Screening CVs with AI in France in 2026: what the CNIL checks and how to stay compliant

Use is growing fast. According to APEC (May 2026), 13% of mid-sized and large French companies used AI to recruit managers and professionals (cadres) in 2025, up from 6% in 2024, mainly to write job ads. On the candidate side, 31% of cadres who recently looked for a job used AI, up from 15% at the end of 2024, and 2 companies in 10 already value AI skills when selecting candidates. For the wider HR context, see our guide to AI in human resources.

Each year the CNIL, France's data protection authority, picks a few priority inspection themes. The 2026 themes, published on 3 April, are recruitment, the single electoral register and sports federations. The CNIL says about 20% of its annual inspections fall under these themes.

For recruitment, the page lists three things inspectors will check:

• automated decision-making systems: a tool that screens candidates out without real human involvement;
• information given to candidates: what they are told, when, and about which tool;
• retention periods: CVs kept after the process ends, talent pools that are never purged.

Inspections target large companies and recruitment firms first, because they receive and screen the most applications. The CNIL adds that this theme prefigures its future role as AI market surveillance authority in the employment field. Smaller companies are still in scope: the CNIL can inspect any organisation and also acts on complaints.

The CNIL recruitment guide, published on 30 January 2023, has 19 fiches (practical sheets). Fiche 13 covers software for sorting, ranking and assessing applications (pages 69 to 74 of the PDF). It is the text inspectors work from in 2026, and news articles cite it without going into detail.

A ranking can be an automated decision

A decision based solely on automated processing is prohibited in principle under the GDPR. The CNIL specifies that a ranking tool falls into this category when the recruiter only looks at the top-ranked profiles. The tool formally rejects nobody, yet candidates at the bottom of the list are never read, so the algorithm has made the decision.

The exceptions are narrow

• Consent: according to the CNIL, it can only very rarely justify such a decision.
• Law: no French law authorises this kind of decision in recruitment.
• Necessary to enter into a contract: the EDPB limits it to an exceptionally high number of applications.

The guide's two examples

The fiche's checklist

• record the processing in the register;
• avoid variables that act as proxies for discriminatory data;
• rely on an Article 22 exception if the decision is automated;
• carry out a data protection impact assessment (DPIA);
• give candidates specific information;
• organise human review;
• involve the data protection officer.

For a self-learning algorithm, the recruiter must check that it stays relevant, including how it was trained. A vendor that will not explain its training data leaves you exposed on this point.

GDPR Article 22 sets the principle: a person has the right not to be subject to a decision based solely on automated processing that produces legal effects or similarly significantly affects them. Rejecting an application qualifies. The three exceptions (explicit consent, contract, law) come with safeguards: human intervention, the right to express one's view and the right to contest the decision.

A DPIA is almost always required. The CNIL list of processing that requires an impact assessment (deliberation 2018-327 of 11 October 2018) covers processing that profiles individuals for HR management. Its example is processing that makes recruitment easier through a selection algorithm. A CV scoring or matching tool fits that description.

The DPIA must be done before go-live. It describes the data processed, the tool's logic, the risks (discrimination, error, leaks) and the measures taken. Technical safeguards for AI agents (access, logs, data separation) are covered in our guide to AI agent security.

On 2 April 2026, updated on 20 May 2026, the CNIL published a retention framework for HR management. Its recruitment section gives precise periods, and these are what the 2026 inspections will compare against your databases.

Two practical consequences. First, the 5-year archive exists as evidence: it sits apart from active storage, and rejected candidates should not reappear in recruiters' searches. Second, an AI tool that keeps CVs to "improve matching" must follow the same deadlines: check in the contract what the vendor keeps and for how long.

EXTIA, €300,000. In a decision of 21 July 2026, published on 9 September 2026, the CNIL fined this engineering and IT consultancy. In 2024 it received 265 erasure requests, mostly from candidates. More than three quarters were not handled or were handled badly: 12 never processed, 166 people never told the outcome, 27 told late. The breaches concern GDPR Articles 12 and 17, and the company had already been reminded of its obligations twice. As of 15 September 2026, it is the most recent CNIL sanction involving candidates.

Formal notice of 25 April 2024. The CNIL ordered a company to stop asking candidates for their place of birth, nationality, family situation and previous salary. The case was closed after the company complied.

For scale: in 2025 the CNIL issued 259 decisions, including 83 sanctions, for a total of €486,839,500 in fines (report published on 9 February 2026). None was specific to recruitment. A screening tool that stores thousands of CVs must therefore also be able to erase them on request, within the one-month deadline set by the GDPR.

The works council point is often misreported. For recruitment methods, the text requires prior information. The stronger "informed and consulted" duty covers tools that monitor employees' activity. A tool that screens external applications and also scores internal performance falls under both.

