AI CV screening: why it is high-risk and what that requires

Short answer: Software that automatically filters CVs, extracts key fields (parsing) or gives candidates a score or ranking is by far the most widely used AI in HR — and falls under Annex III, point 4 of the AI Act as high-risk. That holds even if you buy the tool: then you are a deployer, with your own duties. The GDPR runs in parallel.

Why CV screening in particular is high-risk

The AI Act classifies AI used for recruitment and selection — targeted advertising, filtering applications and assessing candidates — as high-risk. The reason is the impact on fundamental rights: someone filtered out automatically gets no fair chance, often without knowing it. A ranking or matching score touches that same core.

The bias risk

CV screening learns from historical data. If that data contains an imbalance — few women in technical roles, say — the model reproduces the pattern. Seemingly neutral features (postcode, CV gaps, name) can act as proxies for protected characteristics. An efficiency gain then quickly shifts into discrimination in recruitment.

What the employer must do

As deployer (Art. 26) you have your own package, even with a bought-in tool:

• Human oversight (Art. 14): a recruiter must be able to assess and override the outcome — no automatic rejection without a human view.
• Use as instructed and with relevant, representative input data.
• Inform candidates that an AI system is used.
• Keep logs and monitor operation for skewed outcomes.

The provider carries the heaviest load (risk management, data quality, documentation, CE marking). Modify the tool substantially or put your own name on it, and you become a provider yourself (Art. 25).

The GDPR on top

A fully automated rejection with significant effects falls under Article 22 GDPR: you need a valid basis, transparency about the logic and a right to human intervention.

What to do

• Inventory whether your recruitment tools fall under Annex III — most matching and screening tools do.
• Demand documentation from the supplier to evidence your own duties — see AI in contracts.
• Build a human decision point before every rejection.
• Test periodically for bias and record the result.

CV screening is not a "handy tool with a caveat" but a high-risk system. Treating it that way now prevents both a complaint from a rejected candidate and a supervisory problem.