Hiring by Machine: Screening, Scoring and Automated Interviews

Hiring is where most people first meet the AI boss, often before they know who the human boss will be. A job advertisement is shown to some people and not to others, an applicant-tracking system ranks the applications, an online test scores the shortlist, and a video-interview platform turns a recorded conversation into a number. Each step is easy to present as administrative help. Together they decide who gets access to work, which is why this chapter treats hiring as M3 Consequence. The ranking and scoring along the way are M2 Evaluation, applied to people who are not yet employees and who often do not know that a system read their application. The chapter describes the automated funnel, its documented failures, the record of the human recruiters it replaces, the limits of audits, what the AI Act requires and prohibits, and what co-determination over selection guidelines means for a screening model. It ends with the question every employer must answer: how a recruiter keeps the decision and the record, rather than signing a ranking.

Figure 7.1: The hiring funnel with the management function and degree of delegation at each stage, the records the recruiter keeps, and the prohibited affect-analysis stage removed.

The automated funnel

A hiring process has five stages, and AI now appears in all of them. The first is reach: targeted advertising selects who sees the vacancy, and a person who never sees it never applies. The second is sourcing and screening: tools that search profile databases, and applicant-tracking modules that parse a CV, compare it with the requirements and produce a ranking or a category such as "strong match". The third is assessment: ability tests, situational judgement, personality questionnaires and game-based exercises, some scored by models trained on past employees. The fourth is the interview, increasingly a one-way recording that a system transcribes and scores, and in some products has also analysed voice and face. The fifth is the decision, often communicated by a chatbot that also schedules appointments.

The AI Act names this funnel in its own words. Annex III, point 4(a), lists as high-risk "AI systems intended to be used for the recruitment or selection of natural persons, in particular to place targeted job advertisements, to analyse and filter job applications, and to evaluate candidates" (1, European Union, 2024). The Commission's draft guidelines on high-risk classification, published for consultation in May 2026, read the point functionally: recruitment covers early-stage prospecting, placement of targeted advertisements and identification of candidates in databases, and selection covers "the analysis of applications, automated shortlisting, scoring, ranking, or assigning predictive scores of job suitability" (3, European Commission, 2026). The draft calls recruitment "the principal entry point into the labour market".

The functions blur along the funnel. Ranking a CV is evaluation; but where recruiters read only the top fifty of eight hundred applications, the ranking has settled the fate of the other seven hundred and fifty. The delegation profile may say Level 1 Assisted while practice is closer to Level 4 Autonomous for the applicants nobody reads. Delegation is set by use, not by the configuration screen, and the book's rule that Level 4 Autonomous is never used for M3 Consequence applies with special force, because a rejected applicant rarely has any way to know that no person looked.

What went wrong, documented

Four cases have shaped the public understanding of hiring by machine. They differ in technique and in how much is established, and are described here by what was reported or decided.

The first is Amazon's experimental recruiting tool. In October 2018 Reuters reported that a team at Amazon had built models to rate applicants' CVs, trained on CVs submitted to the company over a ten-year period, most of them from men. According to the team members Reuters spoke to, the system learned to penalise CVs that contained the word "women's", as in "women's chess club captain", and downgraded graduates of two all-women's colleges; the project was scrapped, and recruiters had looked at its recommendations without relying on them solely (186, Dastin, 2018). An Amazon spokesperson told The Verge that the tool "was never used by Amazon recruiters to evaluate candidates" (215, Vincent, 2018). The case has since served legal scholarship as a paradigmatic example of proxy discrimination (216, Adams-Prassl et al., 2023). It remains a report based on unnamed sources, not a judgment; its lesson is the mechanism: a model trained to predict who was hired before learns the pattern of who was hired before.

The second is iTutorGroup. The US Equal Employment Opportunity Commission alleged that the company had programmed its tutor-application software to reject automatically female applicants aged 55 or older and male applicants aged 60 or older, and that more than 200 qualified applicants in the United States had been rejected because of their age. The company settled in 2023, paying $365,000 to applicants who had been rejected (201, U.S. Equal Employment Opportunity Commission, 2023). No machine learning was involved. The case shows the simplest form of the problem: a hard-coded rule that rejects people without any recruiter reading the application.

The third is the complaint against HireVue. In November 2019 the Electronic Privacy Information Center asked the US Federal Trade Commission to investigate the video-interview provider, quoting the company's own statements that it collected "tens of thousands of data points" from each interview, including "intonation", "inflection" and "emotions", and that 10 to 30 per cent of a candidate's score was based on facial expressions; EPIC also noted that candidates had no access to their scores or to the logic behind them (188, Electronic Privacy Information Center, 2019). In January 2021 HireVue announced that it was dropping facial analysis, citing an external algorithmic audit and acknowledging that public concern had been part of the calculation, while continuing to use speech and intonation (193, Knight, 2021). No finding against the company was reported. The feature it removed is close to what the AI Act later prohibited.