Annex III, point 4(a), of Regulation (EU) 2024/1689 classifies as high-risk AI systems intended for the recruitment or selection of people, in particular to place targeted job ads, analyse and filter applications, and evaluate candidates. An applicant tracking system (ATS) that scores or ranks CVs is directly concerned.

The date has changed. The Digital Omnibus on AI, Regulation (EU) 2026/1744, entered into force on 27 July 2026. It moves Annex III high-risk obligations to 2 December 2027. Some content published since, including a French ATS vendor blog dated 30 July 2026, still presents these rules as applying from August 2026. The full timeline is in our AI Act guide for businesses.

Duties of the employer as deployer (Article 26)

The company using the tool is a "deployer". Article 26, in the 2024 version shown on the Commission's Service Desk, requires it to:

• use the system according to the provider's instructions;
• assign human oversight to people with the necessary competence, training and authority;
• make sure input data under its control is relevant and sufficiently representative;
• monitor operation and report risks and incidents to the provider;
• keep automatically generated logs for at least 6 months (26(6));
• inform workers' representatives and affected workers before putting the system into service at the workplace (26(7));
• use the provider's information to carry out the DPIA (26(9));
• inform people who are subject to decisions made or assisted by the system (26(11)).

Check the consolidated text after the Omnibus before fixing your procedures: the Service Desk page had not been updated as of 15 September 2026.

What already applies

• Emotion recognition is banned: since 2 February 2025, Article 5(1)(f) bans systems that infer a person's emotions in the workplace, except for medical or safety reasons. A video interview tool that scores a candidate's "enthusiasm" or "stress" should be ruled out.
• Pre-screening chatbots: since 2 August 2026, Article 50 requires telling candidates they are talking to an AI. See the AI agent transparency obligation.
• AI literacy (Article 4): in force since 2 February 2025, this duty was simplified by the Omnibus, with the Commission and Member States taking a stronger role. Training the recruiters who use the tool remains good practice, and Article 26 requires competent people for human oversight anyway.

The Omnibus also allows sensitive data to be processed to detect and correct bias, under set conditions. That is directly relevant to the bias tests described below.

The risk described by the CNIL and the French Défenseur des droits has been measured. Two cases are the usual references.

These results concern specific models and settings; they do not prove that a given tool is biased. They show that a language model applied to CVs reproduces gaps without being asked to, and that testing before go-live is the only way to know. The Défenseur des droits published a report with the CNIL on the automation of discrimination (31 May 2020) and a sheet on discrimination produced by algorithms and AI, updated on 1 February 2024. Its decision 2025-182 of 10 October 2025 concerns the targeting of job ads on Facebook, a use also covered by Annex III.

ATS vendors active in France publish very uneven information on compliance. The table reports their own statements, without judging the products.

Note SmartRecruiters' position: the vendor states in writing that human oversight is the customer's job. Under both the GDPR and the AI Act, the employer answers for the decision. And a ranking with no formal exclusion can still become an automated decision if nobody reads the bottom of the list. To compare providers who integrate these tools, see our comparison of AI agencies for recruitment and HR.

1. Set the job criteria before publishing. Skills, required qualifications, experience: written, job-related criteria (L1221-6) that drive scoring and justify each decision.
2. Build a structured form. Closed questions on those criteria rather than free analysis of the CV. No questions on age, family situation, nationality or place of birth.
3. Inform before use. On the job ad and form: the tool used, what it does, where the human steps in, the right to ask for review and how to exercise it (L1221-8, GDPR Articles 13 and 22). If a chatbot asks the questions, it introduces itself as an AI.
4. Let the AI suggest without rejecting. The tool proposes an order with a reason per criterion. No candidate is screened out automatically, and the recruiter can open every application.
5. Have a recruiter decide, with a review window. Every rejection is confirmed by a person who opened the file. Candidates get an announced period to request human review, as in the CNIL good-practice example.
6. Keep logs. Scores, suggestions, final decision and who made it, kept for at least 6 months. This becomes mandatory on 2 December 2027 (Article 26(6)); today it is already your evidence of human decision in an inspection.
7. Carry out the DPIA before go-live, with the DPO, and record the processing in the register.
8. Inform the works council before deployment and at each significant change to the tool (L2312-38).
9. Schedule the purge. Active storage until the process ends, a separate 5-year archive after the position is filled, talent pool limited to 2 years after the last contact. Handle erasure requests within one month.
10. Test for bias. Before go-live and at regular intervals: the same CVs with names, ages or addresses changed, and a comparison of selection rates by group.

This workflow can be built inside an existing ATS or as a custom AI agent connected to your tools. The same traceability then applies when the hired candidate arrives, as described on our page about the onboarding agent.

If you are weighing several tool configurations, AI consulting can map the processing before you buy or build.

Lumyniq is an AI automation agency based in Paris. It builds custom AI agents, Claude integrations, n8n workflows and Twenty CRM setups for small and mid-sized businesses, with a focus on real estate, legal, healthcare and HR. Every project starts with an audit of the existing process, before any quote.