AI in hiring in Germany: what the law requires before you screen applicants with AI

May an HR team pre-screen applications with AI?

Yes, if a person makes the decision on the application. Article 22(1) GDPR gives everyone the right not to be subject to a decision based solely on automated processing that produces legal effects or similarly significantly affects them. An automatic rejection meets that test. Paragraph 3 requires that people can at least obtain human intervention, express their point of view and contest the decision.

The Hamburg data protection authority (HmbBfDI) described on 6 June 2024 what goes beyond that in application procedures. CV parsers that read out data and transfer it in structured form into the applicant management system are generally permissible if the data is accurate. If an additional analysis follows the parsing, Article 22 GDPR must be met. Leaving the full selection decision or the final candidate recommendation to a language model, the authority calls problematic and generally impermissible.

What counts as a "decision" needs clarifying. On 7 December 2023 the Court of Justice of the European Union held in the Schufa case (C-634/21) that even a score can be an automated decision if the recipient bases its decision substantially on it. The court did not accept the argument that the provider only delivers a number and a person decides. Applied to recruiting: a ranking that the recruiter follows in almost every case is not decision support, it is the decision. The Hamburg paper puts it this way for applications: purely formal human involvement is not enough, the decision-maker needs real discretion and must not decide mainly on the basis of the AI suggestion.

Article 22(2) GDPR has exceptions, for example where the decision is necessary for entering into a contract. I do not plan around that exception, because the Hamburg authority still expects a person to make the selection decision. If you want to rely on it, have your data protection officer assess it in writing first.

Evidence1234

Is your recruiting tool high-risk AI?

Mostly yes, as soon as it filters, scores or ranks applications. Annex III point 4(a) of the EU AI Act lists as high-risk AI systems intended for the recruitment or selection of natural persons, in particular to place targeted job advertisements, to analyse and filter job applications and to evaluate candidates. Point 4(b) covers decisions on promotion and termination, task allocation based on behaviour or personal traits, and the monitoring of performance and behaviour.

Article 6(3) contains an exception: an Annex III system is not considered high-risk if it does not pose a significant risk to health, safety or fundamental rights, for example because it only performs a narrow procedural task or a preparatory task. There is a hard override: if the system performs profiling of natural persons, it is always high-risk. Whoever relies on the exception for their system must document the assessment (Article 6(4)). That is first the provider's job, but you should request the documentation before you deploy the tool.

The selection below walks through this classification in four questions. It does not replace a legal assessment, but it shows where your tool lands and which question to put to the vendor.

Evidence567

What duties do deployers have, and when do they apply?

From 2 December 2027, no longer from 2 August 2026. The Digital Omnibus moved the requirements for high-risk systems under Annex III from 2 August 2026 to 2 December 2027. The Future of Privacy Forum reads it that way, and Article 113(c) in its amended form names this date. The postponement changes nothing about the bans: Chapters I and II of the regulation have applied since 2 February 2025.

As a deployer, meaning a company that uses a recruiting system, the duties of Article 26 then apply to you. You assign human oversight to people with the necessary competence, training and authority. You check that the input data you control is relevant and sufficiently representative for the purpose. You monitor operation against the instructions for use and report risks and incidents. You keep the automatically generated logs, to the extent they are under your control, for at least six months. And before use you inform the workers' representatives and the affected workers (paragraph 7) as well as the people about whom the system helps decide (paragraph 11). In recruiting, those are the applicants.

Article 86 adds to this: anyone affected by a decision that rests on the output of an Annex III system and has an adverse effect can demand clear and meaningful explanations from the deployer of the role of the system and the main elements of the decision. In practice you must be able to explain to a rejected person what role the AI played. That presupposes that you know it yourself.

Oversight is where the real difficulty lies. Article 14(4)(b) names the tendency to rely automatically on the output of a high-risk system (automation bias) as something the oversight persons must stay aware of. That matches the data protection yardstick. If you appoint oversight on paper only, you meet neither requirement. For training these people, see the article on AI training for employees.

