Share This Article
The sixth coordinated enforcement action of the European Data Protection Board of EU privacy authorities announced on 11 November 2026 will examine whether the AI agent that screens job applications takes a decision based solely on automated processing within Article 22(1) of the GDPR, and whether the employer running it can explain that decision under Article 15(1)(h).
The announcement of the EDPB coordinated action describes an action concerning automated decision-making in recruitment, including AI-driven automated decision-making, focused on the right not to be subject to decisions based solely on automated processing and the related right of access, in the context of automated candidate screening tools. EU data protection authorities will join on a voluntary basis in the coming weeks, and the action launches in the course of 2027.
Below is an analysis of what businesses should expect as a consequence of this action.
How a coordinated enforcement action actually runs
The coordinated enforcement mechanism deserves more attention than the topic, because it determines what lands on a desk. Members propose candidate topics, all of them vote at a plenary, and the authority that proposed the chosen topic coordinates participants with the Board’s secretariat.
Participating authorities then act in three ways, and the distinction decides how much work an employer faces:
- Some run fact-finding exercises, which in previous actions meant questionnaires sent to a selected population of controllers, and some open fresh formal investigations with also dawn raids as the Garante normally does.
- Others fold the topic into investigations they already have open, which is the quietest route and reaches a company already under scrutiny for something else.
Each authority writes a national report, the coordinators aggregate those reports, and the Board adopts a consolidated report in plenary. That aggregated report is the output which matters commercially, because it becomes the template every authority applies afterwards to employers it never contacted about their screening agent.
What the four earlier actions asked for
Four previous actions give a reliable picture, since the mechanism has already run on cloud services in the public sector, on the designation of data protection officers, on the right of access, and on the right to erasure. Each of them turned on a documentary question rather than a technical one.
That pattern is the most useful thing an employer can know in advance. Authorities asked who held which role, what the organisation had written down before the question arrived, and how it logged and answered requests. Every coordinated action so far has rewarded the organisation that could produce a current document and punished the one that had to reconstruct a position after the questionnaire landed. I have examined how that documentary logic plays out in the enforcement of data subject rights, and screening agents present the same question in a harder form.
Participation on a voluntary basis by EU data protection authorities in the EDPB coordinated action is the feature most groups will misread, because it sounds like a softening and operates as the opposite. A group recruiting across the Union will meet a set of national actions of differing intensity rather than a single one, since one authority may send a questionnaire, a second may open a formal investigation, and a third may stay out.
That unevenness falls on a group with one applicant tracking system and one set of screening criteria, so several national files will describe the same configuration at once. Nothing in the framework requires the accounts given in those files to be consistent with one another, and nobody inside the group is usually tasked with keeping them so. Deciding who answers, in what order and from which entity has to happen before the first questionnaire arrives, because the first answer constrains every answer afterwards.
The EDPB coordinated enforcement action and the word “solely”
Article 22(1) of the GDPR engages only where a decision rests solely on automated processing, and that single adverb carries the defence most employers intend to run. Most will answer that a recruiter reviews the shortlist, so no decision rests solely on automated means, and the prohibition never applies.
That answer holds only where the human contribution is real, which in an AI agentic configuration becomes a question of fact rather than of policy. A screening agent scores every application, ranks the population, filters out everyone below a threshold and presents a shortlist, so nobody ever read the applications it discarded. The decision that matters is the rejection rather than the hire, and the rejected population is precisely where no human intervened.
The burden of proof is on the company to provide evidence that the actual human intervention was not just formal, but substantial. This activity will require organizations to collect evidence and perform audits. It does not mean that a human intervention shall occur on all the applications, but that a review – whose scope shall be tailored on the volume of applications – shall be actually performed.
Any data protection authority joining the action will have a judgment of the Court of Justice to work with. In Case C-634/21, decided on 7 December 2023, the Court held that the concept of a decision reaches broadly enough to encompass the calculation of a person’s creditworthiness as a probability value, and that where such a value plays a determining role in granting credit, establishing it constitutes a decision within Article 22. Reasoning the other way, the Court observed that a contrary reading would let the operation escape Article 22(2) to (4) altogether.
