Updated 1 November 2026: rewritten with sources and the dates set by Regulation (EU) 2026/1744. Useful KVKK Article 11 and biometric data points from an earlier article on this site have been checked and merged here.

AI hiring tools carry discrimination risk today, even though the EU AI Act's high-risk duties for recruitment systems only start on 2 December 2027. Automated rejections can already engage GDPR Article 22, KVKK Article 11(1)(g) and Turkish equality law (Labour Law Article 5 and Law No. 6701). In the EU, using emotion recognition during recruitment has been banned since 2 February 2025. A tool can be neutral in design and discriminatory in effect, and both employers and vendors may have to answer for that.

How does bias get into a hiring tool?

It usually arrives through past data and proxies, not through an explicit instruction. A model trained on earlier hiring decisions treats earlier patterns as signs of success. It can then learn features that stand in for a protected characteristic: career gaps can track parental leave, and postcodes can track social or ethnic background.

The Netherlands Institute for Human Rights found in February 2025 that Facebook's job ad algorithm indirectly discriminated by sex: research showed one receptionist vacancy reaching 96% to 97% female users. The Institute held that a company running a learning algorithm can be expected to monitor and counter stereotyping. Its opinions on individual complaints are non-binding. In the US, Mobley v. Workday, which is still pending, tests whether a screening vendor can be liable as an employer's agent. An interim 2024 ruling said it can.

What does the EU AI Act require, and from when?

Recruitment and workforce management systems are high-risk, and those duties apply from 2 December 2027 after Regulation (EU) 2026/1744. Annex III point 4 of the AI Act covers:

  • (a) systems for recruitment or selection, in particular placing targeted job adverts, analysing and filtering applications, and evaluating candidates;
  • (b) systems for decisions on terms of work, promotion or termination, allocating tasks based on behaviour or traits, and monitoring and evaluating performance.

An Annex III system that profiles people is always high-risk (Article 6(3)), which makes the exceptions hard to use for candidate ranking tools. Employers as deployers must follow instructions, assign competent human oversight, ensure relevant and representative input data where they control it, monitor the system and keep logs for at least six months (Article 26). They must also tell workers' representatives and affected workers before using a system at work (Article 26(7)). Affected people gain a right to a clear explanation of the system's role in a decision (Article 86).

A system already in use before 2 December 2027 is caught only if its design changes significantly (Article 111(2)). Two points already apply:

  • Emotion recognition. Article 5(1)(f) bans inferring emotions in the workplace, except for medical or safety reasons. The Commission's non-binding guidelines say this extends to candidates and that "using emotion recognition AI systems during the recruitment process is prohibited". They tie the ban to biometric data, such as facial expressions or typing patterns: inferring emotions from written text falls outside it.
  • Bias testing. Since 27 July 2026, Article 4a allows exceptional processing of special category data for detecting bias, under strict conditions.

What rights do the GDPR and KVKK Article 11 give a candidate?

Both laws offer a route against purely automated outcomes; the GDPR goes further. GDPR Article 22 gives candidates the right not to be subject to a decision based solely on automated processing that significantly affects them. Exceptions exist for contract necessity, law and explicit consent. In those contract and consent cases, the employer must allow at least human intervention, a chance to give a view and a way to contest the decision (Article 22(3)).

The Court of Justice reads "decision" broadly. In SCHUFA (C-634/21), a score was itself a decision where a third party "draws strongly" on it. In Dun & Bradstreet (C-203/22), it held that people can require an explanation of the procedure and principles actually applied. A ranking score that recruiters simply follow may therefore be treated as a decision, even if a person formally clicks "reject". A systematic and extensive automated evaluation on which such decisions rest also requires a data protection impact assessment (Article 35(3)(a)). The Dutch regulator's EUR 824.99 million fine on Uber, announced in August 2026, concerned automated account deactivation without human assessment. Uber is contesting the fine, so that decision is not final.

