If you use AI to screen CVs, a handful of regimes decide how you have to do it: South Africa's POPIA and Employment Equity Act, the EU AI Act, NYC Local Law 144, and GDPR Article 22. Here is what each one actually asks for, and how Qcandidate produces the evidence.
South Africa
POPIA, Employment Equity Act & B-BBEE reporting
POPIA fully enforced since July 2021- •POPIA s71: no decision based solely on automated processing where it has legal consequences for the candidate
- •POPIA s9–s13: lawful, minimal, purpose-limited processing with candidate notice at collection
- •POPIA s18: candidates must know who holds their CV and why
- •POPIA s5(e)/s23: right of access, correction and deletion, and the right to object
- •Employment Equity Act s8: any assessment must be scientifically valid, reliable, applied fairly and free of bias
- •EEA s6: no unfair discrimination on race, gender, age, disability, pregnancy, HIV status or 16 other listed grounds
- •B-BBEE and EE reporting: demographic evidence for your EE plan and skills-development spend
How Qcandidate answers it: Qcandidate scores and ranks against your written rubric; a person makes every hire and reject call, so you stay outside POPIA s71's automated-decision prohibition. Every score carries the CV evidence behind it, which is the record you need to show an assessment was valid and fairly applied under EEA s8. Consent is captured with a typed signature before any candidate joins the Talent Network, retention and deletion requests are honoured within 30 days, and selection-rate reports give your EE committee the numbers for the EEA2 return. Growth Kits sent to unsuccessful candidates — free courses and free-to-apply freelance work — also support your skills-development story.
European Union
EU AI Act
High-risk obligations phasing in from 2026- •CV screening and candidate ranking are high-risk AI under Annex III
- •Human oversight: a person must be able to review and override the output
- •Automatic logging of each system use, kept for traceability
- •Transparency to candidates that an AI system is being used
- •Risk management and data-governance evidence from the provider
How Qcandidate answers it: Qcandidate ranks, never rejects. Every rejection and Growth Kit send needs an HR sign-off after the evidence table is reviewed, and every score, override and send is written to an immutable audit log you can export.
New York City
Local Law 144
Enforced since July 2023- •Independent bias audit within the past 12 months
- •Public summary of the audit results on the careers site
- •Candidate notice at least 10 business days before the tool is used
- •Disclosure of the job qualifications and characteristics assessed
How Qcandidate answers it: The bias audit dashboard tracks selection rates by protected-attribute signal and exports the impact-ratio artifacts your auditor needs. The rubric editor makes the assessed qualifications explicit and publishable.
Global
GDPR Article 22 & EEOC guidance
In force- •No solely automated decision with legal or similarly significant effect
- •Meaningful information about the logic involved
- •The right to contest a decision and obtain human review
- •Adverse-impact monitoring under the four-fifths rule (US EEOC)
How Qcandidate answers it: Candidates get a portal showing their own score breakdown and skills gap, not a silent rejection. Impact ratios are computed per run so you can spot a four-fifths problem before a regulator does.
If you hire across borders, these are the jurisdictions that will ask for evidence soonest.
- Does AI CV screening comply with POPIA?
- Yes, provided a person still makes the call. POPIA section 71 blocks decisions based solely on automated processing where they carry legal consequences for the candidate. Qcandidate ranks and explains; your HR team decides and signs off, which keeps you on the right side of section 71. You also need candidate notice at collection, minimal data, and honouring access, correction and deletion requests — all built into the platform.
- What about the Employment Equity Act and B-BBEE?
- EEA section 8 says any assessment used in hiring must be scientifically valid, reliable, applied fairly to all employees and free of bias. A written rubric plus per-candidate evidence is exactly the record that proves it. Selection-rate reporting gives your EE committee numbers for the EEA2 return, and Growth Kits for unsuccessful candidates support your skills-development commitments.
- Is AI CV screening legal under the EU AI Act?
- Yes, but screening and ranking applicants is high-risk under Annex III. You need human oversight, logging, candidate transparency, and a provider that can hand you its technical documentation. It is not banned — it is regulated.
- What does NYC Local Law 144 require?
- An independent bias audit within the previous 12 months, a public summary of the results, and notice to candidates at least 10 business days before the tool is used on them.
- Can the AI reject a candidate on its own?
- It should not. A solely automated rejection triggers the strictest GDPR Article 22 duties and defeats the human-oversight requirement. Rank with AI, decide with a person, and log both.
- What do candidates have to be told?
- That an automated tool is being used, what it assesses, and — on request — meaningful information about the logic behind their outcome. Qcandidate gives every candidate a portal with their own score breakdown and skills gap, which satisfies this by default.