AI screening and GDPR when candidates can only suspect they are being screened

Among job seekers who believed an AI had evaluated their application, four in ten suspected the employer had used the technology without telling them. The figure comes from a US survey published by the applicant tracking vendor iCIMS on 28 October 2026 via PR Newswire. The survey describes the American labour market, but the question it raises will be familiar to anyone hiring in Europe. Here, telling applicants about automated processing is not a matter of courtesy. It is an obligation under the GDPR, and it applies whether the screening happens inside an ATS, inside an assessment platform or in a tool bolted on afterwards.

Together with the analyst firm Kyle & Co., iCIMS asked 1,000 US job seekers how they had encountered AI during their 2026 job search, and 500 HR and talent leaders how far they had come with AI in hiring. The report is titled 2026 Talent Transformation Yearbook: AI Progress Report.

On the candidate side, 44 percent said they never encountered AI screening during this year's search. 17 percent met it once, and 32 percent met it several times or in most of their applications. Among those who believed AI had evaluated their application, 32 percent said the employer had clearly disclosed it, while 41 percent suspected AI had been used without disclosure. 42 percent were confident that the automated screening had evaluated them fairly.

On the employer side, 45 percent of leaders rated their AI implementation as highly successful. At the same time, the average organisation has put only about half of its purchased AI capabilities into production. The report tracks seven capabilities, including resume screening and ranking, AI-led assessments and skills matching. Roughly a quarter of respondents have deployed agentic AI at full scale across multistep hiring workflows. Looking ahead to 2027, 30 percent of leaders name candidate experience as their biggest concern, 29 percent name maintaining human judgment, and 28 percent name responsible, accurate and compliant use of AI.

The striking number is not how many candidates met AI, but the gap between those who were told and those who merely suspected. In the EU that gap is a compliance problem. Articles 13 and 14 of the GDPR require the controller to inform the data subject that automated decision-making, including profiling, takes place, and to give meaningful information about the logic involved as well as the significance and the envisaged consequences. Article 15 gives the candidate the right to obtain the same information through an access request. Article 22 sets the frame for decisions based solely on automated processing that produce legal effects or similarly significant effects, and a rejected job application is a textbook example.

The EU AI Act adds a further layer. Systems used for recruitment and selection are on the list of high-risk systems, and whoever deploys such a system must inform the people about whom it makes or supports decisions. Employers must also inform workers' representatives and affected workers before putting a high-risk system into service in the workplace. When each of these obligations starts to apply depends on the regulation's timetable, which was adjusted in 2026, but the GDPR information duty applies today.

For anyone working with assessments, the relevant part of the report is its list of AI capabilities. AI-led assessments, resume ranking and skills matching are three different points in the workflow where an automated score can decide whether a candidate moves on. The information duty follows the processing, not the system. If the assessment platform produces the score and the ATS sorts on it, the candidate needs to be able to understand both links in the chain.

That places three demands on documentation. First, the candidate privacy notice has to say that automated evaluation takes place and what it is based on. Second, the vendor's documentation has to be translatable into an explanation a candidate can follow, which in practice means the buyer needs access to a description of the scoring logic. Third, the role of human review has to be defined, so the organisation can show where a person actually makes a judgment.

The report's own figures hint at why this is hard. When only half of the purchased capabilities are live, there is a real risk that the privacy notice describes a workflow that does not exist, or omits a step added after the purchase.

The survey was issued by a vendor, relies on self-reported answers and was conducted in the United States. iCIMS itself writes that the findings suggest associations rather than causes. The figures therefore say nothing about how many European candidates are informed correctly. What they show is how candidates experience hiring when disclosure is voluntary, and that is precisely the situation the GDPR was written to prevent.

Kilde: https://www.prnewswire.com/news-releases/new-icims-and-kyle--co-research-links-ai-readiness-and-deployment-to-stronger-hiring-performance-302921676.html