Article 22 in Recruiting: Automated Applicant Decisions

Article 22 of the Recruitment Act generally prohibits exclusively automated applicant decisions that have legal effect or similarly significantly impair applicants. The decisive factor is not whether you use AI, but whether the selection is made without substantial human involvement. Summarizing CVs is a different matter than rejecting applicants without independent human review.

As the founder of Berger+Team in Bolzano, I bring over 20 years of practical experience in branding and digitalization. My perspective on automated personnel decisions is therefore strategic: Which tasks can technology facilitate – and where must your company take responsibility itself? A credible employer brand is also reflected in how transparently and respectfully you handle applications.

Sources as of February 27, 2025. This article provides guidance for process design, not legal advice. The sources include the legal acts, guidelines, and judgments listed below up to this date; this does not constitute a current review of the legal status. Have your specific process and the applicable regulations reviewed by a legal expert before implementation.

Article 22 in Recruiting: When does support become a decision?

For Article 22(1) GDPR to apply, two conditions must be met: The decision is based solely on automated processing and has legal or similarly significant effects. The legal basis is the GDPR, in particular Article 22.

• Exclusively automated decision-making: Effective human evaluation is lacking. The fact that someone set up the process or later sends a rejection is not sufficient to constitute participation in the actual selection.
• Legal effect: The decision changes a person's legal status, such as their contractual rights.
• Similarly significant impairment: Even without an immediate change in rights, a decision can be significant. Being excluded from an employment opportunity is an important example.
• Profiling: Personal data is used automatically to assess personal aspects, such as presumed professional suitability. Not all profiling falls under Article 22; the decisive factors remain the impact of decisions and actual human involvement.

Automated applicant selection is a subset of automated personnel decisions. Article 22 does not require a specific AI model or a certain company size. A rule-based filter can also meet the requirements.

Four recruiting processes you should review separately

The term "assistance system" says little about the legal classification. For Article 22 in recruiting, what matters is what actually happens with each application – including those applications your team never sees.

1. Summarize application documents

• System function: The tool condenses the resume and cover letter into a single overview.
• Actual impact: Omitted qualifications, translation errors, or a one-sided presentation can predetermine the selection.
• Human role: The responsible person reviews decision-relevant information based on the original documents and forms their own judgment.
• Test question: Does the summary remain a reading aid, or is a decision based on it practically without verification? Can omitted information still be taken into account?

2. Evaluate applications

• System function: The tool awards points for professional experience, qualifications, or other selection criteria.
• Actual impact: A seemingly precise score can have a stronger effect than the underlying information justifies.
• Human role: The responsible person questions criteria, data and evaluation, instead of treating the score as objective truth.
• Test question: What characteristics and weightings determine the result? Are assumptions presented as facts? Can your team justify rejecting the proposal?

3. Create an applicant ranking

• System function: Applications are sorted according to a calculated suitability.
• Actual impact: If only the first five applications are read, the ranking can effectively exclude the remaining applicants.
• Human role: Human review must also capture the selection criteria. The independent evaluation of top candidates alone does not eliminate the need for automated exclusion of other applications.
• Test question: Does the ranking serve as a guideline, or does the ranking primarily determine who is even considered?

An important legal reference point is the ECJ ruling C-634/21 of 7 December 2023 : The European Court of Justice itself already classified automated scoring as a decision if the subsequent contractual decision of a third party depends significantly on it.

The ruling concerns credit scoring, not recruiting. Whether an applicant ranking can be classified as comparable must be examined based on the specific process.

4. Automatically filter applications

• System function: Below a certain threshold, the application will be rejected or removed from further selection.
• Actual impact: Without an independent human assessment, the person concerned loses the opportunity for employment.
• Human role: If your team only reviews the decision after a complaint, the original decision remains entirely automated.
• Test question: Is there a valid exception under Article 22(2) and have the necessary safeguards been implemented? Without these conditions, a process falling under Article 22 may not be used.

Automatic sending does not make a rejection an automated decision. What matters is who made the substantive decision regarding the rejection.