The fourth is Mobley v. Workday, in which the supplier of a screening system, not an employer, is the defendant. Derek Mobley alleges that Workday's AI-based applicant recommendation system discriminated by race, age and disability; he and four other plaintiffs over forty say they were rejected for hundreds of jobs, almost always without an interview. On 16 May 2025 the federal court in Northern California preliminarily certified a nationwide collective of applicants aged forty and over under the Age Discrimination in Employment Act, holding that the alleged "unified policy", the use of Workday's recommendation system "to score, sort, rank, or screen applicants", raised a question susceptible to common proof "regardless of the degree to which particular employers place weight on those recommendations" (73, United States District Court for the Northern District of California, 2025). The order decides nothing about whether discrimination occurred. But the sentence about weight deserves a second reading in Europe: if a screening system shapes who reaches a person, the question of its effect does not go away because a human formally made the last decision.

The four cases show three failures: a model that learned a historical pattern (Amazon), a rule that encoded an unlawful one (iTutorGroup), and products alleged to infer more than they could justify and to tell candidates less than they could ask (HireVue, and the allegations in Mobley). AI Threat, Chapter 12, set these within the wider evidence on discrimination by automated judgement (44, Nordqvist, 2026).

Human discretion as the baseline

The alternative to a screening model is not a fair process; it is a human recruiter, with a documented record of its own.

Bertrand and Mullainathan sent fictitious CVs to employers advertising in Boston and Chicago newspapers, randomly assigning names that sounded African-American or white. CVs with white-sounding names received 50 per cent more callbacks for interviews, and callbacks were also more responsive to CV quality for white names than for African-American ones; the gap was uniform across occupation, industry and employer size (156, Bertrand & Mullainathan, 2004). The study measured the callback, the first gate of hiring, in two American cities. It showed that unaided human screening can discriminate at scale, invisibly and without any record of why.

Hoffman, Kahn and Li studied the introduction of job testing across 15 firms employing low-skilled service-sector workers. Managers who appeared to hire against the test's recommendations ended up with worse hires, measured by how long those hired stayed. The authors concluded that managers often overruled the test because they were biased or mistaken, not only because they had better information (163, Hoffman et al., 2018). The finding is specific to one kind of test, one outcome and one segment of the labour market. It does not show that algorithms hire better in general; it shows that unconstrained discretion is not a neutral benchmark.

Cowgill's model explains when a system trained on past human decisions can be less biased than they were. Algorithms can remove human biases present in historical training data, but only if the human decisions were sufficiently noisy, so that the data contain something like natural experiments; where past decisions were consistent, the algorithms "will codify or exacerbate existing biases", and the conditions for removing bias entirely are "extreme and unlikely to appear in real datasets" (171, Cowgill, 2019). A screening model trained on a company's past hires inherits that past, and whether it improves on the recruiters depends on properties of the data that the supplier should document.

The fair conclusion is uncomfortable for both sides of the debate that Chapter 12 stages in full. Human hiring is biased, and the bias is hard to see. Automated hiring can be biased too, and the bias is replicated across every employer that buys the product. The automated process can at least be measured, but only if the deployer keeps the records and can see what the supplier has done.

Audits and their limits

Suppliers answer the question of bias with audits. Raghavan, Barocas, Kleinberg and Levy examined the public claims of 18 vendors of algorithmic pre-employment assessments. Websites generally did not make clear whether or how models were validated; only seven vendors explicitly discussed adverse impact, and those making concrete claims all focused on the US "4/5 rule", under which a group's selection rate below four-fifths of the highest group's indicates possible adverse impact (172, Raghavan et al., 2020). De-biasing of this kind, typically removing features correlated with protected attributes until the ratio passes, can satisfy a threshold while leaving open whether the assessment measures anything related to the job.

Sánchez-Monedero, Dencik and Edwards examined three systems in use in the United Kingdom, HireVue, Pymetrics and Applied, and found that the two US-originated systems were built around the four-fifths rule, while UK equality law, "itself heavily permeated by EU law", has no such statistical threshold and turns on individual assessments of proportionality and justification (173, Sánchez-Monedero et al., 2020). They added that a solely automated hiring decision is close to the canonical case for GDPR Article 22; recital 71 gives "e-recruiting practices without any human intervention" as an example of the decisions Article 22 is about (5, European Union, 2016). For a European deployer, a supplier's adverse-impact report is a starting point, not evidence of compliance with Council Directive 2000/78/EC, which applies to "selection criteria and recruitment conditions" in both the public and private sectors (Article 3(1)(a)) and shifts the burden of proof to the respondent once facts from which discrimination may be presumed are established (Article 10) (54, Council of the European Union, 2000).

New York City's Local Law 144 is the best-known attempt to make audits mandatory. Employers using an automated employment decision tool in hiring or promotion in the city must have it audited for bias by an independent auditor no more than one year before use, publish a summary, and notify applicants at least ten business days before use; the audits cover sex and race or ethnicity categories and their intersections. The law has been enforced since 5 July 2023 (81, New York City Department of Consumer and Worker Protection, 2021). It does not require an employer to stop using a tool an audit shows to be biased, and it applies only where the employer itself determines that it uses a covered tool.

