Executive Summary
- For this supplier, the recommended first release contains scheduling and genuinely clerical CV extraction. Candidate evaluation, inferred suitability and exclusion must remain disabled until their separate release conditions are satisfied. An administrative description cannot exempt a function that profiles candidates or materially influences selection. (Regulation (EU) 2024/1689, Articles 3(1), 6(2)–(4), Annex III, point 4(a).)
- Ranking and shortlist recommendations engage the AI Act’s recruitment classification even when a person makes the final hiring decision. Automated rejection also requires assessment under the EU General Data Protection Regulation (GDPR) and its restrictions on solely automated decisions. (Regulation (EU) 2024/1689, Article 6(3), Annex III, point 4(a); Regulation (EU) 2016/679, Article 22.)
- The enacted AI Omnibus moves Chapter III, Sections 1–3, except Article 6(5), to 2 December 2027 for Annex III systems. Existing prohibitions, applicable transparency duties, the GDPR and French recruitment law require work before the first sale. A qualifying legacy system has a separate transition test. (Regulation (EU) 2026/1744, Article 1(39)–(40); Regulation (EU) 2024/1689, Articles 111 and 113.)
- Biometric emotion inference during recruitment should be excluded. The workplace prohibition permits a narrow medical or safety exception; ordinary candidate assessment does not qualify. Personality inference needs examination of the actual inputs and inferred traits. (Regulation (EU) 2024/1689, Articles 3(39), 5(1)(f)–(g); Commission Guidelines C(2025) 5052 final, paragraphs 244–259.)
- The Moroccan developer supplying its own branded product is the provider; the French employer is the deployer and ordinarily the recruitment-data controller. White-labelling, repurposing or substantial modification can change the product roles. The contracts must reflect the activities each party actually performs. (Regulation (EU) 2024/1689, Articles 2, 3 and 25; GDPR, Articles 4(7)–(8), 26 and 28.)
- EU hosting leaves Moroccan remote access subject to international-transfer assessment. The parties need an available GDPR transfer mechanism and effective safeguards, alongside the applicable Moroccan processing and outbound-transfer formalities. France’s presence on Morocco’s permitted-country list does not authorise the reverse EU-to-Morocco flow. (GDPR, Articles 44–46; Moroccan Law 09-08, Articles 2, 12, 43–44; CNDP Deliberation 236-2015, Article 1.)
- Before evaluation features are activated, the employer should complete the required impact assessment, establish review before exclusion and give the prescribed applicant and staff-representative information. The supplier should deliver evidence of job-related performance, error correction, bias controls and change management under agreed acceptance conditions. (GDPR, Articles 5, 22, 28 and 35–36; French Labour Code, Articles L1221-6, L1221-8–9 and L2312-38; Regulation (EU) 2024/1689, Articles 9–15 and 26.)
Administrative functions need a boundary that survives actual use
The initial commercial offer should separate administrative work from candidate assessment in its permissions, interface and contract. Scheduling and accurate copying of CV fields can support that narrower offer. The employer must still be able to examine every application without an undisclosed suitability filter.
Ordinary software that follows rules fixed entirely by people may fall outside the AI Act’s definition. A calendar that sends a selected appointment time therefore needs a different assessment from a system that infers which applicants deserve earlier interviews. The latter may influence progression even though its interface displays appointments. (Regulation (EU) 2024/1689, Article 3(1), recital 12.)
For an AI system within the recruitment category, Article 6(3) permits a limited exception where the system poses no significant risk of harm to health, safety or fundamental rights. The statutory formulation includes not materially influencing the outcome of decision-making. The alternative grounds concern a narrow procedural task, improving the result of a completed human activity, detecting decision-making patterns or deviations from earlier patterns, or a preparatory task. The pattern-checking ground requires that the system neither replace nor influence a completed human assessment without proper human review. Performing one listed task does not dispense with the substantive risk condition. An Annex III system that profiles natural persons is always high-risk under that provision. (Regulation (EU) 2024/1689, Article 6(2)–(3).)
