What happened
On September 23, 2026, the Spanish data protection authority, the AEPD, issued warning AI-00009-2026 under Article 58(2) of the GDPR to a company that planned to use an AI tool to screen and assess candidates for recruitment and promotions. The tool was intended to analyse CVs, score applications and rank them. The company described it as a support tool and said a human would always make the final recruitment or promotion decision.
The AEPD accepted that AI can improve the efficiency and consistency of recruitment, and that the GDPR does not prohibit these technologies, but it said safeguards must be proportionate to the risk. It also explained what a warning is: a preventive measure available where planned processing might breach the GDPR, without the regulator needing to be certain a breach would occur. It is not a sanction. The company was told that failing to act on it could lead to an investigation and corrective action, including sanctions.
The central point in the warning is about oversight. The AEPD said any human intervention must be effective, and the decision maker must be able to critically assess the tool's score and reach an independent conclusion that has not been pre-determined by the output. A human signature over a ranked list is not oversight on those terms.
The warning landed alongside a broader shift in Spanish employment law. Royal Decree 723/2026 came into force on October 5, 2026, developing Article 8.5 of the Statute of Workers. Employers must inform each employee in writing if algorithmic or automated decision making systems are used, and where those systems decide working conditions, they must explain the system's guidelines, criteria and operating rules. New employees must receive the information before employment starts, and existing employees can request it, with the employer required to respond within 30 business days. Failure to provide the written information is a minor infringement punishable by fines of EUR 70 to EUR 750, with separate exposure under data protection law where personal data is processed. On October 7 the AEPD published guidance on algorithmic systems in the workplace. It stressed that the new disclosure duty does not displace GDPR obligations, that warnings remain effective even where the authority's information was incomplete, and that the controller must adapt and demonstrate compliance under the accountability principle.
Why this is a GRC story
Human in the loop has to be a working control. Real oversight needs authority, information, time and the practical ability to override the model. Where that is missing, the control is documentation rather than mitigation.
Transparency obligations are stacking. Employment law disclosure, GDPR information duties and rights around automated decisions overlap. One notice has to satisfy all of them, and the AEPD says the employment rule does not reduce the data protection one.
Small fines, useful leverage. A penalty capped at EUR 750 sounds harmless, but the guidance and the warning are the documents a complainant or auditor will cite, and they set out what the regulator expects to see.
What to watch
Watch whether the next AEPD case moves from warning to sanction, and whether other EU authorities publish comparable workplace guidance. For employers, the useful test is whether the recruitment tool's documentation can show how a reviewer was equipped to disagree with it.
Attribution: Analysis based on A&O Shearman on JD Supra and related public reporting. This article is original commentary, not a repost of the source material.