Spanish Data Protection Authority Issues Preventive Warning on AI Recruitment Tools

Spain's data protection authority, the AEPD, issued a preventive warning in September 2026 against the deployment of AI-driven CV screening systems that make or significantly influence recruitment decisions without adequate transparency, human oversight, and data subject rights mechanisms. The warning identifies the use of algorithmic scoring to rank or filter job applicants as processing that carries a high risk of discrimination and that requires, at minimum, a data protection impact assessment, meaningful candidate notification, and a genuine human review process before any decision is finalised.

The AEPD's warning anticipates the full set of AI Act obligations for high-risk employment AI systems, which are currently deferred to December 2027 under the Digital Omnibus. The authority is using its existing GDPR powers on automated decision-making and high-risk processing to address AI recruitment practices ahead of the AI Act's specific framework coming into force, signalling that regulators intend to apply existing data protection law to fill the gap before the AI-specific rules become enforceable.

The warning covers not only applicant tracking systems that use AI scoring but also tools that analyse recorded interviews, assess written applications through natural language processing, or aggregate public social media data to build candidate risk profiles without explicit consent. The AEPD characterised several practices currently standard in the HR technology market as unlawful under existing GDPR provisions independently of the upcoming AI Act requirements.

Why it matters for business: The AEPD's warning signals that HR technology vendors and employers using AI screening tools face regulatory risk under existing GDPR rules, not only under the AI Act obligations arriving in 2027. For HR technology buyers, the warning is a specification document for the compliance questions they should be putting to their vendors right now: what data protection impact assessment has been conducted, what candidate notification does the tool provide, and what genuine human review mechanism is built into the hiring workflow? Waiting for the 2027 AI Act deadline to ask these questions is a commercially and legally exposed position.

Source: AEPD / Datalawgy, September 2026, https://datalawgy.substack.com/p/what-is-new-in-data-technology-and-008