Clerical extraction should reproduce stated qualifications, dates and contact details, with the original CV available alongside the fields. The product should flag uncertain extraction and allow correction before the employer uses the information. It should not infer that an employment gap shows unreliability, translate an unfamiliar qualification into a lower suitability score, or hide applications with missing fields. Those functions evaluate applicants and can materially alter selection. (Regulation (EU) 2024/1689, Article 6(3), recital 53, Annex III, point 4(a); GDPR, Articles 4(4), 5(1)(c)–(d) and 16.)
The strongest adverse classification is therefore an extractor whose apparent formatting conceals assessment. Renaming a ranking field “profile completeness” does not change what it does. The supplier should test the entire path from uploaded CV to recruiter display, including defaults, sorting and missing-data rules. Where it relies on Article 6(3), Article 6(4) requires a documented assessment before placement or service and refers to registration under Article 49(2). The commencement and transition rules must be applied to that version; the Omnibus did not delete the registration provision.
An intended-purpose record should identify permitted inputs, outputs, users and decisions, together with uses the product prevents. Licentium’s AI Act readiness assessment covers classification, operator roles and obligation timing. For this product, the decisive evidence is whether the implemented workflow preserves the stated administrative boundary.
Ranking, shortlists and interview questions require separate release decisions
Ranking candidates against a vacancy and recommending a shortlist fall squarely within recruitment and selection uses in Annex III, point 4(a). The listed category includes analysing and filtering applications and evaluating candidates. A score that evaluates professional suitability ordinarily also constitutes profiling. A recruiter’s authority to override the score does not remove that classification. (Regulation (EU) 2024/1689, Articles 3(52), 6(2)–(3), Annex III, point 4(a); GDPR, Article 4(4).)
Interview-question generation needs a more specific distinction. Drafting generic questions from a job description, followed by human review for relevance, may qualify as preparatory support. A generator that analyses an applicant’s presumed weaknesses, chooses different tests from those inferences or produces an assessment rubric can materially influence evaluation. The supplier should initially exclude personalised assessment from this module and release even generic drafting only after checking its actual effect on selection. (Regulation (EU) 2024/1689, Article 6(3), Annex III, point 4(a); French Labour Code, Articles L1221-6 and L1221-8.)
Generative functions also require a transparency assessment independent of high-risk classification. Article 50(2) requires providers to mark covered synthetic outputs in a machine-readable format and make them detectable as generated or manipulated. Its technical requirements and exceptions determine the necessary implementation. Original interview-question generation can engage that duty. A text interface intended to interact directly with applicants also requires disclosure of AI interaction unless that interaction is obvious under Article 50(1).
The Commission’s nonbinding draft transparency guidance published with C(2026) 5054 final describes a narrow exception for controlled business outputs with strictly technical content, limited professional users and no intended external use. Candidate interview questions should not be treated as exempt merely because the customer is a business. Machine-readable marking under Article 50(2) is distinct from the employer’s advance explanation of recruitment methods. (Regulation (EU) 2024/1689, Article 50(1)–(2), (5); Commission C(2026) 5054 final, Annex, paragraph 87; French Labour Code, Article L1221-8.)
The enacted timetable requires a launch plan for each version
Regulation (EU) 2026/1744 was published on 24 July 2026 and entered into force on 27 July 2026. Its amendment to Article 113 sets 2 December 2027 for Chapter III, Sections 1–3, except Article 6(5), for systems classified through Annex III. The corresponding date for Article 6(1) product-safety systems is 2 August 2028. Standalone recruitment software belongs to the Annex III analysis. (Regulation (EU) 2026/1744, Article 4 and Article 1(40)(b); Regulation (EU) 2024/1689, Article 113, third paragraph, point (c).)
The changed date does not postpone the whole Act. The workplace-emotion prohibition already applies. Providers and deployers must take tailored measures supporting AI literacy among relevant staff and others acting on their behalf. A new release after 2 August 2026 must address applicable Article 50 transparency duties. The special marking grace until 2 December 2026 covers systems placed on the market before 2 August 2026. (Regulation (EU) 2024/1689, Articles 4, 5, 50, 111(4) and 113, as amended.)
Conformity, registration and post-market provisions outside the expressly deferred sections must be read with their high-risk predicates and Article 111. The parties should specify the applicable requirements for each intended purpose, version and first placement. Requiring the supplier’s complete assessment dossier before activating ranking is a recommended contractual acceptance condition, including where statutory commencement or legacy treatment would allow a later deadline.
