At its plenary on November 10, 2026, the European Data Protection Board chose the topic for its sixth Coordinated Enforcement Framework action, to run during 2027. Participating authorities will look at how organisations respect the right not to be subject to decisions based solely on automated processing, and the related right of access, when they use automated candidate screening. At the same meeting the Board adopted a statement on the first review of the EU adequacy decision for the Republic of Korea.

What the EDPB announced

According to the EDPB’s November 11 announcement, the coordinated action will concern “automated decision-making (ADM), including AI-driven ADM, in recruitment.” It will focus on “the enforcement of the right not to be subject to decisions based solely on automated processing and the related right of access, in the context of the use of automated candidate screening tools.” Authorities will sign up in the coming weeks, and the action itself starts during 2027.

The Coordinated Enforcement Framework is the Board’s way of getting national regulators to look at one issue at the same time with a shared method. Previous actions covered public-sector cloud use, the role of data protection officers, the right of access, the right to erasure and, in 2026, transparency obligations. In practice, authorities send questionnaires to selected controllers, sometimes open formal investigations, and feed results into a joint report. Earlier rounds produced national follow-up and, in some countries, enforcement. Each authority decides how to run its national part. Denmark’s Datatilsynet, for example, has already said it will take part.

Automated decisions are a worry for many privacy teams. A survey we covered found that AI and automated decisions rank among the top GDPR concerns for compliance professionals. Recruitment is a sensible place to test the rules, because high application volumes push employers toward automation and a rejection affects a person’s livelihood.

Article 22 and recruitment: the legal frame

Article 22(1) of the GDPR gives individuals the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significantly affects them. Recital 71 names “e-recruiting practices without any human intervention” as an example. Three points determine whether a screening tool falls inside the rule.

• “Solely” automated. A human in the loop only takes a decision outside Article 22 if their review is meaningful. Earlier regulator guidance on automated decisions says a reviewer who routinely applies the system’s output without real authority or analysis does not count.
• What counts as a decision. In its 2023 SCHUFA ruling (C-634/21), the Court of Justice held that an automated score can itself be a decision where a third party relies on it heavily. A ranking or “fit score” that effectively decides who gets an interview may be treated the same way.
• Significant effect. Being filtered out of a job process will often meet this threshold, particularly when candidates never reach a human.

Where Article 22 applies, solely automated decisions are allowed only if necessary for entering into or performing a contract, authorised by EU or member state law with safeguards, or based on explicit consent. In hiring, consent is a weak basis because of the power imbalance between employer and applicant. Contract necessity is the more common argument, particularly where an employer receives very large volumes of applications, but the employer must be able to show automation is genuinely necessary. In the first two cases, Article 22(3) requires at least the right to obtain human intervention, to express a point of view and to contest the decision. Article 22(4) adds tighter limits when special category data such as health or ethnicity is involved.

The access right: explaining the logic

The second focus is the right of access. Under Article 15(1)(h), a candidate who makes an access request is entitled to know whether automated decision-making was used and to receive “meaningful information about the logic involved,” along with its significance and envisaged consequences. In Dun & Bradstreet Austria (C-203/22, February 2025), the Court of Justice said this means explaining the procedure and principles actually applied in a way the person can understand. Sending a complex formula or a generic description is not enough. Where trade secrets are at stake, the information may have to go to the authority or court so it can balance the interests involved. A blanket refusal is not allowed.

For employers this is where tooling and governance meet. Many organisations cannot currently answer three basic questions for a given rejected applicant: which tool processed the application, which criteria it applied, and whether a person looked at the outcome. Coordinated reviews tend to expose exactly these gaps.

How the AI Act raises the stakes

The GDPR review will run alongside the EU AI Act. Annex III lists AI systems intended for recruitment or selection, including placing targeted job ads, analysing and filtering applications and evaluating candidates, as high-risk. Under the Digital Omnibus on AI, the Council confirmed that high-risk obligations for stand-alone systems now apply from December 2, 2027, so the CEF action will take place as those duties approach.

Deployers of high-risk systems, which includes employers, will have to use systems according to instructions, assign trained people to human oversight, keep logs, inform workers’ representatives and affected workers before workplace use, and tell people when a high-risk system is used in decisions about them. Article 86 adds a right to an explanation of certain individual decisions. Emotion recognition in the workplace has been banned since February 2025. Regulators will expect a GDPR DPIA and AI Act documentation that tell the same story.

Security is part of the picture too. The McDonald’s AI hiring bot exposure showed how candidate data in a chatbot-driven funnel can leak when basic controls fail.

Seven steps for employers and HR tech vendors

1. Inventory every automated touchpoint. List knockout questions, CV parsers, ranking engines, video or game assessments and chatbots, and record who supplies and configures each.
2. Classify each one against Article 22. For every step, document whether a human can and does change outcomes, how often, and with what information. Where rejection is solely automated, record the exception you rely on and the safeguards offered.
3. Test your human review. Sample decisions and check override rates. If reviewers almost never disagree with the tool, assume a regulator will question whether the review is real.
4. Prepare an explanation template. Draft a plain-language description of each tool’s main criteria and their weight, and a process for responding to Article 15(1)(h) requests within one month.
5. Update the DPIA. Automated screening at scale is a classic high-risk processing case. A structured approach such as the CNIL DPIA template helps cover bias testing, data minimisation and retention of applicant data.
6. Fix vendor contracts. Employers need vendors to provide logic documentation, audit support, bias metrics and AI Act instructions for use. Vendors should expect these requests in RFPs before 2027.
7. Revise candidate notices. Privacy notices for applicants should say when automation is used, what it does and how to request human review or contest an outcome.

Organisations hiring in the US face a parallel trend, with states such as Colorado issuing draft rules on automated decision-making, so a single documentation set can often serve both regimes.

The Korea adequacy statement

The Board’s other decision concerns data flows. The Commission adopted its adequacy decision for the Republic of Korea on December 17, 2021, and published its first review report on July 23, 2026, concluding that protection remains adequate. In Statement 2/2026 the EDPB welcomed amendments to Korea’s Personal Information Protection Act. They include a general right to withdraw consent, a right to request suspension of processing, a right to refuse automated decisions or request an explanation where rights are significantly affected, clearer onward transfer tools and stronger enforcement powers for the regulator, the PIPC. The Board agreed with the Commission’s proposal to review the decision every four years. For companies relying on adequacy to send data to Korea, nothing changes. Korea’s evolving approach to data use is worth watching, and its new automated-decision right mirrors the theme of the 2027 action.

The plenary also adopted final recommendations on processor binding corporate rules. Existing holders must align them during the application process or as part of their 2028 annual update.

Frequently asked questions

Is the 2027 action an investigation of my company?

Not automatically. Each participating authority chooses which organisations to contact, often by questionnaire, and may open formal investigations where it finds problems.

Does a recruiter clicking “approve” take a tool outside Article 22?

Only if the review is real. The reviewer needs authority to change the outcome, relevant information and enough time to use them.

Do vendors face scrutiny or only employers?

Employers are usually the controllers and answer to regulators. Vendors will feel it through contract demands, and under the AI Act providers of high-risk systems carry their own obligations.

Must we disclose the algorithm itself?

No. Candidates are entitled to a meaningful, understandable explanation of the logic and criteria applied, not source code, though trade secrets cannot justify refusing to explain.

Show the human, show the logic

The 2027 action asks two practical questions: is a person really involved when a tool rejects a candidate, and can you explain what the tool did? Employers who can answer both with records rather than assurances will be in a good position, both for the regulators’ questionnaires and for the AI Act deadline that follows.