Decision tree: Check Article 22 in recruiting

Go through these questions for each selection and exclusion step, not just for the final hiring:

1. Is a decision about a person based on personal data? If no, Article 22 is not the focus of this step. If yes, examine the implications.
2. Will this result in legal consequences or a similarly significant impairment? A purely organizational sorting process is different from actual exclusion from the procedure. If there are significant consequences, you proceed to the next step.
3. Is a substantial human review conducted before the effective decision is made? If so, the requirement of "exclusively automated" can be omitted. A confirmation click or a subsequent option to complain is not sufficient.
4. If Article 22 applies: Is an exception under paragraph 2 applicable? Check for contractual necessity, specific legal permission, or explicit consent. Without a valid exception, you may not use a purely automated decision-making process.
5. Have protective measures and additional boundaries been taken into account? Clarify data subject rights, transparency, and, where applicable, special categories of data. An exception alone does not make the entire process lawful.

Outside of Article 22, processing is not automatically GDPR-compliant. Legal basis, purpose limitation, data minimization, security and other data protection obligations remain in effect.

What exceptions does Article 22 allow in recruiting?

Required for a contract

Article 22(2)(a) covers decisions that are necessary for the conclusion or performance of a contract. Time savings, lower costs, or numerous applications do not, in themselves, demonstrate this necessity.

You must be able to provide a concrete explanation as to why a purely automated decision is necessary and which less intrusive alternatives were examined.

Permitted by law

Article 22(2)(b) requires authorization under Union law or the law of a Member State to which your company is subject. This legislation must provide for appropriate safeguards. An internal company policy, a supplier commitment, or a general reference to legitimate interests does not replace such authorization.

Based on explicit consent

Explicit consent is generally possible under Article 22(2)(c), but is particularly challenging in the context of job applications. The European Data Protection Board explains in its Guidelines 05/2020 why the power imbalance vis-à-vis employers regularly makes voluntary consent problematic.

Applicants need a genuine choice and must be able to refuse or withdraw their consent without negative consequences. A mandatory checkbox stating "I accept the AI ​​selection" does not guarantee this. An explicit declaration also does not replace voluntary consent.

Certain data categories require additional review.

Health data, information on religion or other special categories of personal data are subject to additional restrictions. Decisions under Article 22(2) may not, in principle, be based on such data unless a condition under Article 9(2)(a) or (g) is met and appropriate safeguards are in place.

These exceptions apply to explicit consent or processing based on a substantial public interest and a corresponding legal basis. A mere business interest is not sufficient.

My recommendation: Don't include sensitive information in suitability assessments as a precaution. First, clarify which information is necessary for the specific position and legally permissible.

This is how human control becomes truly effective

The European Data Protection Board's guidelines WP251 rev.01 on automated decision-making require effective human involvement, stipulating that a person with the competence and authority to amend the decision is necessary. The guidelines also cite electronic recruitment procedures without human intervention as an example of significant impacts.

To implement Article 22 in recruiting, I recommend five prerequisites:

• Responsibility: A designated person makes the specific selection decision; a substitute is in place.
• Competence: The person understands job requirements, evaluation criteria, and the limitations of the tool.
• Time: The review is part of the workflow. Release under unrealistic time pressure does not allow for reliable control.
• Access to information: Original documents, decision-relevant data and verifiable evaluation criteria are available.
• Decision-making authority: The person can correct erroneous assessments, reject suggestions, and continue to consider applications regardless of the ranking.

Briefly document what was reviewed and why the decision was made. A pre-filled "human-reviewed" field does not constitute proof of an independent evaluation. Random sampling helps with quality control but does not replace individual review of applications that would otherwise be automatically excluded.

Such rules of responsibility are part of your AI governance : You define which tasks technology is allowed to take on and where a human makes a binding decision.

What you need to explain to applicants and what you need to enable

Information obligations regarding automated decision-making

Articles 13 and 14 of the GDPR regulate information regarding data collection and data from other sources, respectively. Article 15 concerns the right of access.

Within the respective legal scope, this includes information on the existence of automated decision-making, including profiling, pursuant to Article 22, paragraphs 1 and 4. At least in these cases, meaningful information on the logic involved, its scope, and its intended effects is also required.

In practical terms, you should be able to describe things clearly:

• What data and selection criteria does the procedure use?
• How do the criteria generally interact?
• Does a result lead to a recommendation, a ranking, or an exclusion?
• What role does a person play before and after the decision?
• How can applicants exercise their relevant rights?

In its judgment C-203/22 of 27 February 2025, the European Court of Justice clarified the information requirements under Article 15(1)(h): The explanation must clearly demonstrate the procedure actually applied, its principles, and the use of personal data for the specific result. Simply disclosing an algorithm is insufficient.

