AEPD warning on using AI to screen CVs

Regulator guidanceAEPD CV-screening warning

Summary

A preventive measure addressed to a company planning to use AI to score and rank candidates. It imposes no fine, but sets the AEPD's position: whoever decides must be able to critically assess the score rather than simply accept it, and the company using the tool is accountable even if its group developed it.

Who it applies to

Companies using AI to select or evaluate candidates and employees in Spain.

Penalties

The rule has no penalty regime of its own, or it does not apply.

Official name: Advertencia AI-00009-2026 (expediente EXP202600427) de la Agencia Española de Protección de Datos sobre una herramienta de IA para el análisis de currículums
Official reference: Advertencia AI-00009-2026, art. 58.2.a RGPD; nota de prensa de la AEPD de 23 de septiembre de 2026
Regulator: Spanish Data Protection Agency (AEPD)
Official source: Check the sourceHow we verify sources

Key dates

September 23, 2026Warning published

Obligations and dates

Obligations table
Obligation	Article or citation	Status	Date	Who it applies to	Verification
Real human review and DPIA in AI-assisted hiring	Advertencia AEPD AI-00009-2026; RGPD, arts. 22, 25 y 35	Regulator guidance	Already applicable	If you use AI to read, score or rank CVs or evaluate candidates or employees.	Verified in the official source on November 2, 2026

Real human review and DPIA in AI-assisted hiring

Advertencia AEPD AI-00009-2026; RGPD, arts. 22, 25 y 35Regulator guidance

Already applicable

When it relates: If you use AI to read, score or rank CVs or evaluate candidates or employees.
What the rule provides: Apply data protection by design and assess risks to candidates and workers.
Carry out a DPIA before using the tool if processing may be high-risk.
Give clear information about the tool's role in the assessment.
Ensure the decision-maker can critically assess the score and make their own decision; simply accepting the output is not oversight.
Good practice: extend human review to candidates the tool rejects, not only those who pass the filter.
Typical evidence: DPIA of the hiring system.
Human review procedure including samples of rejected candidates.
Candidate notice.
Related base documents: Human Oversight Procedure for AI Systems
Data Protection Impact Assessment (DPIA) for AI
Supporting documents: Bias Audit Report (Impact Ratio)
Automated Decision Review Procedure
AI User Rights Notice
AI in Hiring Policy
Verification: Verified in the official source on November 2, 2026Checked against the AEPD's official press release. Correction: the research dated the warning Oct 7, 2026; the AEPD release is dated Sep 23, 2026. The release does not expressly mention rejected candidates: that point comes from commentators and is presented as good practice.