Breaches of Article 26 can be fined up to 15 million euros or three percent of worldwide annual turnover, whichever is higher (Article 99(4)). That is the ceiling, not the normal case. It shows the rank the legislator gives deployer duties.

Evidence891011121314

Which legal basis and which data protection impact assessment do you need?

You need a legal basis for every processing of applicant data and, as a rule, a data protection impact assessment. Section 26(1) first sentence BDSG (the German Federal Data Protection Act) permits processing for the decision on establishing an employment relationship if it is necessary. Since the CJEU judgment of 30 March 2023 (C-34/21), Gleiss Lutz assesses that this provision probably does not meet the requirements of Article 88(2) GDPR that apply to national rules on employee data protection. Employers keep Article 6(1)(b) GDPR as a standalone basis. In practice: do not rest the basis in your record of processing activities on section 26 BDSG alone.

Consent is not a convenient shortcut in an application relationship. Section 26(2) BDSG requires that the dependence of the person and the circumstances of giving consent be taken into account when assessing voluntariness. An applicant who is asked to agree to an AI interview in order to stay in the process hardly decides freely. The Hamburg authority doubts the voluntariness of consent for emotion analysis for this reason.

Article 35 GDPR requires a data protection impact assessment where processing is likely to result in a high risk to the rights and freedoms of natural persons. Paragraph 3(a) names as a standard example the systematic and extensive evaluation of personal aspects based on automated processing, including profiling, on which decisions with legal or similarly significant effects are based. A ranking tool in recruiting fits that description. You carry out the assessment as controller, and you must request the vendor's information for it. Article 26(9) of the EU AI Act expressly provides that deployers use the provider's information under Article 13 AI Act for this assessment.

Applicants must be informed. Article 13(2)(f) GDPR requires information on the existence of automated decision-making, including profiling, and meaningful information about the logic involved and the significance and envisaged consequences. A single sentence in the privacy notice, "we use AI as support", is not enough. More on the GDPR side of AI in HR is on the page GDPR and AI in HR.

Evidence14151617

What does the AGG require when AI screens out applicants?

That the selection does not disadvantage anyone on a protected ground, even when an algorithm screens them out. Section 6(1) AGG treats applicants as employees, and section 7(1) prohibits disadvantage on a ground named in section 1. The law does not ask whether a person or software made the decision. The employer is the addressee.

In a dispute, the burden of proof matters. Under section 22 AGG it is enough that one party proves indications that suggest a disadvantage. The other side then has to prove that there was no breach. A tool whose selection logic you cannot explain makes that counter-proof hard. If you cannot reconstruct the reasons for a rejection, you have no defence.

The consequences are set out in section 15 AGG. The employer must compensate the damage, and for non-material damage those affected can demand appropriate compensation in money. For a refusal to hire it is capped at three months' salary if the person would not have been hired even with a non-discriminatory selection. Under paragraph 4, claims must be asserted in writing within two months. That short deadline is a reason to document selection decisions and their reasons in a way you can still prove later.

A case from the United States shows what such a dispute can look like. On 16 May 2025 the federal district court for the Northern District of California (Judge Rita Lin) preliminarily certified a collective action under the Age Discrimination in Employment Act in Mobley v. Workday. It covers applicants aged 40 and over who were rejected through the platform since 24 September 2020. The court saw the central question, whether the AI system disproportionately affects older applicants, as one that can be resolved collectively. That is American law and no yardstick for Germany, but it shows that courts look at the systems as well as the users.

Evidence1819202122

What does the works council have to co-decide?

On selection guidelines, questionnaires, the introduction of AI and monitoring. The Works Constitution Act (BetrVG) now names AI explicitly. Section 95(1) BetrVG makes selection guidelines for hiring, transfers, regrading and dismissals subject to the works council's consent. Paragraph 2a extends this to cases where artificial intelligence is used when drawing up the guidelines. If a tool generates criteria by which applications are weighted, those criteria count as a guideline even if they never appeared in a document.

