Input data and information sources
Candidates write their own CVs and cover letters. Every application contains a name, contact details, career history and often a photograph.
AI-assisted candidate screening
Also known as: AI-based candidate screening
The system uses CVs and cover letters to identify the best match for a role and suggest whom the company should invite for interview.
Understand the use case
What defines this use case?
Controversial cases have attracted particular attention: Amazon abandoned a system in 2018 because it disadvantaged women, and Workday faces litigation in the US.
This page describes a typical system design. Actual data flows and permissions depend on your implementation.
- System design
- Analysis and processing
- Ability to act
- Action permissions depend on integration
- Fields of use
- human resources, recruitment services
- Also known as
- AI in recruitment, CV screening, AI-powered applicant tracking
How it works, step by step
System design and data flows
Input data
CVs, cover letters and certificates arrive through the application portal, alongside the role's requirements.
Candidates write their own CVs and cover letters. Systems that also analyse video interviews or photographs add image and audio to text.
Processing
The system extracts information and compares education, experience and skills with the requirements.
The model processes application documents and compares identified characteristics with defined requirements. This produces classifications or a ranking for shortlisting. The ranking reflects the chosen assessment method and is not a comprehensive statement about a person's suitability.
Results
Each application receives a score, ranking or summary.
The result describes the defined model task. A match, category or forecast acquires its professional significance only in conjunction with the underlying data and intended use.
Use and impact
HR uses this output to decide whom to invite and whom to reject.
Integration determines whether the result is simply displayed, adopted after approval or written directly into a business application. These variants differ in their data flows and permissions.
Explore the system design: Select a component to see its task, incoming and outgoing data, and role in the use case. The guided walkthrough explains each phase. Then use Yes, Uncertain and No to represent your specific system variant.
7 review first20 clarify6 baseline threats
- Present
- Depends on your system
- Absent
- Review first
- To clarify
How to use the model
The diagram shows the typical architecture. Select a component to see what happens there and adapt its features to your system. Enable “Analysis guidance” to see which threats need reviewing for this architecture. The page's checklist continues to describe the typical case.
Changes from the typical case
None yet. Each change will appear here.
Where most threats arise
- 6 clarify
- 4 review first, 1 clarify
- 5 clarify
- 1 review first, 1 clarify
In this system design: 7 to review first, 20 to clarify, 6 baseline threats.
Architecture as a list
External access: Depends on your system
To clarify
Input: Part of every AI system
Review first
- Adversarial Inputs Review priority
- Privacy Attacks
- Sensitive Information Disclosure
- Exfiltration from ML Application
To clarify
Third-party content: Present
AI model: Part of every AI system
To clarify
- Sleepy Agent (Time/Event-Triggered Hidden Instructions)
- Prompt Injection: Direct
- Prompt Injection: Indirect
- Jailbreaks
- Meta Prompt Extraction
- Misalignment
Baseline for every AI system
Provider service: Present
Review first
To clarify
Document collection: Depends on your system
To clarify
Training and feedback: Depends on your system
To clarify
Result: Part of every AI system
Review first
- Insecure Output Handling Review priority
To clarify
Business application or equipment: Depends on your system
To clarify
person: Part of every AI system
Review first
- Overreliance Review priority
Affected person: Present
Unapproved AI services: Depends on your system
To clarify
Supply chain and technical foundations: 5 baseline threats applying to every AI system
Baseline for every AI system
How it differs from similar use cases
Assigns tasks to workers and evaluates their performance
Personalised online advertising (behavioural targeting)
Targets job advertisements at selected people
Data and information
Processing and operating environment
Assessment is usually part of applicant tracking software, with a model supplied by the vendor.
Storage and further use
Some systems search past applications for suitable candidates. Some companies train the model on their past hiring decisions, as Amazon did.
Results and data sharing
Depending on the company, the system sends rejections itself or only suggests a ranking. If applicant tracking software runs in the cloud, applications leave the company.
Using a provider does not automatically determine where processing takes place. Storage location, subcontractors, deletion periods and use for training must be checked for the specific deployment.