Legacy treatment is a real commercial alternative. Revised Article 111(2) generally makes the Act applicable to a high-risk system placed or put into service before the relevant Chapter III date only if significant design changes occur from that date. Article 5 is expressly preserved. The amendment’s recital 39 explains the transition by reference to a system type and model, including later unchanged units. Providers and deployers of high-risk systems intended for public-authority use face a 2 August 2030 backstop. (Regulation (EU) 2026/1744, Article 1(39)(a), recital 39.)
A lawful, unchanged ranking product first supplied before 2 December 2027 may therefore receive different treatment from a later new product. That possibility does not resolve GDPR lawfulness, discrimination or operational review. It also requires reliable version and first-placement records. Adding evaluative ranking after the deadline to a formerly clerical product cannot establish that the evaluative product already existed before it. In that published draft guidance, the Commission interprets Article 111’s high-risk transition as leaving cumulative Article 50 duties applicable. (Regulation (EU) 2024/1689, Articles 3(9)–(12), 111 and 113; Commission C(2026) 5054 final, Annex, paragraph 153 and footnote 50.)
Emotion and personality inference cannot be bundled into ordinary screening
The supplier should exclude biometric emotion inference from interviews. Article 5(1)(f) prohibits placing on the market, putting into service for that purpose, or using AI to infer emotions in workplaces, except for medical or safety reasons. The Commission interprets the workplace prohibition to include recruitment. Assessing enthusiasm, anxiety or apparent honesty for hiring does not become a medical or safety use because the employer calls it risk management. Applicant consent does not add an exception. (Regulation (EU) 2024/1689, Articles 3(39) and 5(1)(f), recital 44; Commission Guidelines C(2025) 5052 final, paragraphs 244–259.)
Personality inference needs examination of the mechanism. Transcribing words, inferring emotion from facial or vocal characteristics and predicting conscientiousness from interview material are different operations. A personality label cannot conceal prohibited emotion inference; biometric categorisation to infer specified sensitive characteristics may separately engage Article 5(1)(g). Other personality assessment still falls within recruitment evaluation and requires a lawful, relevant and accurate basis. Voice or video is not automatically special-category biometric data under the GDPR: its definition and identification purpose require separate analysis. (Regulation (EU) 2024/1689, Articles 3(34), 3(39), 5(1)(f)–(g), Annex III, point 4(a); GDPR, Articles 4(14), 5 and 9; French Labour Code, Articles L1221-6 and L1221-8.)
For the proposed launch, there is no operational reason to make these inferences available before the employer can substantiate their job-related necessity and validity. The recommended release excludes personality assessment as well as prohibited emotion inference. A later transcription-only function would need its own data and accuracy assessment.
The supply chain determines provider, deployer and representative duties
The Moroccan company is the AI Act provider when it develops and supplies the system under its own name. The Act covers providers placing systems on the EU market regardless of their establishment. The French employer uses the product under its authority and is the deployer. The EU location of the server does not allocate either role. (Regulation (EU) 2024/1689, Articles 2(1)(a)–(c), 3(3)–(4).)
An EU business that first places the Moroccan-branded system on the market can be its importer. A later reseller can be a distributor. A French purchaser is not automatically an importer merely because its supplier is Moroccan: the statutory test requires the relevant market-placement activity. For a high-risk release within the applicable regime, the non-EU provider must appoint an EU authorised representative by written mandate. A hosting company or sales contact fulfils that role only if properly appointed and able to perform Article 22 duties. (Regulation (EU) 2024/1689, Articles 3(6)–(7), 22–24.)
EU branding can change the allocation. An employer commissioning a system under its own name may be a provider under Article 3(3). Article 25 also addresses rebranding an existing high-risk system, substantial modification and repurposing a previously non-high-risk system into a high-risk use. Its rebranding rule expressly preserves contractual arrangements allocating obligations otherwise. That qualification requires careful drafting; a contract cannot generally remove statutory responsibilities triggered by the parties’ activities. (Regulation (EU) 2024/1689, Article 25(1).)