The New York State Comptroller's audit of enforcement, published in December 2025, showed what that design leaves out. The city department received two complaints during the audit period; nine of the auditors' twelve test calls to the city's 311 line did not reach it. The department had surveyed the websites and bias audits of 32 companies and found one issue of non-compliance; the Comptroller's auditors reviewed the same companies and found at least 17 instances of potential non-compliance, and noted that the department lacked the technical expertise to evaluate the tools (214, Office of the New York State Comptroller, 2025). The report does not show that the tools were biased; it shows that a transparency obligation without a capable supervisor and a working complaint route produces documents rather than scrutiny.

Three limits follow. An audit measures outcomes for groups, not the treatment of the individual who was rejected. It measures the tool on the auditor's data, not as a particular employer configured it last month. And it says nothing about whether anyone read the applications ranked low. The European answer moves the weight from the supplier's audit to the deployer's duties and the applicant's rights.

Annex III point 4(a)

Classification under Annex III, point 4(a), makes a recruitment or selection system a high-risk AI system unless the provider documents that it falls under the narrow derogation of Article 6(3). That derogation is unavailable for most screening tools, because Article 6(3) states that an AI system referred to in Annex III "shall always be considered to be high-risk where the AI system performs profiling of natural persons" (1, European Union, 2024), and ranking applicants by predicted suitability is profiling. The Commission's draft guidelines draw the boundary at a system that only drafts a job description from qualifications a recruiter has already defined; one that generates the qualifications or evaluates CVs against them is high-risk (3, European Commission, 2026). Recital 57 gives the reason: such systems "may perpetuate historical patterns of discrimination" (1, European Union, 2024).

The provider carries the heavier duties, but the employer is a deployer, and Article 26 gives it duties that cannot be bought from the supplier. It must use the system according to its instructions (Article 26(1)); assign human oversight "to natural persons who have the necessary competence, training and authority, as well as the necessary support" (Article 26(2)); ensure that input data under its control are relevant and sufficiently representative (Article 26(4)); monitor operation and suspend use where the system presents a risk (Article 26(5)); keep the logs under its control for at least six months (Article 26(6)); inform workers' representatives and affected workers before putting a high-risk system into service at the workplace (Article 26(7)); and inform the people about whom the system makes or assists decisions (Article 26(11)) (1, European Union, 2024). Article 14(4) requires that overseers be enabled to remain aware of automation bias and to "disregard, override or reverse" the output. A public body such as Nordvik Region must also carry out a fundamental rights impact assessment under Article 27.

Two provisions give the applicant a direct claim. Article 86 gives a person adversely and significantly affected by a decision based on the output of an Annex III high-risk system the right to obtain "clear and meaningful explanations of the role of the AI system in the decision-making procedure and the main elements of the decision taken" (1, European Union, 2024). GDPR Article 22 gives the right not to be subject to a decision based solely on automated processing with legal or similarly significant effects and, where an exception applies, at least the right to human intervention and to contest (5, European Union, 2016). Article 88 leaves member states room for more specific rules on employee data, so Hansa Mutual's entities do not process applicant data under identical national rules.

Timing has moved. The Digital Omnibus on AI, Regulation (EU) 2026/1744, set the application of the high-risk requirements in Chapter III, Sections 1 to 3, at 2 December 2027 for systems classified as high-risk under Article 6(2) and Annex III; it left the prohibitions of Chapter II, applicable since 2 February 2025, in place. It also amended the transitional rule of Article 111(2): high-risk systems placed on the market or put into service before the date of application fall under the regulation only if their design changes significantly thereafter, but providers and deployers of high-risk systems intended for use by public authorities must comply by 2 August 2030 (2, European Union, 2026). In November 2026, then, the prohibition on emotion recognition in recruitment is observable law, the high-risk obligations for hiring systems are expected from December 2027, and a deployer relying on the transitional rule must show that its supplier's frequent releases are not significant changes. AI Governance, Chapter 8, concluded that classification is triggered by change, not by the calendar (F16) (41, Nordqvist, 2026); for a hiring service updated monthly, the transitional rule is a poor foundation for planning.

No emotion recognition

Article 5(1)(f) of the AI Act prohibits the placing on the market, putting into service for this specific purpose, or use of "AI systems to infer emotions of a natural person in the areas of workplace and education institutions, except where the use of the AI system is intended to be put in place or into the market for medical or safety reasons" (1, European Union, 2024). Recital 44 gives the reasons: "serious concerns about the scientific basis" of emotion recognition, whose key shortcomings are "limited reliability, the lack of specificity and the limited generalisability", combined with the imbalance of power at work.

The Commission's guidelines on prohibited practices settle the hiring question: "workplace" is interpreted broadly and "should also be understood to apply to candidates during the selection and hiring process", because "the imbalance of powers and the intrusive nature of emotion recognition may already apply at the recruitment stage", and "using emotion recognition AI systems during the recruitment process is prohibited" (58, European Commission, 2025). The prohibition attaches to emotion recognition systems as the AI Act defines them, systems that infer emotions or intentions "on the basis of their biometric data" (Article 3(39)). Inferring emotions from facial expressions, posture, keystrokes or voice is therefore within the prohibition; sentiment analysis of written text is not.