There are further rights. Under section 90(1) no. 3 BetrVG the works council must be informed in good time about the planning of work procedures and workflows, including the use of AI. If it has to assess the introduction or use of AI, section 80(3) deems the involvement of an expert necessary to that extent. Personnel questionnaires, including structured queries in the application process, need consent under section 94(1). And for technical devices intended to monitor the behaviour or performance of employees, the works council co-determines under section 87(1) no. 6. That matters mostly for tools later used on existing staff.

For every hire, section 99(1) first sentence BetrVG applies: in companies that usually have more than twenty employees entitled to vote, the works council must be informed before the hire and given the necessary application documents. How much of an AI ranking the works council may see should be clarified before the first hire is due, ideally in a works agreement. How one can be structured is described on the page on the works council AI agreement.

I recommend a simple order: inform first, then consult, then regulate the use. A pilot without the works council endangers the rollout, because the works council can bring in an expert under section 80(3) and the introduction is delayed.

Evidence232425262728

What do vendors say, and how widespread is AI in recruiting?

By the latest reliable figures it is barely widespread in Germany, and vendors say little about the legal questions. The digital industry association Bitkom surveyed 852 companies with three or more employees (calendar weeks 38 to 44 of 2024, by telephone, representative) and found that only 1 percent screen applications with AI help. 3 percent use an AI-based competency or potential analysis, 4 percent an AI chatbot, and 1 percent let an AI conduct job interviews. For the future, 21, 29, 25 and 7 percent can imagine it. I found no newer figures for recruiting. The survey dates from 2024. Whether the values are higher today I cannot show.

The vendor figures come from my own survey of AI tools for HR. It covers 46 recruiting tools, archived entries excluded, 23 of them with AI screening of CVs or AI video interviews. For 6 of these 23 I found a vendor statement on the EU AI Act, for 13 none, and for 4 it has not yet been checked. 5 of the 23 have a publicly viewable data processing agreement. For none of the 46 recruiting tools did I find a vendor page on involving the works council. Only what is on the vendor pages is recorded, as of 14 October 2026. If a statement is missing there, that does not mean the vendor cannot supply it on request. It means you have to request it.

A simple buying rule follows. Make the documents a condition for the trial, not for the contract: the classification of the system under the EU AI Act including the documentation of an Article 6(3) exception, the description of the logic for informing applicants and for the impact assessment, logging and its duration, the data location and the subprocessors. If a vendor supplies none of this, you should not start the deployment.

Evidence29

What belongs on the checklist before deployment?

The list below sums up the points from the sections above, in the order in which I would work through them before a deployment. Each point goes back to one of the provisions named or to a step that follows from them. The list does not replace a legal review.

Tick off what you have settled. The list stays saved in your browser, and the button below copies the current state as text.

Evidence101

How I approach the topic

I do not rate tools here, and I am not a lawyer. What I bring is the view of an HR lead who has done selection personally: more than 1,000 interviews conducted and more than 100 hires across twelve or more countries. I consider documenting the decision more important than the tool, because the reasons for a rejection get asked for later: by applicants, by the works council or in court (section 22 AGG). That is my assessment, not a study.

When a company approaches me about AI in recruiting, I start with two questions. Who decides today, and what does that person rely on? And what should the tool replace: reading time, decision time or responsibility? If it should save reading time, parsing and summaries fit and the legal position is manageable. If it should take over decisions, we are at Article 22 GDPR, at Annex III and at the works council, and the effort for documents and involvement rises considerably.

That is also part of my offer: I work as an HR interim manager and AI consultant, so I have a stake in you contacting me. If your plan is a CV parser with a human decision, you need neither me nor a legal opinion, but clean documentation and a works council that has been informed. I will tell you that in the first conversation.

Evidence2