Assess risks and determine measures
From understanding the system to analysing risks
- Define the system boundary
Record data, participants, interfaces and permissions. Resolve uncertain characteristics in the model.
- Investigate threats
Relate review candidates to actual data flows: what could happen, and who would be affected?
- Assess risk
Assess impacts and likelihood in the deployment context. The number of review candidates is not a risk score.
- Provide evidence of measures
Select appropriate controls, assign responsibilities and define effectiveness checks. Document residual risks and approvals.
Key threats in the application context
- 3 particularly important
- 4 typical
- 20 depending on the system
- 6 additional threats for every AI system
A total of 33 threats from the threat catalogue may be relevant to this use case.
Also review: whether the system disadvantages groups
Check whether selection, ranking or assessment disadvantages people with protected characteristics, such as sex, age or origin.
Priority review points
Candidates can repeat job advertisement keywords or hide them in their CVs. The system then ranks an application more highly than the candidate's qualifications justify.
Recruiters often look only at the top-ranked candidates. Those placed lower have little chance, even when the ranking is wrong.
The ranking passes into the applicant tracking system and can trigger rejections. A scoring error thus becomes a direct decision about a person.
4 further review candidates in the typical design
Other relevant threats
Training data or an adopted base model can introduce hidden triggers for misbehaviour.
Listed because of this characteristic
- Uses another provider's model
Targeted queries can recover some personal or protected training data from the model.
Listed because of these characteristics
- Processes personal data
- Processes confidential data
Sensitive Information Disclosure
Confidential content can appear in answers, supplied context or logs.
Listed because of these characteristics
- Processes personal data
- Processes confidential data
Exfiltration from ML Application
Protected data can leak through tools, network connections, storage or insiders.
Listed because of this characteristic
- Processes confidential data
Up to 20 further threats may apply, depending on your system design. Nine threats need to be reviewed for every AI system. Three of these are particularly important here and are therefore listed above.
System features and open questions
Each Yes adds further threats to your checklist, up to 20 in total. If you cannot yet answer a question, include its threats in your review.
- Added by this Yes
- Also requires a Yes to another question
How your system is built
- Performs natural language tasks5 threats
- Generates its own text2 threats, plus 1 only in combination with other characteristics
- Uses operational feedback2 threats
- Processes text, images and speech together2 threats
- Searches its own document collection1 threat, plus 1 only in combination with other characteristics
- Learns from your own data1 threat, plus 1 only in combination with other characteristics
- Uses a knowledge graph1 threat
- Changes data or triggers processes1 threat
- Learns from examples with correct answers1 threat
- Optimises a specified metric1 threat
- One search store for several permission groups1 threat only in combination with other characteristics
How you operate the system
- Available to people outside the organisation5 threats
- Accepts queries directly through an interface4 threats, plus 1 only in combination with other characteristics
- Accessible over a network2 threats, plus 1 only in combination with other characteristics
- Incurs costs with each query1 threat
- Shares computing resources with other customers or applications1 threat
- Used alongside unapproved AI services1 threat
How your system is built
Does the system generate its own text, such as answers, drafts or summaries?
Newer systems use a language model to summarise applications; traditional approaches only produce a ranking.
If yes, add
Can users give the system natural language tasks that it then performs?
A language model follows instructions, including ones someone has invisibly embedded in a CV.
If yes, add
Does the system search its own collection of documents or records for relevant content?
Some systems search past applications for suitable candidates.
If yes, add
Does the system use a knowledge graph storing concepts and their relationships?
Some systems map skills and occupations using a database of concepts and their relationships.
If yes, add
Can the system change things itself, such as storing data, sending messages, initiating transactions or granting permissions?
Depending on the company, the system sends rejections itself or only suggests a ranking.
If yes, add
Do documents from several customers, departments or permission groups share one search store?
Recruitment agencies often hold applications for several client companies in the same repository.
If yes, add
Does your organisation train or fine-tune the model itself using its own data?
Some companies train the model on their past hiring decisions, as Amazon did.