For a video-interview product the implication is precise. Analysing facial expression, tone of voice or vocal stress to infer enthusiasm, nervousness, honesty or any other emotional state or intention is prohibited in recruitment in the European Union, and has been since 2 February 2025. Scoring the content of a transcript against structured criteria is not emotion recognition, but it remains the evaluation of candidates under Annex III, point 4(a), with all the duties of a high-risk system. A deployer should therefore record the switch that disables the affect module, verify with the supplier that no biometric features enter any score, and check after every release that the setting has not changed. The HireVue case is the precedent: facial analysis was removed while intonation stayed (193, Knight, 2021), and in Europe intonation analysed to infer emotional states is on the prohibited side of the line.

Selection guidelines and co-determination

Europe's older answer to hiring discretion is in labour law. In Germany, the Works Constitution Act (BetrVG) gives the works council a right of consent over personnel questionnaires and general assessment principles (§ 94) and over guidelines for the selection of personnel in hiring, transfers, regrouping and dismissals (§ 95(1)); in establishments with more than 500 employees the works council can demand such guidelines (§ 95(2)). Since the Works Council Modernisation Act of 2021, § 95(2a) states that these rights apply "also where artificial intelligence is used in drawing up the guidelines", and § 80(3) treats the involvement of an expert as necessary where the works council must assess the introduction or application of AI (9, Germany, 2001) (207, Germany, 2021). A guideline agreed under § 95 has teeth in individual cases: under § 99(2) no. 2 the works council may refuse consent to a hire that breaches it. Where a screening system is also suited to monitor employees' behaviour or performance, § 87(1) no. 6 applies in addition.

The architectural consequence is that a screening model's configuration is, in substance, a selection guideline. The criteria it scores, their weights, the knock-out questions, the threshold below which nobody reads and the excluded features are the "professional and personal requirements" a § 95 guideline sets out. Treated as a vendor setting, it escapes co-determination; treated as the guideline, versioned and changed only by agreement, it keeps the works council's right intact and gives the employer a document it can show a court or an applicant.

Nordic co-determination reaches the same point by another route. Under the Swedish model on which Nordvik Region's co-determination act is patterned, the employer must negotiate on its own initiative with the unions with which it has collective agreements before deciding on an important change in its activity or in conditions of work (MBL § 11), must negotiate on other questions when a union asks (§ 12), and must keep the unions informed of the guidelines for its personnel policy (§ 19) (205, Sveriges riksdag, 1976). There is no consent right over selection criteria, but there is a duty to negotiate before introducing a system that changes how people are selected, and a duty to inform that a union can use to ask how it works. That is what happened at Nordvik.

What a works council or union needs to see is the same in both systems: the intended purpose and the stages at which the system acts; the criteria and features used and excluded; the source and period of the training data, and whether the employer's own past decisions were used; validation evidence, including outcomes by sex, age and other protected characteristics; the knock-out rules and thresholds that define the degree of delegation; the logs and who may read them; how applicants are informed and obtain an explanation; and how a change of model is notified. The worked example below codifies that list.

Worked example: the delegation profile DLG-HM-REC-01 for TalentLens

Illustrative. Hansa Mutual uses TalentLens, the screening and video-interview module of its group applicant-tracking system, in Poland for service-centre roles and in Germany for graduate and apprentice hiring. The profile sets M2 Evaluation and M3 Consequence at Level 1 Assisted, records the affect and voice analysis as switched off group-wide, and makes the selection criteria a referenced document rather than a vendor setting. The entry sits in management/delegation-register.yaml, the delegation register that Chapter 25 describes in full.

id: DLG-HM-REC-01
system: TalentLens
version: 1.3
owner: Group chief HR officer
operator: Group HR, recruitment
usage_mode: Mode 4 Built AI applications
ai_act:
  role: deployer
  classification: high-risk, Annex III point 4(a)
  prohibited_features_disabled:
    - feature: affect and voice analysis in video interviews
      basis: AI Act Article 5(1)(f); Commission guidelines, paragraph 254
      scope: group-wide, all entities including UK and Switzerland
      verified_after_each_release: true
markets: [PL, DE]
uses: [service-centre roles PL, graduate hiring DE, apprentice hiring DE]
functions:
  M2_Evaluation:
    level: Level 1 Assisted
    scope: CV ranking against published job requirements; transcript scoring of structured interviews
  M3_Consequence:
    level: Level 1 Assisted
    decider: named recruiter per vacancy, recorded in the hiring MDR
    forbidden:
      - rejection of any applicant without a recruiter decision
      - knock-out rules other than legal eligibility to work and stated mandatory licences
      - rejection message sent before the recruiter has signed the decision
conditions:
  read_below_cut: recruiter reads at least 20 per cent of applications ranked below the shortlist
  blind_review: monthly sample of 50 rejected applications re-assessed without the ranking
  outcome_monitoring: quarterly selection rates by sex and age band per stage and market
  logs_retained_months: 12
  applicant_information: notice in the application form; explanation on request within 30 days
selection_criteria:
  document: HR-REC-CRIT-2026-01
  de_status: requested as a BetrVG section 95 guideline by the Konzernbetriebsrat on 2026-10-12; negotiation open
  pl_status: consulted with the company trade union organisation and the employee council
  works_agreement: KBV-IT-2024
review:
  triggers: [new model version, change of criteria, outcome alert, complaint, regulatory change]
  next_scheduled: 2027-03-31
reversibility_test: manual screening procedure exercised once a year per market