Transposing that reasoning to recruitment produces an uncomfortable result for any employer running a screening agent. Where a recruiter draws strongly on a ranking an agent produced, the ranking answers the description of the decision, and a formal sign-off does not move it to the human who signed. An authority will ask whether the person who signed the rejection could have reached a different answer, which is a different question from who signed it.
What the coordinated enforcement action will ask the file to show
Access rights need no new legislation and no coordinated action in order to operate today. In Case C-203/22, decided on 27 February 2025, the Court held that a data subject may require the controller, as meaningful information about the logic involved, to explain the procedure and principles actually applied to that person’s data to obtain a specific result, in a concise, transparent, intelligible and easily accessible form.
That judgment also closed the two escapes that organisations reach for first. Communicating a complex mathematical formula does not satisfy the obligation, and neither does a description of every processing step, because the explanation has to let the data subject understand. Where the controller maintains that the information contains third-party data or trade secrets, it must hand that information to the competent supervisory authority or court, which balances the competing interests, and a national rule excluding access wherever a trade secret arises cannot stand. I examined the Advocate General’s framing of that balance when the opinion in that case appeared.
Here the comparison with national enforcement planning runs against what most compliance teams assume. Italy’s current inspection programme, adopted by deliberation of 23 July 2026 as measure no. 545, covers August to December 2026 and commits the authority, partly through the financial police, to at least thirty-five inspections across eleven areas, running from geomarketing and neuromarketing to electronic health records, breaches affecting significant public databases, providers of data protection officer services to public bodies, municipal welfare processing, the April 2026 guidelines on tracking pixels in email, and dynamic pricing.
Recruitment does not appear in that programme, nor do automated decisions, profiling or algorithmic management, and its single artificial intelligence item targets systems used by municipalities and local health authorities rather than employers. Reading the programme alone would be the error, because it reserves a residual category for complaint-driven and urgent inspections, and the authority adopts each January programme in the closing days of December. I have written separately on the authority’s approach to artificial intelligence in the workplace, which shows where its attention goes.
The AI Act route, and why it arrives second
A second door leads to the same activity, and that one opens no earlier than December 2027. Point 4(a) of Annex III of the AI Act classifies as high-risk those systems intended for the recruitment or selection of natural persons, naming in particular the analysis and filtering of job applications and the evaluation of candidates. Many deployers expect to escape through Article 6(3), which lets a provider conclude that an Annex III system poses no significant risk where it performs a narrow procedural task or a preparatory one.
That exit closes for a screening agent, because the final subparagraph of Article 6(3) provides that an Annex III system is always high-risk where it performs profiling of natural persons, and ranking applicants against each other on inferred characteristics is profiling. Those obligations apply from 2 December 2027 for Annex III systems, on top of the Italian enforcement framework already in force, and Article 26 then requires an employer to inform workers’ representatives and the affected workers before putting such a system into service, saying nothing of the applicant who never joins. The coordinated action therefore arrives first, in the same year, and it reaches the rejected candidate whom the employment provisions miss.
What organisations should do
- Reconstruct and record what the agent rejects, as well as what it recommends, since the rejected population is where Article 22(1) operates and an organisation that cannot show the discarded applications cannot show human involvement.
- Write the Article 15(1)(h) answer now, as a document a candidate can understand, describing the procedure and principles actually applied rather than the model.
- Test whether the human review could produce a different outcome, and record the test, since a reviewer who cannot depart from the ranking leaves the decision where the agent made it.
- Decide the Annex III position of each screening tool before 2 December 2027, assuming the profiling rule applies, because the Article 6(3) filter closes wherever the system profiles natural persons.
I expect the first European file on screening agents to open from one rejected candidate’s access request that escalates into a complaint, rather than from a questionnaire issued under the action itself. I flag the risk in that view: complaint-driven files depend on who complains, and the aggregated report may still produce a sweep across employers. Which of your European entities would answer a rejected applicant asking why the agent screened them out, and who inside that entity has ever seen the criteria?