This ruling also concerns credit rating, not directly the selection of applicants. You should consult a legal expert on how to explain your specific rating procedure.

Rights of data subjects: Differentiate between review before the decision and appeal

In the cases of exceptions based on contractual necessity and explicit consent, Article 22(3) requires appropriate safeguards. These include at least the right to human intervention on the part of the controller, the right to express one's point of view, and the right to contest the decision.

In the case of a statutory authorization under paragraph 2(b), the relevant legal provision must include appropriate safeguards. These subsequent rights are different from a human review prior to the selection decision: An appeal process does not retroactively transform a previously purely automated rejection into a human decision.

Organize the handling of any appeal by a competent person with decision-making authority within your company. Data protection officers and, where applicable, data protection representatives will support the legal and organizational processing. A reassessment must not simply return the same score. Statutory complaint and legal remedies remain unaffected.

Fictional example: A South Tyrolean SME changes its process

The following example is entirely fictional and not a project report from Berger+Team. A craft business in South Tyrol with 18 employees is looking for administrative support.

Previously: The threshold decides

1. A system evaluates resumes based on education, experience, and language skills.
2. Applications with a score below 70 points will be automatically rejected.
3. Management only reads the remaining applications.

For those excluded, there is no human review process. The threshold determines further access to the application procedure. Article 22 in recruitment law already applies to the exclusion itself, not just the final appointment. The subsequent human selection from among the remaining candidates does not negate the previous automated exclusion.

Afterwards: The tool prepares, the person checks independently

1. The company establishes job-related selection criteria and checks their admissibility.
2. The tool creates a structured overview with references to the original documents. Automatic rejection decisions are disabled.
3. The responsible person independently reviews each application based on the relevant original information before any exclusion.
4. Unclear information, such as regarding the equivalence of a foreign degree, is not automatically treated as a lack of qualification.
5. The person documents their reasoning for selection. Only then is the corresponding message sent.

This process aims for independent human selection with technical support. However, this does not provide a general guarantee of legality. Data processing, selection criteria, and actual implementation must be examined separately.

From my perspective as a branding strategist, the commitment to a fair employer brand must be reflected in the selection process. Job-related criteria and the careful review of each application make this commitment concrete. How you translate brand values ​​into codes of conduct affects recruiting just as much as leadership and collaboration.

Checklist for Article 22 in Recruiting

Use this list as a working basis before release and after significant changes:

Selection process and responsibility

• Selection criteria: Are the criteria job-related, transparent, and checked for impermissible discrimination?
• Data sources: What documents, external information, and derived characteristics are processed?
• Decision thresholds: Which scores, filters, or rank limits trigger an exclusion – even indirectly?
• Responsibilities: Who decides, who represents this person, and who is allowed to stop the process?

Human review and data subject rights

• Human testing: Is the review conducted before the effective decision, with original documents, sufficient time, and actual power to amend?
• Documentation: Are the evaluation, corrections, and selection rationale adequately comprehensible?
• Applicant information: Do the instructions reflect the actual process and comply with legal information requirements?
• Complaint procedure: Can applicants reach a responsible person and effectively exercise their relevant rights?

Provider and data protection

• Provider documents: Do you know how it works, its limitations, data flows, storage locations, deletion options, and contractual roles?
• Data protection principles: Have the legal basis, access control, storage, deletion and, if applicable, data processing been clarified?
• Impact assessment: Is it documented whether a data protection impact assessment is required?

According to Article 35 of the GDPR, a data protection impact assessment is necessary where there is likely to be a high risk. Paragraph 3(a) specifically mentions systematic and extensive assessments of personal aspects based on automated processing that serve as the basis for decisions with legal or similarly significant effects.

Not every AI tool triggers the obligation; however, human involvement does not automatically exclude the obligation either.

We delve deeper into the general review of data flows and provider terms in our article on the data protection-related approval of AI tools . For this recruiting check, the additional key question remains: Who actually decides on the application?

EU AI Act: an independent audit level

The EU AI Act, Regulation (EU) 2024/1689 , must be examined independently of Article 22 GDPR. According to Article 6(2) in conjunction with Annex III, point 4(a), certain AI systems for recruitment and candidate selection generally fall under the high-risk classification. This includes systems for analyzing, filtering, or evaluating applications.