Three fields carry the weight. forbidden turns the rule that Level 4 Autonomous is never used for M3 Consequence into conditions a reviewer can test against the logs. read_below_cut and blind_review make Level 1 Assisted true in practice, because people outside the shortlist are seen by a person. And selection_criteria points to a document whose German version is about to become co-determined. The defaults are illustrative and should be agreed with the works council and adapted to volume.

Keeping the decision with the recruiter

The chapter inherits open question Q2: who is accountable for a consequence decision that an AI recommended and a manager accepted without reading it. In hiring it is sharper, because most consequence decisions are rejections and most are never explained. The Transformed Security Architect, Chapter 14, concluded that verifying what AI proposes requires review that does not start from the AI's answer, because automation bias is documented and must be designed against (F76) (46, Nordqvist, 2026). A recruiter facing four hundred ranked applications is that reviewer.

Four practices keep the decision with the recruiter. The first is to treat the ranking as advice in how the work is organised, not only in the policy: the ranking is one column among several, not the order in which the list is presented. The second is to read below the cut: a defined share of the applications ranked low is read before any rejection is sent, so that a systematic error has a chance to be seen. The third is independent review of the rejected: a monthly sample is re-assessed by a second recruiter who does not see the ranking, the agreement rate is reported, and disagreements go to the owner of the selection criteria. The fourth is the record. Every hiring decision is a Management Decision Record, the sibling of the Architecture Decision Record and the AI Decision Record that Chapter 25 introduces in full: short, numbered, immutable, naming the decider, stating what the system contributed and what the decider weighed, and readable by the applicant on request. AI Platform and Security, Chapter 5, set the discipline for AI Decision Records, short and numbered and re-opened by evidence (F38) (42, Nordqvist, 2026); the hiring MDR applies it to a decision about a person.

The record also answers Q3, how such a decision is shown to the person, a works council, a court and a supervisor. An applicant who asks under Article 86 receives the main elements of the decision and the system's role, drawn from the MDR; a works council receives the criteria version cited; a court applying the burden-of-proof rule of Directive 2000/78 receives the reasons at the time, not a reconstruction. For a public authority, AI Governance, Chapter 17, concluded that the line between decision support and automated decision must be drawn in the data model and the audit log, with a reasons log for every case (F31) (41, Nordqvist, 2026); in hiring, the MDR is that reasons log. And because Article 26(2) requires competent oversight, recruiters need role-specific AI literacy evidenced in competence records (F25; AI Governance, Chapter 14).

Worked example: a hiring Management Decision Record

Illustrative. A recruiter at Hansa Mutual's Polish service centre decides the shortlist for a claims-handler vacancy. The record names her by role identifier, cites the criteria version and the profile, and states where she departed from the ranking.

id: MDR-HM-0070
date: 2027-02-15
function: M3 Consequence
decision: shortlist for interview, vacancy PL-CLM-2026-118, claims handler, service centre
decider: HR-PL-REC-014, recruiter
delegation_profile: DLG-HM-REC-01
level_used: Level 1 Assisted
criteria: HR-REC-CRIT-2026-01
system_contribution: TalentLens ranking of 212 applications against published requirements
human_review:
  read_in_full: 64
  read_below_cut: 45
  departures_from_ranking:
    - applicant ranked 131 shortlisted; insurance experience in a non-standard job title not matched by the ranking
    - applicant ranked 9 not shortlisted; mandatory language level not met on review
shortlisted: 12
rejection_notices_released_after_signature: true
explanation_available_on_request: true
contestation_route: HR-PL appeals mailbox, response within 30 days

Practical guide: Introducing, pausing or retiring a screening model with a record a candidate, a union and a supervisor can read

Purpose. Introduce, pause or retire a screening, assessment or interview-scoring model so that every hiring decision stays with a named person and leaves a record an applicant, a union or works council and a supervisory authority can read.

Roles. The HR director or chief HR officer (owner and decider), the recruitment lead (operator), the works council or unions, the data protection officer, the AI governance lead, the procurement owner of the supplier contract, and the applicants, through the notice and the explanation route.

Steps.