If yes, add
Is the model trained on examples to which someone has assigned the correct answer?
A model trained on past hires adopts their patterns, including discriminatory ones.
If yes, add
Does operational feedback or output later feed into analysis or training?
HR decisions can feed back as new training examples.
If yes, add
Does the system process several input types together, such as text with images or speech?
Systems that also analyse video interviews or photographs add image and audio to text.
If yes, add
Is the system intended to maximise a specified metric, such as revenue, utilisation or clicks?
If yes, add
How you operate the system
These questions arise for almost every AI system.
Can people or programs query the model directly, for example through an interface?
If yes, add
Is the system accessible over a network or dependent on network services?
If yes, add
Do you pay per query or unit of computing time, so costs increase with use?
If yes, add
Does the system share servers or computing resources with other customers or applications?
If yes, add
Can people outside your organisation use the system, including without login?
Anyone can submit documents through an application portal for the system to evaluate.
If yes, add
Do staff also use AI services for this task that your organisation has not approved?
Staff who upload applications to a freely available chat service for comparison do so without approval.
If yes, add
Controls and implementation
Measures for the priority review areas are expanded. Each linked measure explains how to implement it.
Review priorityAdversarial Inputs2 measures
Review priorityOverreliance3 measures
Review priorityInsecure Output Handling3 measures
Backdoor ML Model2 measures
Privacy Attacks3 measures
Sensitive Information Disclosure3 measures
Exfiltration from ML Application3 measures
Controls for the remaining threats are available on their pages in the threat catalogue.
AI Act provisions
-
Art. 4: AI literacy
For every AI system Applies since 2 February 2025.
-
Art. 5 para. 1 point e, f, g, h: Prohibited biometric practices
Depending on use Review trigger since 2 February 2025.
-
Art. 53 para. 1 point b, Annex XII: Embedded general-purpose model
Depending on use Review trigger since 2 August 2025.
-
Annex III no. 4 point a: Recruitment and selection
In typical use Review trigger from 2 December 2027.
Applies to every AI system
Art. 4: AI literacy
Applies if staff or appointed representatives operate or use AI systems.
Applies since 2 February 2025.
Obligations and details for Art. 4: AI literacy
- Who bears the obligations
- Provider, Deployer, Product manufacturer, Provider of a general-purpose AI model
Detailed obligations
May apply in typical use
Annex III no. 4 point a: Recruitment and selection
Applies if the system screens or filters applications or evaluates candidates, even when a person ultimately decides whom to invite.
Applies from 2 December 2027.
Obligations and details for Annex III no. 4 point a: Recruitment and selection
- The general condition is
- Applies if the system targets job advertisements, screens or filters applications or evaluates candidates.
- Who bears the obligations
- Provider, Deployer, Product manufacturer, Importer, Distributor, Authorised representative
Detailed obligations
- Document the classification with reasons
- Check whether you become a provider
- Establish and operate a risk management system
- Register the exemption under Art. 6(3)
- Use the system in line with the instructions
- Assign human oversight to suitable people
- Inform workers and their representatives in advance
- Inform affected persons about the use
- Explain decisions on request
May apply in particular uses
Art. 5 para. 1 point e, f, g, h: Prohibited biometric practices
Applies if the system infers candidates' emotions or intentions from their faces or voices in video interviews.
Applies since 2 February 2025.
Obligations and details for Art. 5 para. 1 point e, f, g, h: Prohibited biometric practices
- The general condition is
- Applies if the system indiscriminately collects facial images from the internet or video, recognises workplace or educational emotions, categorises people biometrically by sensitive attributes, or identifies people in public spaces in real time for law enforcement.
- Exception
- Workplace and educational emotion recognition is permitted for medical or safety reasons. Real-time law enforcement identification has narrowly defined exceptions.
- Who bears the obligations
- Provider, Deployer, Importer, Distributor, Authorised representative, Product manufacturer, Provider of a general-purpose AI model
Detailed obligations
Art. 53 para. 1 point b, Annex XII: Embedded general-purpose model
Applies if a large language model or another third-party general-purpose model analyses or summarises applications.
