Key takeaways
- 85% of recruiting professionals already use AI tools, up from 55% in 2024. The question is no longer whether to automate, but which part of the process can be automated without taking on legal risk.
- AI in recruitment is a high-risk system under Annex III of the EU AI Act. That means transparency, traceability, effective human oversight and bias assessment: even though the compliance timeline has been deferred.
- The operating rule: AI should screen and rank, never auto-reject. Automatic rejection without human review is where nearly all the regulatory and reputational risk concentrates.
- The biggest return is not in CV screening but in coordination: scheduling interviews, updating the ATS, replying to candidates and keeping the pipeline alive. No discrimination risk there, and plenty of lost hours.
Applying AI to recruitment means using models and agents to screen applications, rank them by fit, coordinate interviews and keep the ATS current. In the EU it is a high-risk system under Annex III of the AI Act, which requires transparency, traceability and effective human oversight. The correct implementation uses AI to prioritise, not to reject.
What can actually be automated in a hiring process
A hiring process has five phases, and AI adds very different value to each:
- Sourcing. Finding profiles, writing job ads and outreach messages. Automatable at low risk, as long as targeting does not use protected criteria.
- CV screening. Structured extraction of CV data and ranking by fit against objective role requirements. Automatable only as prioritisation, never as rejection.
- Coordination and communication. Interview scheduling, reminders, candidate replies, ATS updates. Automatable at essentially zero risk and with the largest time saving in the whole process.
- Competency assessment. Technical tests, interview analysis, suitability scoring. Maximum-risk zone: this is where algorithmic discrimination and the hardest obligations appear.
- Final decision. Human. No exceptions, and not only for compliance: it is also where AI adds least.
What AI must NOT do: automatically reject applications, infer undeclared personal characteristics (age, origin, health status, pregnancy) or score personality from video or voice. Emotion recognition in the workplace is, moreover, among the AI Act's prohibited practices.
The analogy we use: AI is a good chief of staff, not a tribunal. It prepares, organises, summarises and frees up time. Decisions about a person are made by a person.
What the EU AI Act requires if you use AI in HR
AI systems intended for recruitment, promotion, task allocation and decisions about the employment relationship are classified as high risk in Annex III of the EU AI Act. This does not depend on how sophisticated the tool is: a CV filter with scoring falls inside the category.
The substantive obligations are these:
- Transparency towards the candidate. They must know an AI system is involved in the process.
- Effective human oversight. A person with enough authority and context to override the system's recommendation. A "reviewed" checkbox is not oversight.
- Data quality management and bias assessment. Documented and repeatable, not a statement of intent.
- Traceability and logging. Being able to reconstruct why the system ranked a candidate the way it did.
- Technical documentation and risk assessment for the deployed system.
The timing nuance worth being clear about: Omnibus Regulation (EU) 2026/1744 deferred Annex III high-risk obligations to 2 December 2027. That does not leave the field clear: the Article 50 transparency obligations (informing users they are interacting with an AI system and labelling synthetic content) apply from 2 August 2026 to all organisations. And GDPR, with its Article 22 on automated decisions, applied long before the AI Act existed.
In Spain, the supervisory body is AESIA (the Spanish AI Supervision Agency). Our recommendation is not to treat this as a last-minute compliance project: traceability is designed into the system, not bolted on afterwards.
Key market data
- 85% of recruiting professionals already use AI tools, up from 55% in 2024, and 76% of HR professionals believe AI has improved hire quality.
- 80% of Spanish companies are looking for tools that make hiring faster and more accurate, and Spanish firms mainly use AI for written language analysis (44.7%) and workflow automation (39%).
- In 2026, agentic systems manage full recruiting workflows: sourcing, filtering, personalised messaging, interview scheduling and real-time ATS updates (Tramitapp, 2026 AI in HR trends).
The honest reading of those numbers: adoption is far ahead of control. 85% usage with a much smaller share of audited systems is exactly the risk profile the regulation aims to correct.
Where the real return is (and where it isn't)
Here we disagree with the mainstream narrative. Almost the entire conversation about AI in HR centres on CV screening, which is simultaneously the part with the highest regulatory risk and the smallest time saving once the process is well defined.
The real return is in operational coordination:
| Task | Time saved | Regulatory risk | Recommendation |
|---|---|---|---|
| Scheduling and rescheduling interviews | High | None | Automate now |
| Answering candidate questions | High | Low | Automate with escalation |
| Updating the ATS after each interaction | High | None | Automate now |
| Drafting job ads and messages | Medium | Low | Assist, review before publishing |
| Structured CV data extraction | Medium | Low | Automate |
| Ranking applications by fit | Medium | High | Prioritise only, with review |
| Rejecting applications | : | Very high | Do not automate |
| Scoring personality from video or voice | : | Prohibited/very high | Do not do it |
Our view: a company that automates the first four rows of this table recovers more hours, at lower risk, than one that jumps straight into candidate scoring. And it arrives in a far better position whenever it does decide to tackle assisted screening.
Common use cases
Case 1: Interview coordination agent.
- Problem: the HR team spends a large share of the day matching calendars between candidates and hiring managers, with constant rescheduling.
- Solution: an agent that proposes slots based on real availability in both calendars, confirms, sends reminders and updates the ATS.
- Stack: agent + calendar API + ATS integration + email/WhatsApp channel.
- Result: coordination time per vacancy drops sharply and candidate response time improves.
Case 2: Structured application extraction.
- Problem: CVs in heterogeneous formats that somebody has to transcribe manually into the ATS.
- Solution: structured data extraction (experience, education, technologies, languages) with no scoring or ranking: normalisation only.
- Stack: document extraction model + schema validation + ATS upload.
- Result: the recruiter gets comparable profiles and spends time assessing rather than copying.
