AI hiring tools: EU privacy authorities to check in 2027
In brief
On 10 November 2026, the European Data Protection Board chose the theme of its sixth coordinated enforcement action, to be launched in 2027. According to the EDPB, the work will cover automated decisions, including AI tools used to select candidates. It will focus on the right not to be subject solely to automated processing and the related right of access; national authorities may join voluntarily.
What it changes for an SME
If you use automated tools, including AI, to screen or rank job applicants, the action targets the right not to be subject solely to an automated decision and the related right of access, according to the EDPB. Nothing changes immediately: the action will start in 2027 and authorities take part on a voluntary basis. For an SME with 10 to 250 people, the issue is time and compliance risk if hiring relies on automatic screening without human involvement. The other EDPB items that day, on South Korea's adequacy and binding corporate rules for processors, mainly affect transfers of personal data outside the EU.
What you can do
- List the tools, in-house or from a vendor, that automatically filter or rank job applications.
- Check that a candidate can obtain information about an automated decision and that a person can step in.
- Update the GDPR documentation of your hiring process before the 2027 action begins.
Let's talk about the time you could save.
In 20 minutes, we find where AI could save you time or money. Free, no commitment.