Can You Use AI Interviews for Hiring in the EU? The AI Act and GDPR Explained

Yes, you can use AI interviews for hiring in the European Union. But AI in recruitment is one of the most regulated uses of AI in the world, and the rules come from two laws at once: the EU AI Act and the GDPR.

This guide explains what applies today, what changes on 2 December 2027, and what to check before you buy or roll out an AI interview tool. It is a practical overview, not legal advice. For a decision about your own process, talk to your data protection officer or a lawyer.

The short answer

• AI interviews are allowed, but AI used to evaluate candidates is a high-risk use under the AI Act.
• Emotion recognition is already banned. Since 2 February 2025, AI systems that infer emotions in the workplace are prohibited, and the European Commission's guidance treats recruitment as part of the workplace.
• Candidates must know they are talking to an AI. The AI Act's transparency rules for systems that interact with people apply from 2 August 2026.
• The full high-risk obligations apply from 2 December 2027. A 2026 amendment, the "Digital Omnibus", moved the date from 2 August 2026.
• GDPR applies now. A person must be meaningfully involved in decisions that significantly affect candidates, and candidates must be told how their data is used.

Why recruitment AI is "high-risk"

The AI Act sorts AI systems by risk. Annex III of the Act lists employment as a high-risk area, including AI systems intended to be used for recruitment or selection: placing targeted job ads, analyzing and filtering applications, and evaluating candidates.

An AI interviewer that asks questions and evaluates answers falls into this category. So do most AI tools that screen CVs or rank candidates.

High-risk does not mean forbidden. It means that both the vendor (the "provider") and the employer using the tool (the "deployer") have obligations.

What is already banned: emotion recognition

Article 5 of the AI Act lists practices that are prohibited outright. One of them is the use of AI systems to infer the emotions of a person in the workplace or in education, except for medical or safety reasons. This ban has applied since 2 February 2025.

The European Commission's guidelines on prohibited practices read "workplace" broadly and include candidates in a selection process. In practice, this means an AI interview tool must not infer whether a candidate is nervous, enthusiastic or honest from their face, voice or body language.

This rules out a feature that some older video interview products advertised: scoring candidates on facial expressions or tone. If a vendor still offers emotion or "sentiment" analysis of candidates' faces or voices, ask exactly what it does, and expect to switch it off in the EU.

What applies from 2 August 2026: telling candidates it is an AI

Under Article 50 of the AI Act, AI systems that interact directly with people must be designed so that the people know they are interacting with an AI, unless it is obvious from the context. An AI interviewer that speaks with candidates falls under this rule. Make it clear in the invitation and at the start of the interview that the interviewer is an AI.

What applies from 2 December 2027: the high-risk obligations

From 2 December 2027, employers that use high-risk AI in recruitment take on deployer obligations under Article 26 of the AI Act. The main ones:

1. Use the system according to the provider's instructions.
2. Assign human oversight to people who have the competence, training and authority to do it, and who can overrule the system.
3. Monitor how the system works and report serious problems to the provider.
4. Keep the logs the system generates, for at least six months, where they are under your control.
5. Inform workers' representatives and affected workers before you put a high-risk AI system into use at the workplace.
6. Inform candidates that they are subject to the use of a high-risk AI system.
7. Explain decisions on request. Under Article 86, a person affected by a decision based on a high-risk AI system can ask for a clear explanation of the AI's role in it.

Providers have their own, heavier obligations: risk management, data quality, technical documentation, accuracy and robustness testing, and a conformity assessment before the system is placed on the EU market.

What GDPR requires today

The AI Act does not replace GDPR. For AI interviews, four GDPR rules matter most:

• No solely automated decisions with significant effects (Article 22). Rejecting a candidate is a significant decision. A person must be meaningfully involved: reviewing the evidence and able to decide differently, not just approving every recommendation.
• Transparency (Articles 13 and 14). Tell candidates what data you collect, why, how long you keep it and how the AI is used in the decision.
• Data protection impact assessment (Article 35). Evaluating candidates with AI is a typical case where a DPIA is expected.
• Data minimization and retention. Collect what the evaluation needs, and delete interview recordings and transcripts when you no longer need them.

You also need a data processing agreement with the vendor, and you need to know where candidate data is stored and which subprocessors handle it.

Questions to ask an AI interview vendor

Use this checklist in your next demo:

1. Does the tool infer emotions, personality or honesty from faces, voice or video? In the EU, the answer must be no.
2. Who makes the decision? Can a person see the evidence behind each result and decide differently?
3. Is every result explained? Can you show a candidate which answer led to which assessment?
4. How is the candidate told that the interviewer is an AI, and how is consent collected?
5. Which criteria are evaluated, and can you see and edit them?
6. What does the tool do with protected characteristics? Does it avoid asking about them and keep them out of the evaluation?
7. Where is the data stored, for how long, and who are the subprocessors?
8. Will you sign a data processing agreement and support our DPIA?
9. What is your plan for the AI Act's high-risk requirements that apply from 2 December 2027?
10. What happens when a candidate has a technical problem or needs an accommodation?

How Firstview approaches this

Firstview's AI Interviewer was built with these rules in mind:

• No facial or emotion analysis. Firstview does not analyze faces, expressions or gestures, and video is never part of the evaluation. During the interview, the camera is checked only for integrity, for example that no virtual camera is in use.
• A person decides. Firstview writes a report with a verdict for each criterion and the candidate's own words as evidence. It never decides who moves on, and unclear cases go to a person.
• Explained results. Every CV result has a reason for each criterion, and every interview verdict links to the moment in the recording it came from.
• Candidates know and consent. Candidates give consent in the application and interview flow, and access to candidate data is set by role.

For a data processing agreement or a security questionnaire, write to security@firstview.ai.