Ranking job applicants is on the EU’s high-risk list. Most firms do it.

Two different regimes reach the same activity from opposite directions, and a UK firm hiring in the UK is squarely inside one of them.

The EU AI Act classifies by use rather than by technology. Annex III lists employment and worker management, and ranking job applicants sits inside it. That classification does not depend on the system being impressive — a rules engine that scores candidates on years of experience is in the same box as a model.

The UK route is nearer. Section 80 of the Data (Use and Access) Act 2025 replaced Article 22 of the UK GDPR with Articles 22A to 22D, in force since 5 February 2026, and a decision that determines whether somebody progresses in a recruitment process is the textbook case of a significant decision.

Why firms do not think this applies to them

Because the sorting is inside something bought for another reason. An applicant tracking system that surfaces the ten "best matched" candidates is ranking. A keyword filter that hides applications missing a qualification is deciding. A scoring field a recruiter sorts by is an automated evaluation, even when a human clicks last.

The human-at-the-end defence is weaker than it sounds and the reason is worth stating plainly. A reviewer who sees a ranked list, does not see the candidates the system suppressed, and has no time to look, is not exercising meaningful judgement. They are ratifying.

The four questions Article 22C actually asks

Written as a recruitment process rather than as law, the safeguards come down to four things a candidate must be able to do.

1. Find out that a decision about them was automated, and on what basis.
2. Make representations — say something that could change the outcome.
3. Obtain human intervention — reach a person with the authority to decide differently.
4. Contest it — challenge the decision itself, not merely the data behind it.

Most recruitment processes answer none of the four, and the rejection email is where all four are absent at once. That is the cheapest place to start and it does not need new software.

The special category trap

Article 22B keeps a tighter restriction where a decision is based on special category data — health, ethnicity, religion, trade union membership and the rest. Nobody enters those fields into a hiring system on purpose.

They arrive by inference instead. A model that penalises employment gaps is reaching for something a health condition or caring responsibility explains. A filter keyed on a named qualification can proxy for where somebody was educated. The data protection question is about the basis of the decision, not about which boxes were typed into, and that is an easy distinction to lose when the system is a supplier's.

Three things worth doing before hiring again

1. Ask your supplier, in writing, what the system scores and on what. The quality of the answer tells you whether they have thought about this. Ask what it suppresses as well as what it surfaces.
2. Measure the override rate. How often does a recruiter progress somebody the system ranked low? If the answer is never, the human step is decorative and you should know that before somebody else establishes it.
3. Rewrite the rejection. Four sentences covering the four safeguards, once, used everywhere.

What this does not tell you

Whether a specific system makes a decision "based solely on automated processing" is a judgement, and the line is exactly where enforcement will land. We are not lawyers and this is not advice on a particular tool.

It also does not tell you the EU deadline matters to you. Most UK firms hiring UK staff are outside the AI Act entirely — the reason to know the classification is that your supplier is building to it, which is the argument in the note on the moved deadline.

The near obligation is the UK one, covered in what your agent is allowed to decide, and the data side of hiring is where we do the work. The employment law changes running alongside it are in the Employment Rights Act note.