QQcandidate
Screen CVs

European Union

The EU AI Act and AI CV screening

Screening and ranking job applicants is explicitly high-risk AI under Annex III. That does not make it illegal — it makes it evidenced. Here is what a deployer has to be able to show, and where Qcandidate produces that evidence automatically.

The short version

You may use AI to rank CVs. You may not let it reject people by itself, and you must be able to reconstruct — months later — what criteria were applied, what the system output, who reviewed it and what the candidate was told.

Deployer duties, line by line

Human oversight

A named person must be able to review, interpret and override the AI output before it affects a candidate.

In Qcandidate: Every rejection and every Growth Kit send passes through the HR sign-off step. Nothing leaves the system without a human decision recorded against a name and timestamp.

Automatic logging

Logs of each use of the system must be generated and retained (at least six months for deployers).

In Qcandidate: Each screening run writes an immutable audit log: job, rubric version, model, per-candidate score, reviewer and outcome. Exportable as CSV, JSON or a compliance PDF.

Transparency to candidates

Candidates must be told a high-risk AI system is used and may ask for an explanation of its role in their outcome.

In Qcandidate: Every applicant gets a portal link with their score breakdown, the rubric criteria and the evidence quoted from their CV.

Input data relevance

Deployers must ensure the input data is relevant and sufficiently representative for the intended purpose.

In Qcandidate: Scoring runs against an HR-authored rubric of job requirements only. Rubric edits are versioned so you can show what the system was asked to look for on any given date.

Provider documentation

You must be able to point to the provider's technical documentation, risk management and instructions for use.

In Qcandidate: The DPA page lists the model, subprocessors, data categories and retention. The compliance evidence pack bundles it with your own run logs.

AI literacy

Since February 2025, staff operating AI systems must have a sufficient level of AI literacy.

In Qcandidate: The in-app guided tour and explainability panel are written so a recruiter can explain, in their own words, why a candidate ranked where they did.

Timeline

DateWhat applies
Aug 2024AI Act enters into force
Feb 2025Prohibited practices and AI-literacy duties apply
Aug 2025General-purpose AI model obligations apply
Aug 2026Annex III high-risk duties apply — recruitment and CV screening
Aug 2027Remaining high-risk categories in regulated products

Source: Regulation (EU) 2024/1689. This page is guidance, not legal advice — confirm the current text with your counsel.

Common questions

Is CV screening really high-risk?
Yes — Annex III point 4 names recruitment and selection, including filtering applications and evaluating candidates, as a high-risk use case.
Are we the provider or the deployer?
An employer using Qcandidate to screen its own applicants is a deployer. Deployer duties are lighter than provider duties, but oversight, logging and candidate information are on you.
Does GDPR Article 22 still apply?
Yes, in parallel. A solely automated rejection with legal or similarly significant effect needs a legal basis and safeguards. Keeping a human decision on every rejection is the simplest way to stay out of Article 22 territory.
See the evidence trailNYC Local Law 144Compliance overview