KVKK Article 11 in Türkiye

KVKK Article 11(1)(g) gives a right to object where analysis "exclusively through automated systems" produces a result against the person. It is narrower than GDPR Article 22 in form: a right to object, not a general ban. The text does not mention human review. Even so, an objection cannot be answered meaningfully without a person able to look at the decision, so organisations should plan for one.

  • The controller must inform candidates of purpose, legal basis and rights when collecting data (Article 10).
  • Requests must be answered within 30 days at the latest (Article 13).
  • If refused or unanswered, a complaint can go to the Board (Article 14).

The word "exclusively" invites argument where a recruiter nominally reviews results. This note found no published Board decision on AI recruitment tools.

Is video interview analysis biometric data?

It can be, and in Türkiye that brings a strict regime. Biometric data is special category data under KVKK Article 6, which can be processed only on the closed list in Article 6(3). Legitimate interest is not on that list. Not all video analysis is biometric: the KVKK's announcement of 27 August 2026 cites GDPR recital 51, under which data counts where a specific technical method makes it capable of uniquely identifying a person. Turning it into a mathematical code does not change that.

The Board's principle decision 2026/921 of 29 April 2026 is about attendance tracking only. It held that biometric attendance systems fail the proportionality test even with valid explicit consent, and it pointed to the power imbalance between employer and worker. In this note's view, a candidate who needs a job faces a similar imbalance, so consent to video scoring would be a weak foundation. That is an inference, not a Board ruling.

Which Turkish equality rules apply?

Two laws apply, and the second covers job applicants expressly.

  • Labour Law No. 4857, Article 5 bans distinctions in the employment relationship based on language, race, colour, sex, disability, political thought, philosophical belief, religion and sect, and similar grounds. An employer may not treat a worker differently, directly or indirectly, because of sex or pregnancy when making a contract, unless biological reasons or the nature of the job require it. Compensation can reach four months' wages plus lost rights. Once a worker shows a strong likelihood of breach, the employer must prove there was none.
  • Law No. 6701 bans discrimination on a longer list, including age, ethnic origin, marital status and health (Article 3). Article 6 binds an employer or anyone authorised by the employer, covers applicants, and names selection criteria and hiring terms. Indirect discrimination covers apparently neutral practices that create an unjustified disadvantage (Article 2). The burden of proof shifts in applications to the Institution (Article 21). A breach can bring an administrative fine (Article 25).

A proxy effect in a screening tool fits the definition of indirect discrimination, though this note found no Turkish ruling applying it to an algorithm.

What can employers do before using these tools?

Keep evidence that the tool was tested and that people can intervene. The site's AI in hiring guide has working material.

  • Map the tools, including vendor features switched on by default.
  • Measure outcomes, comparing pass rates between groups and dating the results.
  • Ask vendors for intended purpose, training data description, bias testing and oversight design.
  • Remove emotion inference from any process reaching EU candidates.
  • Give candidates notice and a working route to a person.

Frequently asked questions

Is AI recruitment software high-risk under the EU AI Act?

Yes, where it is intended for recruitment or selection, including filtering applications and evaluating candidates (EU AI Act Annex III, point 4(a)). Under Regulation (EU) 2026/1744, high-risk duties for these systems apply from 2 December 2027.

Can a candidate in Türkiye object to an automated rejection?

Yes. KVKK Article 11(1)(g) lets a person object where analysis exclusively through automated systems produces an adverse result. The candidate applies to the controller, which must respond within 30 days under KVKK Article 13. A complaint to the Personal Data Protection Board may follow under Article 14.

Is emotion recognition in job interviews allowed?

Not in the EU. EU AI Act Article 5(1)(f) bans emotion inference in the workplace, and the Commission's guidelines apply this to the recruitment process. The ban has applied since 2 February 2025, with an exception only for medical or safety reasons.

Sources: Regulations (EU) 2024/1689, 2026/1744 and 2016/679; Commission guidelines C(2025) 5052; judgments C-634/21 and C-203/22; Laws No. 6698, 4857 and 6701 (mevzuat.gov.tr); KVKK announcements of 2 June and 27 August 2026; decision summaries on this site, all read on 1 November 2026. General information, not legal advice.