1. Classify and record. Record the classification under Annex III, point 4(a), obtain the supplier's written confirmation that no biometric inference of emotion or intention is active, and open an AI Decision Record with a named owner.
2. Obtain the supplier's evidence. Before signing or renewing, require the intended purpose, instructions for use, criteria and features, training-data source and period, validation evidence by protected characteristics, and the notification route for new model versions. A supplier that cannot provide them has given the first reason to pause.
3. Write the criteria as a guideline. Turn the configuration into a versioned criteria document: under BetrVG § 95 in Germany, by negotiation before the decision in a Nordic organisation, by the national consultation route elsewhere. Do not go live before informing the representatives under AI Act Article 26(7).
4. Set the delegation profile. Record M2 Evaluation and M3 Consequence at Level 1 Assisted or lower, forbid automatic rejection, and set the read-below-cut share, the blind-review sample and the monitoring interval. Start with 20 per cent, 50 applications a month and quarterly figures, adapted to volume in agreement with the representatives.
5. Inform applicants. State in the advertisement or form that a high-risk AI system assists the selection (Article 26(11)), that a recruiter decides, and how to obtain an explanation or contest. Answer within 30 days unless national law sets a shorter period.
6. Run a shadow period. For the first vacancies, let recruiters decide without the ranking and compare. AI Platform and Security, Chapter 20, concluded that deployers test the compound system themselves (F44) (42, Nordqvist, 2026).
7. Monitor and record. Keep logs for at least six months, longer while a claim can arise; write an MDR for every shortlist and final decision; report selection rates by stage quarterly to the owner and the representatives.
8. Pause on a defined trigger. Pause, as Article 26(5) foresees for a system presenting a risk, when the supplier cannot explain the ranking to those who ask, when blind review and ranking diverge beyond the agreed threshold, when outcomes show a selection-rate ratio the owner cannot justify, or when a release changes the model without notice. Record the pause as an AI Decision Record, fall back to the manual procedure and review the decisions taken meanwhile.
9. Retire with a record. Record why, preserve logs and MDRs for the retention period, inform the representatives and remove the entry from the transparency register of Chapter 28.

Definition of done. Every live screening system has a delegation profile, an agreed or negotiated criteria document, an applicant notice, a working explanation route, a quarterly outcome report and a tested manual fallback; every hiring decision has an MDR naming a person; every pause and retirement has an AI Decision Record an outsider can read.

Worked example: Nordvik's pause record AIDR-0601

Illustrative. Nordvik Region piloted the screening module of its applicant-tracking system for assistant-nurse and care-assistant vacancies in spring 2026 and paused it in September. The record states what the union asked, what the supplier could and could not answer, and on what conditions the module may return. The pause came first and prompted the HR director's commission of 16 November 2026; the commission carries the first number of the range, AIDR-0600, because every record of the programme, this earlier pause included, is filed under it (Chapter 30).

id: AIDR-0601
title: Pause of the recruitment-screening pilot in the applicant-tracking system
date: 2026-09-18
status: accepted
filed_under: AIDR-0600          # the later commission of 2026-11-16
decider: Ingrid Halvorsen, HR director
system: screening module of the applicant-tracking system
classification: high-risk, AI Act Annex III point 4(a); deployer only
pilot:
  period: 2026-03-02 to 2026-09-18
  vacancies: assistant nurse and care assistant, home care and hospital wards
  delegation: M3 Consequence at Level 1 Assisted
trigger: questions from the union for municipal and care workers, 2026-08-27
questions_asked:
  - Which criteria and weights produce the ranking?
  - Was the model trained on the Region's own past hiring decisions or on other employers' data?
  - How are applicants with foreign qualifications, career breaks or part-time histories ranked?
  - Were applications below the shortlist read by a person before rejection?
  - Can an applicant be told why the application was ranked low?
supplier_answers:
  criteria_and_weights: not disclosed; described as proprietary
  training_data: general data from several customers; period not stated
  outcomes_by_group: no data provided for the Region's applicants
decision: pause the module; recruit by the manual procedure in the meantime
reasons:
  - The Region cannot meet AI Act Article 86 or its national duty to give reasons for a ranking it cannot explain
  - Oversight under Article 26(2) is not possible without knowing what is overseen
follow_up:
  - Review by a recruiter of applications ranked below the shortlist during the pilot, report by 2026-12-15
  - Negotiation with the unions before any reintroduction, under the co-determination act
conditions_for_return:
  - Supplier documentation of criteria, features, training data and validation
  - Delegation profile with read-below-cut and blind review, agreed in negotiation
  - Fundamental rights impact assessment under AI Act Article 27
reviewers: [AI governance lead, data protection officer, chair of the central work-environment committee]

The pause is worth recording because it is easy not to. The Region did not find discrimination; it found that it could not explain a high-risk system it had deployed, and stopped. AI Threat, Chapter 26, concluded that a delegation register should show what has been delegated and that reversibility tests should check that each delegation can be undone (F69) (44, Nordqvist, 2026). AIDR-0601 is that test passed in practice: the manual procedure still existed, and the recruiters still knew how to use it.

