The AI tool is intended to analyse CVs, score applications and rank them. The company described the AI tool as a support tool and stated that any final recruitment or promotion decision would always be made by a human. The company stated the following:
- The AI tool was intended to make the initial assessment of candidates more efficient, consistent and objective.
- The AI tool did not analyse sensitive characteristics.
- The AI tool was audited periodically.
- The company’s group is evaluating implementation of the AI tool.
- The company would review the group‘s findings and take any appropriate measures before the tool was introduced.
The AEPD acknowledged that AI tools can improve the efficiency and consistency of recruitment and people management. It stated that the GDPR does not prohibit these technologies but requires that safeguards appropriate to the risks are applied in relation to the processing of any personal data. As such, it issued the Warning.
The AEPD explained that a warning issued under the GDPR is a preventive measure that can be used when planned processing might breach the GDPR, without the need for the AEPD to be certain that a GDPR breach would occur. The AEPD noted that a warning is not a sanction; rather, its purpose is to draw the company’s attention to the risk so that it can ensure that processing is in line with GDPR requirements.
The Warning addressed, amongst other things:
- Data protection by design: Safeguards must be built into every stage of the tool‘s design, evaluation, selection, configuration and implementation. The company must demonstrate that its processing complies with the data protection by design and default obligations under Art. 24 and 25 GDPR.
- Risk assessment: The company must assess the risks to candidates and employees and, where the processing is likely to be high risk, complete an Art. 35 GDPR data protection impact assessment before using the tool.
- Security measures: The company must address security measures to protect people’s rights, without prejudice to security measures or requirements that may be necessary to protect the system or the organization itself.
- Transparency: Under Art. 12–14 GDPR, the company must provide candidates and employees with clear and accessible information about how the company uses their personal data, including the role that the AI tool plays in assessing them. Additional information requirements will apply if the tool makes decisions without meaningful human involvement (as required under Art. 22 GDPR).
The AEPD noted that any human intervention must be effective and the decision-maker must be able to critically assess the AI tool’s score and reach an independent conclusion that has not been pre-determined by the AI tool output.
The AEPD cautioned that if the company does not take the necessary steps to comply, it could commit a breach within the AEPD’s remit. This may lead to an investigation and corrective action, including sanctions.
On October 5, 2026, Royal Decree 723/2026 (the Royal Decree) came into force. The Royal Decree develops Art. 8.5 of the Statute of Workers (regarding the provision of information to employees) and partially transposes Directive (EU) 2019/1152 on transparent and predictable working conditions into Spanish law.
Amongst other things, the Royal Decree requires that employers must, as a general rule for employment relationships lasting more than four weeks, inform each employee in writing if algorithmic or automated decision-making systems are used. Where those systems are used to decide employee working conditions, employers must also explain the system guidelines, criteria and operating rules.
For new employees, the information must be provided in advance of the employment commencing. Existing employees may request the information, and the employer must respond within 30 business days.
Failure to provide the required written information constitutes a minor infringement under Art. 6.4 of the Law on Infringements and Sanctions in the Social Order (LISOS), punishable by fines of EUR70 to EUR750. Where the system processes personal data, separate exposure may arise under data protection law.
On October 7, 2026, the AEPD published guidance on algorithmic systems in the workplace (the AEPD Guidance). The AEPD Guidance addresses both the Royal Decree and the Warning.
The AEPD stressed that the duty to provide information regarding use of algorithmic or automated decision-making systems does not displace the requirements of the GDPR or the Organic Law 3/2018 of December 5, on the Protection of Personal Data and Guarantee of Digital Rights.
The Guidance highlights, by reference to the Warning and amongst other things:
- A Spanish entity that uses an algorithmic or automated-decision making tool remains responsible for that use, even if the tool was centrally developed by the entity’s group.
- A statement that systems are periodically reviewed is not sufficient. Audits must be verifiable and documented.
- Human involvement must be substantive and effective. Reviewers must be able to assess the score critically and depart from it, or Art. 22 GDPR may still apply. The Guidance provides more information on the application of Art. 22 GDPR.
- It is not sufficient to state that the tool does not process sensitive characteristics. A controller must check for variables that act as proxies for those characteristics.
According to the Guidance, a warning remains effective even if the information available to the AEPD regarding the subject matter of the warning, was incomplete. A warning does not sanction past conduct; it flags a risk. It is therefore the responsibility of the controller, under the accountability principle, to adapt the warning as necessary and to demonstrate compliance. The controller cannot rely on gaps in the AEPD’s information to avoid the need to comply.
The Guidance summarises and recommends example actions to be taken before deploying algorithmic or automated decision-making tools, including, amongst others:
- cataloguing the algorithmic and automated decision-making systems
- documenting the nature of the processing, responsible parties, data, inferences generated, variables, decision rules and the role of human oversight
- determining the legal basis to process personal data, the application of Art. 22 GDPR, the need for a DPIA and the application of the EU AI Act
- designing demonstrable human oversight
- and preparing accessible and targeted information for individuals.
The Guidance notes that it is for each controller to determine which measures are appropriate for its processing.
The Guidance concludes that the Royal Decree and data protection law impose overlapping transparency obligations in relation to an algorithmic or automated decision-making system. Those transparency requirements benefit different individuals: individual employees under the Royal Decree, workers’ legal representatives under the Statute of Workers, and candidates and employees under the GDPR.
Further reading
For more information, please see:
