AI screening of CVs, the Spanish data protection authority spells out what human review requires

On 7 October 2026 the Spanish data protection authority, the Agencia Española de Protección de Datos (AEPD), published a note on algorithmic systems in the workplace. It brings together two developments. The first is Royal Decree 723/2026, in force since 5 October, which obliges employers to inform employees in writing about algorithmic or automated decision-making systems. The second is a preventive warning, AI-00009-2026, issued to a company that planned to use an AI tool to analyse CVs, score candidates and rank them for recruitment and internal mobility.

The case matters beyond Spain because the requirements in the warning rest on GDPR articles that apply in Denmark and the rest of the Nordics in exactly the same way.

According to the AEPD press release of 23 September 2026, the tool had not yet been deployed, but the company had informed its workers' representatives. It stated that the final decision would always be taken by a person, that the tool would not analyse sensitive attributes, and that it would be audited periodically.

The regulator does not reject the tool. It writes that AI can improve the efficiency and consistency of initial candidate evaluation, and that the GDPR does not prohibit such systems. But it sets conditions. Data protection must be built in from the design stage under Article 25. The risks to candidates and employees must be assessed, and where a high risk is likely, a data protection impact assessment under Article 35 must be completed before processing starts. Candidates must receive clear and understandable information about the role the tool plays in their evaluation. And Article 22, which gives people the right not to be subject to purely automated decisions with significant effects, must be assessed on how the tool actually operates, not on how it is described.

A warning under Article 58(2)(a) is preventive. It does not establish an infringement, but the AEPD states that failure to act could lead to an investigation and corrective measures, including sanctions.

The most practical part of the note is its description of effective human review. The AEPD states that a formal human presence does not by itself take a process outside Article 22. The decision-maker must be able to assess the score critically and depart from it without being bound by it in practice.

Reviewers must understand the system's limits, have access to the relevant factors, have the time and the authority to change the outcome, and be able to take additional information into account. Disagreements with the automated recommendation should be recorded. And if there is systematically never any disagreement, the regulator says this may indicate that the organisation is simply following the score, which should trigger a review.

The same logic applies to audits. Mentioning periodic audits proves nothing. An audit should document its purpose and scope, the version of the system reviewed, the data and variables tested, error rates, differential impact across groups, the effectiveness of human oversight, incidents and complaints, and the corrective measures taken.

The company stated that the tool does not analyse sensitive characteristics. The AEPD says this is not sufficient on its own. An organisation has to check whether other variables allow such characteristics to be inferred or act as proxies. The note also recalls that scores, rankings, profiles and predictions about an identifiable person are themselves personal data, citing the Court of Justice rulings in SCHUFA (C-634/21) and Dun & Bradstreet Austria (C-203/22). In the latter, the court held that the explanation given to the individual must be concise and intelligible. Source code is not required, but generic or purely technical explanations are not enough.

The note also addresses group-wide tools. Central development and evaluation within a corporate group does not relieve the local entity that deploys the system. That entity must determine and document whether it is a controller, a joint controller or the user of a processor's service.

The Royal Decree is Spanish law and does not apply in Denmark. But the warning is based on GDPR articles that apply throughout the EU, and the AEPD itself writes that its requirements can be carried over to other workplace systems. The note closes with steps to take before a system goes live. These include an inventory of every system that supports or makes decisions about candidates, documentation of purpose, input data, main variables and decision rules, a separate determination of legal basis, risk level, the need for an impact assessment and classification under the AI Act, and testing whether the explanations given to candidates can actually be understood.

For anyone buying or running screening tools, that is a usable checklist. It is also a clear signal that "a human makes the final decision" is no longer an answer a regulator will accept, unless the organisation can show how that human actually works.

Kilde: https://www.aepd.es/guias/Nota-RD-723-2026-AI-00009-2026.pdf