Across the usage modes

Usage mode	How it appears in hiring	Typical degree of delegation in M3 Consequence	What to watch
Mode 0 Ambient AI	Ranking and "match" scores built into job boards and the applicant-tracking suite	Level 1 Assisted, often unrecorded	Features switched on by a supplier release without a decision
Mode 1 Conversational assistants	Recruiters drafting advertisements or summarising CVs in a general assistant	Level 0 Advisory	Summaries that silently filter; applicant data in unapproved tools
Mode 2 Embedded workplace assistants	Interview notes and candidate comparisons drafted in the office suite	Level 0 Advisory	Drafted comparisons that become the record
Mode 3 Agentic work tools	Sourcing agents that search profiles and contact candidates	Level 1 Assisted for outreach	Who is never contacted, and why
Mode 4 Built AI applications	Procured screening, assessment and interview-scoring systems such as TalentLens	Level 1 Assisted	Read-below-cut and blind review that keep Level 1 true
Mode 5 Autonomous production agents	Agents that screen, schedule and reject end to end	Level 4 Autonomous if no recruiter decides: excluded	Rejections released without a signed decision

Automated screening, the documented cases and the AI Act's classification of hiring systems are observable. The application of the high-risk obligations to hiring systems from 2 December 2027 is expected, as decided by the Digital Omnibus. Agentic sourcing and interviewing at scale, pushing hiring towards Mode 5, are expected; that they would produce fairer hires than structured human interviews is speculation, since this chapter found no study measuring it over the tenure of the people hired.

Nordvik Region and Hansa Mutual

The two organisations reach the same principle from opposite positions. Nordvik Region had one M3 Consequence system and paused it. The union for municipal and care workers asked how the ranking was made, the supplier could not show it, and the HR director, Ingrid Halvorsen, concluded that a public authority with a duty to give reasons cannot deploy a ranking it cannot explain (AIDR-0601). Recruiters went back to the manual procedure, which still existed. Before any reintroduction the Region will ask whether the supplier documents criteria and training data and whether the unions will agree a profile that keeps people below the shortlist in view. Its constraint is procurement: it can demand documentation only in the next tender.

Hansa Mutual uses TalentLens in Poland and Germany at Level 1 Assisted under DLG-HM-REC-01, with the affect and voice analysis switched off group-wide, including in the UK and Swiss entities outside the AI Act, because the group would rather run one configuration than defend two. KBV-IT-2024 covers the system, but Thomas Brandt, chair of the Konzernbetriebsrat, has asked for the selection criteria as a guideline under BetrVG § 95, with the expert support § 80(3) provides. Once agreed, a change of criteria needs the works council's consent, and a hire that breaches the guideline can be refused under § 99. In Poland the same document is consulted with the company trade union organisation and the employee council. Hansa's risk is the opposite of Nordvik's: not a system it cannot explain, but one used long enough for Level 1 to drift in busy seasons, which the read-below-cut condition and the blind review exist to detect. Chapter 26 shows that drift found in the Polish service centre in the first quarter of 2027, and the stricter reading rule that answered it in version 1.5 of the profile: every application that meets the mandatory requirements is opened before it is rejected.

Summary

Hiring is where most people first meet the AI boss, and the decision it shapes, access to work, is M3 Consequence. The ranking, testing and interview scoring along the way are M2 Evaluation of people who are not yet employees and rarely know that a system read their application. The AI Act lists the whole funnel as high-risk in Annex III, point 4(a), and the profiling performed by ranking tools keeps them out of the Article 6(3) derogation.

The documented cases show a model that learned the employer's past, a rule that encoded age discrimination, and products alleged to infer more than they could justify and explain less than candidates could ask. Human recruiters discriminate too, and overriding structured tests has costs. Audits measure groups, not individuals, and New York City's experience shows that a published audit without a capable supervisor is a document, not scrutiny. The prohibition on emotion recognition has applied to recruitment since February 2025; the high-risk duties of deployers are expected from December 2027.

The chapter's conclusion is the book's thesis applied to hiring. A screening model's configuration is a selection guideline and belongs with the works council or the unions. Level 1 Assisted must be made true in practice by reading below the cut and blind review of the rejected. No applicant is rejected without a named recruiter's decision, recorded in a Management Decision Record that the applicant, the representatives and a supervisor can read. And an employer that cannot explain a system it deploys should stop and record why, as Nordvik Region did.

Chapter 8 follows the AI boss past the hiring decision, to the performance scores and productivity metrics that evaluate people once they are employed, and to the point at which M2 Evaluation becomes M3 Consequence through a pay input, a warning or a dismissal.

