Using AI to Screen Candidates in France: What Is Allowed in 2026

A lot of recruiters heard that the EU AI Act's rules for hiring tools were pushed back to December 2027 and concluded that nothing needs doing until then. That reading is half right. The heavy obligations for high-risk systems have moved, but several rules that touch AI in recruitment apply today, and the CNIL has put recruitment among its inspection priorities for 2026.
What is actually delayed
Under the AI Act, systems used to recruit or select people, filter applications or evaluate candidates are classified as high risk. The Digital Omnibus, in force since 27 July 2026, moved the date from which the high-risk obligations for these uses apply from 2 August 2026 to 2 December 2027. That covers the documentation, risk management, logging and human oversight duties, and the duties of the businesses that use these tools, known as deployers.
What applies today
GDPR Article 22. People have the right not to be subject to a decision based solely on automated processing that significantly affects them, and rejecting a candidate qualifies. A human who simply clicks approve does not fix this. In its 2023 SCHUFA ruling the Court of Justice held that when an automated score plays a determining role in a decision, the scoring itself counts as the automated decision. If a tool cuts a thousand applications to a shortlist of ten, the shortlist is the decision.
Discrimination law. An algorithm that disadvantages people on a protected ground produces unlawful discrimination, and the employer is the one who answers for it, whatever the vendor's brochure says.
The ban on emotion recognition at work. Since 2 February 2025 the AI Act has prohibited systems that infer people's emotions in the workplace, except for medical or safety reasons. Video interview tools that claim to read confidence, stress or enthusiasm from faces or voices are the obvious example. If a product you use has a feature like that, switch it off or drop the product.
Transparency. Since 2 August 2026, people must be told when they are dealing with an AI system, such as a candidate chatbot, unless it is obvious.
Data protection basics. Information for candidates, retention limits as described in the companion article on recruiting, and, where the processing amounts to systematic evaluation of people, an impact assessment is often required.
What you will need by December 2027
As a deployer of a high-risk system you will have to use it according to the provider's instructions, give oversight to people with the competence and authority to override it, keep the logs the system generates, and inform workers' representatives and affected workers before putting it into use at the workplace. Candidates must also be told when a high-risk system is being used to help decide about them. Providers carry the heavier duties of documentation, testing and conformity, which is why the vendor conversation matters.
Questions to put to a vendor
Is the system classified as high risk, and what documentation can you provide today?
What data was it trained on, and how was bias tested?
Does it infer emotions, personality or similar traits at any point?
Where is candidate data processed, which sub-processors are involved and is there a data processing agreement?
Is candidate data used to train your models?
Can a recruiter see why a candidate was ranked where they were, and override the result?
Can decisions be logged and exported?
Making the human review real
A human review only counts if it can change the outcome. Give reviewers the authority and the time to read applications the tool marked down, sample rejected candidates regularly and record the cases where the person disagreed with the tool. If nobody ever overrides it, what you have is an automated decision with an extra click.
Low-risk uses
Drafting adverts, scheduling interviews, writing up your own interview notes with candidates informed, and a candidate FAQ assistant that discloses it is an AI all help without ranking anyone.
Where this leaves you
For a small business the sensible position is conservative: use AI to prepare and organise recruitment, keep a person responsible for the choice, and get the documentation habit in place before 2027. Using an assistant to draft an advert or an interview guide sits on the preparation side of that line, and ranking or rejecting people sits on the other. Mirage Cloud's HR agent, scoped to recruitment and French labour law, is useful on the first kind of task. For the second, apply this checklist to any tool you consider.