Spain's data protection agency has issued a preventive GDPR warning to an anonymised employer planning an AI tool that scores job applications, telling it to build in privacy by design, run a prior impact assessment where the risk is high, and make any human review effective

What the AEPD actually did

The AEPD sent a formal warning to a Spanish company, anonymised in the published text as ***EMPRESA.1, about an AI tool its corporate group is developing to screen and score candidates in external recruitment and internal mobility. The warning is a preventive measure under Article 58(2)(a) GDPR. It is addressed only to that company and restates existing GDPR obligations, and the agency's press note says a warning of this kind does not declare that an infringement was committed.

The file began with a written submission received on 6 January 2026. The AEPD's President opened investigative actions on 16 January 2026. The published document closes with the name of Lorenzo Cotino Hueso as President and carries no date of its own; the date we use, 23 September 2026, is the date of the AEPD press note that announced it and links to it, not a date of issue.

The tool, as the warning describes it, would analyse CVs, assign scores and prioritise candidates, and "could directly influence decisions on access to employment and professional promotion" (our translation of the warning's first paragraph).

The company's account, and how far the AEPD relied on it

Almost everything the warning says about the tool comes from the company. On that account, the tool would aim to improve the efficiency, consistency and objectivity of initial screening; it gives a score based on how well a candidate matches the job requirements; the final decision to screen in or discard belongs to a person; it excludes analysis of sensitive attributes; and it is subject to periodic audits.

The AEPD records these as information supplied by the company. It does not say it tested any of them.

Two further facts frame the timing. The warning says the tool "would not yet have been deployed in Spain" (our translation, and the conditional is the AEPD's). The company had told its workers' legal representatives on 1 December 2025, under Article 64.4 of the Estatuto de los Trabajadores, that it would be introduced. The company also told the AEPD that the group is running the data protection analysis centrally and that it would adopt any appropriate measures once it had the group's results, before any go-live.

The human-review test

On page 4 the AEPD accepts that the company's statement that a person makes the final decision is a relevant element in assessing the processing (our paraphrase of "constituye un elemento relevante"). It then sets the condition, in the original Spanish: "La intervención humana deberá ser efectiva, de manera que permita valorar críticamente la información o puntuación proporcionada por el sistema y adoptar la decisión correspondiente sin quedar determinada de hecho por el resultado automatizado."

Our translation, not the verbatim text: "Human intervention will have to be effective, so that it allows the information or score provided by the system to be critically assessed and the corresponding decision to be taken without being determined in fact by the automated result."

The next sentence draws the consequence: the concrete application of Article 22 is to be assessed according to how the decision process actually works. The AEPD does not conclude that Article 22 applies to this tool. In the operative part of the warning it tells the company to assess whether Article 22 applies, in light of how the tool really functions and the degree of human involvement, and, where it does, to respect that Article's limits and safeguards.

The three paragraphs of the operative part

Addressed to ***EMPRESA.1 alone, the operative ADVERTENCIA on pages 4 and 5 says the company "deberá" comply with data protection by design and by default and adopt, under GDPR Articles 24 and 25, appropriate technical and organisational measures to guarantee, and be able to demonstrate, that the processing complies.

For that company only, it then directs a risk assessment covering candidates and workers and, where the processing is likely to result in a high risk within the terms of Article 35, a data protection impact assessment carried out before the processing starts. The warning does not itself decide that this tool is high risk.

The third paragraph pairs transparency toward the people affected with the Article 22 assessment described above. It cites no transparency article; earlier in its reasoning the AEPD ties transparency to GDPR Articles 12 to 14: candidates and workers are to receive clear, accessible and understandable information about the processing and about the role the tool plays in the evaluation. Where the conditions of Article 22 are met, the specific information duties in Articles 13(2)(f) and 14(2)(g) also apply, on the AEPD's reading.

The closing paragraph states the consequence. If the company does not adopt the measures that may be needed, it could commit an infringement that could lead to investigative or corrective action, sanctions included. That is a conditional statement about the future, not a finding.

Why a warning can come before any CV is scored

Much of the warning is spent justifying the use of the power at this stage. The AEPD reads Article 58(2)(a) as a precautionary tool: it can warn where planned processing operations may infringe the GDPR, without having established that they do. It cites paragraph 188 of Advocate General Dean Spielmann's opinion of 23 September 2025 in Case C-474/24, and paragraph 37 of the Court of Justice's judgment of 26 September 2024 in Case C-768/21, for a broad reading of supervisory powers.

It goes a step further. The agency says it may warn on the basis of information it has received "and even information it has not received" (our translation), and that incomplete information does not make a warning less effective, because the purpose is to draw the controller's attention to a risk, not to sanction conduct.

What the warning does not say

It does not mention the EU AI Act. The sources it relies on are the GDPR, Spain's LOPDGDD, the Estatuto de los Trabajadores and EU case law, together with the Charter and Treaty provisions quoted within that case law. It makes no finding that the tool is biased, inaccurate or unlawful, and it contains no assessment of the company's claim that sensitive attributes are excluded. No fine is imposed and no deadline is set.

What we did not verify

What we opened: the five page warning PDF from aepd.es (Ref.: EXP202600427), read in full as extracted text, and the AEPD press note of 23 September 2026 that links to it, including its footnote on the nature of an Article 58(2)(a) warning.

What we did not open: any submission by the company or its group, the workers' representatives' notice of 1 December 2025, the Advocate General's opinion in C-474/24 or the judgments in C-768/21 and C-604/22 that the warning cites, and any documentation of the tool itself. We have not seen the tool and cannot say how it scores anyone.

What we refuse to claim: we do not name the company, which the AEPD anonymised. We do not say the company breached the GDPR, that the tool is high risk, or that Article 22 applies to it, because the warning decides none of those points. We do not treat the company's claims about human decision-making, sensitive attributes or audits as verified; the AEPD records them as the company's information. The PDF prints no date of issue or signature, so the 23 September 2026 date is the AEPD's announcement and publication date from its press note; we do not know when the warning was issued or sent. We did not verify an electronic signature on the published copy; it shows the President's name and title only. The file name contains "ai-00009-2026"; we do not state what that string denotes, because the document does not explain it. Spanish passages are quoted from the extracted PDF text; translations are ours.

Informational analysis for working professionals, not legal advice. Confirm how any rule applies to your situation with qualified counsel.

Related briefings

• CNIL names AI recruitment a 2026 control priority
• UK ICO's automated decision guidance targets hiring
• AEPD reads GDPR accuracy as fitness for purpose in AI processing
• Europe AI regulation tracker
• AI Regulation News hub