EDPB: the supervisory authorities' coordinated enforcement action in 2027 will target automated decision-making and AI in recruitment

At its plenary on 11 November 2026 the European Data Protection Board (EDPB) selected the topic of its sixth coordinated action under the Coordinated Enforcement Framework (CEF). The action will focus on automated decision-making in recruitment, including AI-driven decision-making. Specifically, it concerns compliance with the right not to be subject to a decision based solely on automated processing (Article 22 GDPR) and the related right of access where automated candidate screening tools are used. Supervisory authorities may join the action on a voluntary basis in the coming weeks; it will be launched in the course of 2027.

AI systems intended to be used for the recruitment or selection of natural persons, in particular to analyse and filter job applications and to evaluate candidates, are high-risk under point 4(a) of Annex III to the AI Act. Under the Digital Omnibus on AI, the AI Act obligations apply to them from 2 December 2027; the GDPR already applies to them today.