AI Act candidate disclosure: notice template

If your hiring process uses automated CV screening, ranking or scoring, you must tell candidates before they are assessed by it: GDPR Articles 13 and 14 require meaningful information about the logic and consequences, and the EU AI Act adds a duty to inform people they are subject to a high-risk system. The fix is a short, plain-language disclosure notice placed where candidates apply, and a real human review behind every rejection.

This article is practitioner guidance, not legal advice. National implementations differ; confirm specifics for your market with counsel.

What does the law require you to tell candidates?

You have to disclose three things in plain language: that automated screening is used, what it does to their application, and what their rights are. This sits across two regimes. Under GDPR Articles 13 and 14, you must give candidates “meaningful information about the logic involved” in any automated processing and explain “the significance and the envisaged consequences” of it. Under the EU AI Act, Regulation (EU) 2024/1689, recruitment and selection tools are classified as high-risk in Annex III, point 4, and deployers who are employers must inform affected people that they are subject to such a system.

The two regimes overlap but are not identical. GDPR governs the personal data and the decision. The AI Act governs the tool. A single, well-written notice can satisfy both, which is why a template helps. For the wider data-protection picture around applicant records, see our GDPR for recruiters guide.

What is the difference between decision support and a solely automated decision?

This distinction decides which duties bite, so get it right. Decision support means the tool produces a score, rank or shortlist, and a named recruiter then reviews the output and makes the actual call, with real authority to overrule it. A solely automated decision means the outcome, typically a rejection, is produced and acted on without meaningful human involvement.

The line matters because GDPR Article 22 restricts decisions “based solely on automated processing” that produce “legal effects” or “similarly significantly” affect a person. A fully automated reject-at-the-CV-stage workflow falls squarely inside Article 22. A human who genuinely reviews the case does not.

The Court of Justice of the EU tightened this in the SCHUFA case (C-634/21, 7 December 2023). It held that a probability value can itself be an automated decision where a third party draws strongly on it, and that a human who merely rubber-stamps the output is not enough. The EDPB takes the same view: you cannot avoid Article 22 by fabricating human involvement. The reviewer must have the competence and authority to depart from the recommendation. We unpack the consent and legitimate-interest side of this in legal basis for candidate data.

Aspect	Decision support (human in the loop)	Solely automated decision
Who decides	Named recruiter, can overrule	The system, no real override
GDPR Article 22	Restriction does not bite	Restriction applies; extra safeguards required
Candidate rights	Information, explanation	Plus human intervention, contest, point of view
What you must disclose	Tool is used and what it does	Same, and that the decision is automated
Practical risk	Manageable with logged reviews	High; lawful only on a narrow basis

What rights does a candidate have, and what must the notice say?

A candidate facing automated screening has, at minimum, the right to be informed, the right to a meaningful explanation, and (where a decision is solely automated with significant effect) the right to human intervention, to express their point of view, and to contest the outcome under GDPR Article 22(3). The EU AI Act adds a right to explanation in Article 86: an affected person subject to a decision based on a high-risk Annex III system that produces legal or similarly significant effects can obtain “clear and meaningful explanations of the role of the AI system in the decision-making procedure and the main elements of the decision taken.”

So your notice has to do five jobs:

1. State plainly that automated tools assist screening, ranking or matching.
2. Describe in non-technical terms what the tool evaluates, for example skills and experience against the role.
3. Say whether a human reviews the output before any rejection (it should).
4. Name the legal basis for the processing and point to the full privacy notice.
5. Tell candidates how to ask for a human review, an explanation, or to contest a decision, with a contact route.

What does a copy-paste disclosure notice look like?

Below is a reusable, plain-language template. Adapt the bracketed parts and have counsel confirm it for your market. Keep it short; a wall of legalese fails the GDPR “intelligible and easily accessible” test in Articles 12 to 14.

How we assess your application

[Company name] uses automated tools to help us review applications. These
tools read the information in your CV and application and compare your skills
and experience against what the role requires. They help us rank and shortlist
applications so our team can focus its review.

A person decides. The tools support our recruiters; they do not reject
candidates on their own. A named member of our hiring team reviews the
shortlist and makes every decision about whether your application moves
forward. That reviewer can disagree with and override the tool's output.

Your rights. You can ask us to explain how the tools were used in your case
and the main reasons for a decision. You can ask a human to review a decision,
share your point of view, and contest an outcome you think is wrong. To do any
of this, contact [recruitment contact / email].

Your data. We process your application data on the basis of [legitimate
interest in recruiting / steps prior to a contract / your consent]. We keep it
for [retention period] and then delete it. Full details, including how to
exercise your data rights, are in our [link: candidate privacy notice].

Where do you put it? In three places, so a candidate cannot miss it. First, on or beside the application form, as a short paragraph with a link to the full privacy notice. Second, inside the candidate privacy notice itself, with the detail. Third, where the impact is real, in rejection communications: a line confirming a person reviewed the application and how to request an explanation or human review.

When do these duties apply, and what are the deadlines?

The GDPR duties apply now. Articles 13, 14 and 22 have been in force since 2018, so the information, explanation and human-review obligations are live today for any automated screening you run. There is no waiting period.

The EU AI Act high-risk duties were originally set to apply from 2 August 2026 for Annex III systems, recruitment included. That date is moving. The Commission tabled a Digital Omnibus on 19 November 2025, and negotiators reached a provisional agreement on 7 May 2026 to defer the bulk of standalone Annex III high-risk obligations to 2 December 2027. That deferral is not yet formally adopted or published in the Official Journal, so treat the timing as unsettled and confirm the position for your jurisdiction. Note one thing that does not move: the Article 50 transparency duty, which requires people to be told when they interact directly with an AI system such as a chatbot, applies from 2 August 2026.

The practical takeaway is simple. Whatever the AI Act timeline settles on, your GDPR disclosure and human-review duties already require the notice above. Building it now is not early; it is on time. The deadline detail and deployer checklist sit in our AI Act recruitment compliance checklist.

Why does the high-risk classification raise the stakes?

Because the penalties and the documentation burden step up. Recruitment screening is high-risk specifically because a hiring decision shapes someone’s livelihood, so the Act layers oversight, logging and explanation duties on top of GDPR. Breaching the high-risk obligations can draw fines up to EUR 15 million or 3 percent of worldwide annual turnover, whichever is higher.

The disclosure notice is only the visible part. Behind it you need to be able to show, for any individual rejection, which named human reviewed it, on what information, and when, plus the system logs and the candidate-facing explanation. If you cannot produce that trail, the notice is a promise you cannot keep. The full classification logic and deployer duties are set out in our AI Act high-risk hiring guide.

How Recruitifly helps

Recruitifly is built so the human-in-the-loop claim in your disclosure notice is true by design. The Fly assistant proposes shortlists, stage moves and outreach drafts, but it operates on a propose-and-confirm basis: nothing acts on a candidate until a named recruiter approves it, which keeps screening as decision support rather than a solely automated decision. Match scores carry visible reasoning instead of silent auto-rejection, so you can answer an explanation request, and the actions are logged with who approved what and when. Candidate-data controls and retention settings back the privacy-notice half of the template, and posting compliance checks flag vacancy and disclosure gaps before a role goes live.

Recruitifly is in private beta. If you want to walk your current screening workflow through these disclosure and human-review duties, talk to us and join the beta.