EDPB selects AI-driven automated decision-making in recruitment as 2027 coordinated enforcement action

At its plenary of 10-11 November 2026, the European Data Protection Board (EDPB) selected 'automated decision-making (ADM), including AI-driven ADM, in recruitment' as the topic of its sixth Coordinated Enforcement Framework (CEF) action, to run during 2027. Participating national DPAs (joining voluntarily in coming weeks) will review compliance with GDPR Article 22 (the right not to be subject to solely automated decisions) and the related Art 15(1)(h) right of access, specifically around automated candidate-screening tools, including AI-driven ones. The EDPB also adopted Statement 2/2026 on the first review of the Republic of Korea adequacy decision and finalised its processor BCR recommendations.

This is a concrete, Europe-wide enforcement priority targeting AI/algorithmic hiring tooling. It signals that EU DPAs will jointly scrutinise whether a human reviewer genuinely influences candidate-screening outcomes and whether rejected candidates can obtain a meaningful explanation of the decision logic (Art 15(1)(h)). It directly raises enforcement risk for employers and HR-software vendors using AI screening, and runs alongside the EU AI Act's classification of recruitment AI as high-risk (Annex III).

For AI/automated candidate-screening pipelines, ensure a human sits in the loop with genuine authority, discretion and competence to change the outcome; document the lawful basis and Art 22 safeguards; and be ready to provide 'meaningful information about the logic' and its consequences to a rejected candidate on request. Prepare documentation now for the 2027 coordinated review.