Can an algorithm reject a candidate? Automated decisions in recruitment

Short answer: Letting an algorithm reject a candidate entirely is in principle not allowed. Article 22 GDPR prohibits decisions based solely on automated processing that significantly affect the person — such as an automatic rejection — unless specific safeguards apply. The AI Act adds human oversight (Art. 14) and transparency for high-risk recruitment.

The GDPR rule: Article 22

An automatic rejection is a decision with significant effects. Article 22 GDPR permits such a fully automated decision only in limited cases (for instance with explicit consent or a legal basis), and always with safeguards. The person then has the right to:

• information that an automated decision was made and on what logic;
• human intervention — a genuine assessment by a person;
• the ability to express their point of view and to contest the decision.

"A human presses the button" is not enough: the human judgement must be meaningful, not a formality.

What the AI Act adds

Recruitment is high-risk (Annex III). The system must therefore be designed so a human can effectively assess and override the outcome (Art. 14), and candidates must know they are subject to such a system (Art. 26). The AI Act and the GDPR reinforce each other here: both require a meaningful human role.

What to do

• Don't make rejections fully automatic — build in a genuine human assessment before the decision is made.
• Inform candidates that (and how) AI is used.
• Offer a route for human review and objection.
• Document the logic and the human control.
• See also AI in recruitment and HR for the broader framework.

Automatic filtering is allowed — automatically deciding someone's chance of a job generally is not. The difference lies in the meaningful human assessment before the rejection.