Sources

1. European Parliament and Council of the European Union (2024). Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). Official Journal of the European Union. (1, European Union, 2024)
2. European Parliament and Council of the European Union (2026). Regulation (EU) 2026/1744 amending Regulations (EU) 2024/1689, (EU) 2018/1139 and (EU) 2023/1230 as regards the simplification of the implementation of harmonised rules on artificial intelligence (Digital Omnibus on AI). Official Journal of the European Union. (2, European Union, 2026)
3. European Commission (2026). Draft Commission guidelines on the classification of high-risk AI systems. Shaping Europe's digital future. (3, European Commission, 2026)
4. European Parliament and Council of the European Union (2016). Regulation (EU) 2016/679 (General Data Protection Regulation). Official Journal of the European Union. (5, European Union, 2016)
5. Federal Republic of Germany (2001). Betriebsverfassungsgesetz (BetrVG) (Works Constitution Act), as amended. Gesetze im Internet. (9, Germany, 2001)
6. Nordqvist, G. (2026). AI Governance: Governing Artificial Intelligence in European Enterprises and Public Authorities. The Architecture as Code Series, Book 2. (41, Nordqvist, 2026)
7. Nordqvist, G. (2026). AI Platform and Security: Building and Securing AI Platforms in European Enterprises and Public Authorities. The Architecture as Code Series, Book 3. (42, Nordqvist, 2026)
8. Nordqvist, G. (2026). AI Threat: Are the Dystopias Coming True? Evidence, Risk and Response for European Enterprises and Public Authorities. The Architecture as Code Series, Book 5. (44, Nordqvist, 2026)
9. Nordqvist, G. (2026). The Transformed Security Architect: Role, Craft and Career in the Age of AI in European Enterprises and Public Authorities. The Architecture as Code Series, Book 6. (46, Nordqvist, 2026)
10. Council of the European Union (2000). Council Directive 2000/78/EC establishing a general framework for equal treatment in employment and occupation. Official Journal of the European Communities. (54, Council of the European Union, 2000)
11. European Commission (2025). Commission Guidelines on prohibited artificial intelligence practices established by Regulation (EU) 2024/1689 (AI Act). (58, European Commission, 2025)
12. United States District Court for the Northern District of California (2025). Mobley v. Workday, Inc., No. 3:23-cv-00770-RFL, Order Granting Preliminary Collective Certification, 16 May 2025. Civil Rights Litigation Clearinghouse. (73, United States District Court for the Northern District of California, 2025)
13. New York City Department of Consumer and Worker Protection. Automated Employment Decision Tools (AEDT). NYC.gov. (81, New York City Department of Consumer and Worker Protection, 2021)
14. Bertrand, M. & Mullainathan, S. (2004). Are Emily and Greg More Employable Than Lakisha and Jamal? A Field Experiment on Labor Market Discrimination. American Economic Review, 94(4). (156, Bertrand & Mullainathan, 2004)
15. Hoffman, M., Kahn, L. B. & Li, D. (2018). Discretion in Hiring. The Quarterly Journal of Economics, 133(2). (163, Hoffman et al., 2018)
16. Cowgill, B. (2019). Bias and Productivity in Humans and Machines. Upjohn Institute Working Paper 19-309. (171, Cowgill, 2019)
17. Raghavan, M., Barocas, S., Kleinberg, J. & Levy, K. (2020). Mitigating bias in algorithmic hiring: evaluating claims and practices. Proceedings of FAT* 2020. (172, Raghavan et al., 2020)
18. Sánchez-Monedero, J., Dencik, L. & Edwards, L. (2020). What does it mean to 'solve' the problem of discrimination in hiring? Social, technical and legal perspectives from the UK on automated hiring systems. Proceedings of FAT* 2020. (173, Sánchez-Monedero et al., 2020)
19. Dastin, J. (2018). Amazon scraps secret AI recruiting tool that showed bias against women. Reuters. (186, Dastin, 2018)
20. Electronic Privacy Information Center (2019). In re HireVue (complaint to the US Federal Trade Commission). EPIC. (188, Electronic Privacy Information Center, 2019)
21. Knight, W. (2021). Job Screening Service Halts Facial Analysis of Applicants. Wired. (193, Knight, 2021)
22. U.S. Equal Employment Opportunity Commission (2023). iTutorGroup to Pay $365,000 to Settle EEOC Discriminatory Hiring Suit. Press release. (201, U.S. Equal Employment Opportunity Commission, 2023)
23. Sveriges riksdag (1976). Lag (1976:580) om medbestämmande i arbetslivet (Co-determination in the Workplace Act, MBL). (205, Sveriges riksdag, 1976)
24. Federal Republic of Germany (2021). Gesetz zur Förderung der Betriebsratswahlen und der Betriebsratsarbeit in einer digitalen Arbeitswelt (Betriebsrätemodernisierungsgesetz). Bundesgesetzblatt I 2021, p. 1762. (207, Germany, 2021)
25. Office of the New York State Comptroller (2025). Department of Consumer and Worker Protection: Enforcement of Local Law 144 – Automated Employment Decision Tools. Report 2024-N-6. (214, Office of the New York State Comptroller, 2025)
26. Vincent, J. (2018). Amazon reportedly scraps internal AI recruiting tool that was biased against women. The Verge. (215, Vincent, 2018)
27. Adams-Prassl, J., Binns, R. & Kelly-Lyth, A. (2023). Directly Discriminatory Algorithms. The Modern Law Review. (216, Adams-Prassl et al., 2023)