Case 3: Assisted prioritisation with traceability.
- Problem: 400 applications for one vacancy and a short deadline.
- Solution: ranking against objective, verifiable role criteria (years of experience with technology X, certification Y), with the reason for each position visible to the recruiter and no automatic rejection.
- Stack: explicit criteria + model + per-candidate decision log + review panel.
- Result: the recruiter reviews the full list but starts where it makes sense, and every position is explainable if challenged.
How to implement it step by step
- Start with coordination, not screening. Immediate savings, zero risk, and it lets you bed in the ATS integration before touching anything sensitive.
- Define objective, verifiable role criteria before automating any ranking. If a criterion cannot be justified in writing to a candidate, it should not enter the system.
- Design traceability from the start. Every recommendation must record which data it used and under what criteria. Adding it later means rebuilding the system.
- Forbid automatic rejection by design, not by internal policy. Make the system technically incapable of eliminating an application without human action.
- Run a bias assessment on historical data before deployment, and repeat it periodically. Compare stage pass-through rates across groups. If your history is biased, a model trained on it will reproduce that bias with industrial efficiency.
- Inform the candidate clearly and accessibly, not in the small print. It is a transparency obligation and, on top of that, good employer-brand practice.
- Document the system: purpose, data, criteria, human oversight, risk assessment. This is the documentation you will be asked for, and producing it under pressure costs far more.
Common mistakes (and how to avoid them)
Mistake: training the model on your hiring history "because it worked". → Reality: if your history reflects bias, the model learns it and applies it at scale. Amazon scrapping its internal tool for penalising women's CVs remains the canonical example and has not stopped being relevant.
Mistake: automating rejection to gain speed. → Reality: it is where practically all the project's legal and reputational risk concentrates, in exchange for a modest saving. It does not pay off.
Mistake: confusing review with oversight. → Reality: the AI Act requires effective human oversight: someone with context, authority and time to override the recommendation. A confirmation click over a list of 300 names is not that.
Mistake: using video analysis to infer personality traits. → Reality: the scientific evidence is weak and emotion recognition in the workplace is among the AI Act's prohibited practices. It is a dead end.
Mistake: thinking the Omnibus deferral removes the obligation. → Reality: it defers the high-risk timeline to December 2027, but Article 50 transparency applies from August 2026 and GDPR applied before that. Systems built now will still be running then.
Mistake: treating your SaaS vendor as if they carried your liability. → Reality: as the company deploying the system, you are responsible for its use. Require technical documentation, bias assessment and exportable traceability from the vendor, and verify it before signing.
Realistic timelines and effort
- Interview coordination agent integrated with the ATS: 3-6 weeks to production, depending on how open the ATS API is. Best result-to-effort ratio in this area.
- Structured application extraction: 3-5 weeks, including format normalisation and schema validation.
- Assisted prioritisation with traceability and bias assessment: 8-14 weeks, because most of the time goes into agreeing objective criteria with the business and into bias evaluation, not into the model.
- Where the hidden effort sits: in the ATS. The quality and openness of its API determines the timeline for everything else. Verify it before committing to dates.
Metrics to track from day 1: coordination time per vacancy, time to first candidate response, time to fill, stage pass-through rates broken down by group (bias control) and share of recommendations modified by the human reviewer. That last one is especially revealing: if nobody ever modifies a recommendation, there is no real oversight: there is a rubber stamp.
Frequently asked questions
Is it legal to use AI for recruitment in the EU?
Yes, but it is classified as a high-risk system under Annex III of the AI Act. It requires candidate transparency, effective human oversight, bias assessment, traceability and technical documentation. In Spain the supervisor is AESIA, and GDPR applies in parallel.
Can AI reject candidates automatically?
It is neither advisable nor prudent. GDPR Article 22 restricts decisions based solely on automated processing with significant effects on a person, and the AI Act requires effective human oversight. The defensible pattern is AI that prioritises and explains, with a person making the rejection decision.
What changed with the 2026 Omnibus Regulation?
It deferred Annex III high-risk obligations to 2 December 2027. It removed nothing: Article 50 transparency obligations apply from 2 August 2026, and GDPR obligations were already enforceable beforehand.
How do you avoid algorithmic bias in recruitment?
By using objective, verifiable role criteria instead of learning from historical decisions, evaluating stage pass-through rates across groups before and after deployment, and keeping traceability for every recommendation. A model trained on a biased history reproduces that bias at scale.
Can AI be used to analyse video interviews?
For transcription and summarisation, yes, with consent and transparency. To infer personality traits or emotional states, no: the scientific evidence is weak and emotion recognition in the workplace is among the AI Act's prohibited practices.
Where does AI deliver most return in a hiring process?
In operational coordination: scheduling interviews, replying to candidates, updating the ATS and keeping the pipeline alive. These consume the most hours, carry no discrimination risk and are usually automated last because attention goes to CV screening.
What should I require from an AI recruitment software vendor?
Technical system documentation, bias assessment with an explicit methodology, exportable traceability for every recommendation, information on what data is used and where it is processed, and guarantees that your candidates' data is not used to train third-party models.
Do candidates have to be told AI is used?
Yes. It is a transparency obligation under the AI Act, applicable from August 2026, and consistent with GDPR's duty to inform. It must be done clearly and accessibly, not buried in the privacy policy.
Want to automate recruitment without opening a regulatory front?
At Naxia we implement AI in hiring processes starting where the return is immediate and the risk is zero (coordination, candidate communication, ATS updates) and, where it makes sense, assisted prioritisation with explicit criteria, full traceability and documented bias assessment.
If you want to know which part of your process to automate and which to leave alone, talk to us. No commitment, no 40-slide decks.
Or explore our implementation process first.