• Human involvement is not a blanket exception: A tool can be a high-risk AI system, even though there is no fully automated decision as defined in Article 22.
• Not every HR tool is automatically high-risk: The intended purpose and specific function are decisive.
• Exceptions are limited: Article 6, paragraph 3, provides for exceptions under certain conditions in the absence of a significant risk. A lack of substantial influence on the decision outcome is relevant; in addition, at least one of the conditions mentioned therein must be met, such as a narrowly defined procedural task or a preparatory task.
• Profiling is particularly relevant: This exception does not apply to the systems listed in Annex III that carry out profiling of natural persons.

Before implementation, review the classification, relevant operator obligations – particularly under Article 26 – as well as application dates and transitional rules, based on the then-current official version. Distinguish between obligations already applicable, requirements that will apply later, and mere proposed amendments. A provider's claim of "AI Act compliance" does not replace this review.

For your business in South Tyrol, you also need to check relevant Italian regulations. You should not simply transfer German or Austrian employee data protection and labor law regulations to Italy without first reviewing them.

Frequently asked questions about Article 22 in recruiting

Is AI allowed to summarize resumes?

In principle, AI can be used as a reading aid if the data processing is organized in a legally compliant manner. Verify decision-relevant information against the original documents to ensure that omissions or errors do not uncheck the selection.

Are applicant rankings already decisions?

Not every ranking automatically constitutes a decision under Article 22. However, if the ranking significantly determines which applications are considered or excluded, you must have the actual influence legally reviewed.

Does a human confirmation click count as verification?

A single click is not enough. The responsible person must review the content of the result, consider relevant information, and actually be able to decide differently.

Is a system allowed to cancel automatically?

The automatic sending of a rejection previously decided independently by a human being must be distinguished from an automated rejection decision. If the system makes the significant selection decision itself, you need a valid exception under Article 22, paragraph 2, and the necessary safeguards.

Is explicit consent sufficient?

No, an explicit declaration alone is not sufficient. Consent must be voluntary; applicants need a genuine choice without disadvantages for refusal or withdrawal. Other data protection obligations remain in effect.

What do you need to explain to applicants about the evaluation process?

Where specific information and disclosure requirements apply, you must provide meaningful information about the logic involved, as well as the scope and intended effects. A clear explanation of the procedure and the use of personal data is required; a technical algorithm excerpt alone is insufficient.

Who handles an appeal?

Organize the review by a competent person with access to the relevant documents and actual decision-making authority. Referring the matter to the software provider or rerunning the same assessment does not replace effective human review.

Does Article 22 also apply to small businesses?

Yes, Article 22 does not contain a general exemption for SMEs or small teams. The decisive factors are the degree of automation and the impact of the decision, not the number of your employees.

Does Article 22 also apply to filters without AI?

Yes, Article 22 covers automated processing and does not require AI. A rule-based filter that significantly and unfairly rejects applications without substantial human review can therefore also fall under this provision.

Conclusion: Clearly assign selection responsibility

Article 22 of the Recruiting Regulation requires a clear distinction between technical preparation and purely automated selection. For your company, I recommend a process in which technology structures information, and a competent person independently reviews each selection decision. Where decisions are to be made entirely automatically, a viable exception and the necessary safeguards are essential.

If you'd like to review your recruiting process, Berger+Team can support you with strategic consulting on digitalization and AI processes . As a collective of freelancers in Bolzano, we work directly with you on responsibilities, selection processes, and technical requirements. Legal review on a case-by-case basis remains the responsibility of appropriately qualified legal counsel.

Sources and legal bases

The following sources are linked at the relevant point in the text. This overview documents the source base used up to February 27, 2025.

1. Regulation (EU) 2016/679 – GDPR, in particular Articles 9, 13, 14, 15, 22 and 35 (2016).
2. European Court of Justice: C-634/21, SCHUFA Holding (Scoring), Judgment of 7 December 2023.
3. European Data Protection Board: Guidelines 05/2020 on consent pursuant to Regulation (EU) 2016/679, version 1.1 (2020).
4. Article 29 Working Party: Guidelines WP251 rev.01 on automated decision-making and profiling, endorsed by the European Data Protection Board (2018).
5. European Court of Justice: C-203/22, Dun & Bradstreet Austria, Judgment of 27 February 2025.
6. Regulation (EU) 2024/1689 – AI Regulation, in particular Articles 6 and 26 and Annex III point 4 (2024).