Applies since 2 August 2025.
Obligations and details for Art. 53 para. 1 point b, Annex XII: Embedded general-purpose model
- The general condition is
- Applies if another provider's general-purpose AI model is incorporated, such as a large language model.
- Points to consider
- The model provider bears its obligations. It must give you the Annex XII information; use it for your own documentation.
- Who bears the obligations
- Provider of a general-purpose AI model
Detailed obligations
Other legal requirements
Article 22 GDPR
If a rejection is based solely on automated assessment, the prohibition on automated individual decisions applies, subject to its exceptions.
Sections 1, 7 and 22 of Germany's General Act on Equal Treatment (AGG)
The Act prohibits disadvantaging applicants on grounds such as sex, age, disability or ethnic origin. Where evidence suggests discrimination, the employer must prove otherwise.
Open the legislation Sections 1, 7 and 22 of Germany's General Act on Equal Treatment (AGG)
Classify your system with the quick checker All obligations in the obligations compass
Cross-cutting threats
Review these threats for every AI system, whatever its purpose.
- Supply Chain: Infrastructure
- Supply Chain: Models
- Supply Chain: Datasets
- Adversarial Inputs Review priority: Adversarial Inputs
- Insecure Output Handling Review priority: Insecure Output Handling
- Application Vulnerabilities
- Overreliance Review priority: Overreliance
- Model Drift & Degradation
- Middleware Exploits (AI Framework Attacks)
Atypical system features
View 10 further questions
If any of these features does apply to your system, add the listed threats.
Does the system generate or edit images, sounds, voices or videos?
If yes, add
Does the system create new content from open-ended requests that people read, see or hear directly? Translation, reading aloud and transcription do not count.
The system evaluates submitted documents and does not create new content for external audiences.
If yes, add
Does the system formulate answers from retrieved documents?
If yes, add
Does the system remember content from earlier conversations or tasks and reuse it later?
If yes, add
Does the system call other programs, interfaces or search services itself, even if only to read?
If yes, add
Does the system determine its next steps itself based on earlier results?
If yes, add
Does the system delegate tasks to other AI agents or incorporate their results?
If yes, add
Is the system connected to tools or data sources through the Model Context Protocol (MCP)?
If yes, add
Does the system generate code, scripts or database queries for further use?
If yes, add
Does the system execute programs, scripts or commands itself?
If yes, add
Sources
- Legislation, norm or standard
EU AI Act, Annex III, point 4(a)
The Act expressly lists AI systems that screen or filter applications or evaluate candidates in Annex III.
- Register or case collection
AI Incident Database, Incident 37 (Amazon)
The database documents Amazon's scoring system, which gave women's applications lower scores.
- Other source
Holland & Knight on Mobley v. Workday, May 2025
The law firm reports litigation concerning AI-based candidate assessment in real-world use.
- Specialist study
Federal Network Agency, AI in businesses, July 2025 report
The report states that 24 per cent of AI-using companies use it in human resources overall.
- Specialist study
Digital Labour Society think tank (BMAS), Policy brief on artificial intelligence in recruitment
The Federal Labour Ministry's think tank describes AI systems screening CVs as part of recruitment.
Related use cases
Also in the field of Employment and education
- Algorithmic managementSoftware assigns tasks and shifts to workers, tracks what they do and evaluates their performance.
- Online proctoringThe system monitors online exam candidates through camera, microphone and screen and flags possible cheating.
- Automated assessment of exam performance (essay scoring)A model assesses written or spoken exam answers and awards marks, alone or alongside human examiners.
Often used together with
- Intelligent document processing (IDP)The system reads correspondence, invoices and forms, routes them to the responsible team and transfers their data into business systems.
- Customer service chatbots and voicebotsA bot independently handles customers' or citizens' requests in chat or by phone and passes difficult cases to people.
Updated: 30 September 2026. Review checklist rules version 0.3.2, threat catalogue version 2026.10.24.2. How these pages are structured