The compliance deadline you already missed
Every AI hiring conversation eventually arrives at the same line: "We need to be ready for the EU AI Act by December 2027." Which is true — but it's the wrong deadline to worry about first.
GDPR Article 22 has prohibited fully automated hiring decisions since May 2018. Not 2027. 2018. Any candidate screening that produces a legally significant outcome without genuine human review has been non-compliant for over six years.
In July 2026, the European Data Protection Supervisor and the European Data Protection Board made this explicit at a formal conference in Brussels, titled "Hired by an Algorithm." The message was unambiguous: the rule that matters most for automated hiring is not the upcoming AI Act enforcement. It's the one already on the books.
What "solely automated" actually means
Article 22 prohibits decisions "based solely on automated processing" that produce "legal effects" or "similarly significant effects" on a person. Rejecting a job application qualifies. Getting ranked off a shortlist qualifies.
The operative word is solely. A human reviewing the AI's recommendation — genuinely, not just clicking through — brings you outside the prohibition. But regulators have been clear that a rubber stamp doesn't count. A recruiter who never overrides the system, who has no access to the underlying criteria, who cannot explain why a candidate was ranked — that's not human oversight, that's human theater.
The EU AI Act, which reached full enforceability on August 2, 2026, adds another layer. AI tools used for CV screening, interview scoring, and candidate ranking are classified as high-risk under Annex III. They trigger documentation, risk management, and human oversight obligations. Fines reach €35 million or 7% of global annual turnover.
In September 2026, Spain's data protection authority intervened at the procurement stage — before a company's hiring AI tool even went live. The regulatory direction is clear: proactive, not reactive.
The compliance question that actually matters
For any company using AI in hiring, the right question isn't "Are we ready for 2027?" It's "Can we demonstrate, today, that a human with real authority made every advance-or-reject decision?"
That means three things:
- The human sees the full picture. Not just the AI score. The underlying data, the criteria, the reasoning. A recruiter who can only see a ranked list cannot exercise meaningful oversight.
- The human can actually say no. If the AI selects and the human approves, you have a workflow. If the human only ever confirms, you have a liability.
- You can document it. Regulators don't take your word for it. The audit trail has to show which human made which decision, when, and based on what.
This is not an abstract legal consideration. The EDPB has confirmed that many current implementations fail on point two: the system effectively decides, and the human signs off after the fact. That's the exposure.
How Umamy approaches this
The way Umamy is built reflects a deliberate choice: AI handles the intelligence work — sourcing, signal detection, scoring — but the hiring decision stays with a human, every time.
When Umamy surfaces a candidate, a recruiter or founder sees the full context: why this person was flagged, which signals triggered the recommendation, how the scorecard was applied. That's not a UX feature. It's the precondition for meaningful oversight.
The advance/reject decision is always a human action. Not a confirmation modal. Not a thumbs-up on a ranked list. A deliberate choice made by someone who has the authority to reverse it — and who can explain why they made it if asked.
This is also, practically, what makes AI-assisted hiring work better. The judgment that a candidate is a strong fit on paper but has context that changes the picture — a career gap that has a straightforward explanation, a role change that looks lateral but was a deliberate move — that judgment is human. The AI surfaces the candidate. The human decides.
What to check in your own workflow
If you use AI screening tools today, a fast audit:
- Does the recruiter see the underlying data, or just a score?
- Has any AI recommendation ever been overridden? If not, is that because the AI is perfect, or because there's no real mechanism to push back?
- Can you produce a log, for any rejected candidate, of who made the decision and when?
- Do your candidates know they're being screened by AI? (GDPR transparency obligation — already live.)
If those answers are uncomfortable, the December 2027 AI Act deadline is the least of your problems. The exposure is already there.
The architecture of trustworthy AI hiring
The companies that will navigate this cleanly aren't the ones that spent 2026 building compliance documentation. They're the ones that built workflows where human judgment was genuinely in the loop from the start — not bolted on afterward to satisfy an audit.
That's not a constraint on what AI can do in hiring. It's the design that makes AI hiring defensible, sustainable, and — frankly — better. A recruiter with good AI support, real authority, and full context makes better decisions than either AI alone or a recruiter drowning in manual screening.
The regulation is catching up to what good hiring practice already looks like. The question is whether your tooling supports it.
📅 Keep a human on every decision, without the manual work. Umamy's agents find and rank candidates with the Dynamic Fit Score, and every advance or reject stays a human action. See it on one of your open roles.
Talk to sales
