AI and recruitment: what is allowed in 2026?
More organisations use AI to speed up hiring, and for small and medium-sized businesses (SMBs) it can save real time and cost. But the rules for AI in recruitment and selection are strict, especially under the General Data Protection Regulation (GDPR) and the EU AI Act.
This article explains what the GDPR already requires today and what the AI Act means for you, with a focus on what is practical for Dutch SMBs.
GDPR: the requirements that apply now
When you use AI to sort CVs, the GDPR sets specific requirements:
- Legal basis: you need a legal ground to process personal data, such as the applicant's consent or a legitimate interest.
- Duty to inform: as an employer you must tell applicants how and why their data is processed, including any use of AI.
- Human involvement: the GDPR restricts decisions based solely on automated processing. An AI system should never decide on applicants entirely on its own, without human review.
The AI Act: what it means for recruitment
The AI Act, whose obligations have been postponed to 2 December 2027, classifies AI used in recruitment as "high risk". That means strict requirements for transparency, safety and oversight.
SMBs should prepare early. Even though some detailed requirements are still being finalised, you can start by reviewing your current processes and systems.
Why this matters for SMBs
Falling short can lead to substantial fines and reputational damage. Applying AI correctly also does more than satisfy the law: it can make your hiring process more efficient and fairer.
Practical steps and support
- Start with a thorough review of your current recruitment and selection process.
- Make sure you fully understand how your AI systems work and that they meet GDPR requirements.
- Consider outside expertise to run a compliance scan, which can surface risks and areas to improve.
Our free compliance scan at AI Advies Bureau helps you identify these risks and guides you through the changes you need to make. See also our services.
Frequently asked questions
Can I use AI to screen CVs under the GDPR?
Yes, if you have a legal basis, inform applicants that AI is involved, and keep a human in the decision. A decision based solely on automated processing is restricted.
Is AI in recruitment high-risk under the EU AI Act?
Yes. The AI Act classifies AI used in recruitment and selection as high risk, with obligations for transparency, safety and oversight. Those obligations have been postponed to 2 December 2027.
How should an SMB prepare?
Map your current recruitment process, document which AI tools touch applicant data, check they meet GDPR requirements, and run a compliance scan to find gaps.