Substantial modification concerns a change after placement on the market or putting into service that was not foreseen or planned in the initial conformity assessment and that affects compliance with Chapter III, Section 2 or modifies the assessed intended purpose. Ordinary configuration within the assessed use is not automatically such a modification. If the employer adds its own screening logic, the parties must reassess who provides the resulting system and whether a new conformity assessment is required. The original provider’s cooperation duties and the required written arrangements with component or model suppliers must be addressed expressly. Article 25(2) limits its cooperation duty where the original supplier expressly prohibited changing its system into high-risk AI. An employer cannot assume an unconditional right to the supplier’s assistance with that repurposing. (Regulation (EU) 2024/1689, Articles 3(23), 25(2), (4)–(5), 43(4), as amended by Regulation (EU) 2026/1744, Article 1(12).)
The employer needs a lawful purpose for each use of applicant data
The French employer ordinarily determines why candidates are assessed and the essential means of selection. It is therefore the controller. The Moroccan supplier can act as processor when it operates the service solely on documented instructions. Using CVs to train a general product or create independent benchmarks requires separate analysis of purpose, legal basis and controller status. A processor agreement cannot convert the supplier’s own purposes into the employer’s instructions. (GDPR, Articles 4(7)–(8), 5(1)(b), 26 and 28(3), (10).)
Pre-contractual processing requested by an applicant can rely on Article 6(1)(b) where objectively necessary. Other recruitment operations may require a legitimate-interest assessment under Article 6(1)(f), including necessity, balancing and applicable objection rights. The employer’s subscription contract with the vendor supplies no legal basis for candidate processing. Blanket consent is unsuitable where refusal disadvantages the applicant or consent is otherwise not freely given. Sensitive data require an applicable Article 9 condition in addition to the ordinary lawfulness requirements. (GDPR, Articles 5–7, 9 and 21, recital 43.)
Data collection should follow the job criteria. The initial parser should avoid irrelevant health, family, religious or other sensitive information, including where applicants volunteer it. Retain source material needed to check extraction under restricted access for a justified period, excluding irrelevant sensitive material where required. Provide correction routes and restrict production-data access to authorised support tasks. Separate service delivery from any proposed model training, with training disabled by default until its independent legal conditions are established. (GDPR, Articles 5, 9, 16, 25, 28 and 32.)
Candidates need clear information about purposes, legal bases, recipients, transfers, retention and rights. Articles 13 and 14 impose different notice timing depending on whether information comes from the applicant or another source. Where Article 22 decision-making applies, the notice must include the prescribed information about its logic, significance and envisaged consequences. The employer needs corresponding technical information from the supplier to answer access and correction requests. (GDPR, Articles 12–16 and 28(3)(e).)
Retention must distinguish active recruitment, a future-opportunities pool, restricted evidence archives and technical logs. CNIL recommends normally limiting a recruitment pool to two years from the last contact. That recommendation does not create a universal statutory retention period. Claims for damages for employment discrimination have a five-year limitation running from revelation of the discrimination. That rule does not require every CV to be retained for five years from rejection. Record the purpose and justification for each period, segregate dispute evidence and apply a litigation hold only to necessary material. (GDPR, Article 5(1)(e); French Labour Code, Article L1134-5; CNIL, Référentiel des durées de conservation en matière de gestion des ressources humaines, updated 20 May 2026, p. 3.)
The vendor’s own territorial GDPR position also needs determination. Serving an EU customer or buying EU hosting does not alone establish an EU establishment or Article 3(2) targeting. Processing related to monitoring applicants’ behaviour in the EU can engage Article 3(2)(b). Where that provision applies, Article 27 representation must be assessed separately from the AI Act representative. (GDPR, Articles 3 and 27; EDPB Guidelines 3/2018, version 2.1, sections 1, 2 and 4.)
Effective intervention must occur before an applicant is excluded
The employer should not enable automated rejection for the first release. Article 22 restricts decisions based solely on automated processing that produce legal or similarly significant effects. Excluding a person from consideration for employment can meet that threshold. Human involvement must affect the actual decision. In its nonbinding recruitment guidance, France’s data regulator, the CNIL, explains why nominal approval does not establish effective human intervention. A reviewer needs time, information and authority to depart from the recommendation. (GDPR, Article 22; CNIL, Guide du recrutement, 30 January 2023, fiche 13.)
Reviewing only the top-ranked candidates leaves the remaining applicants excluded through the ranking. The workflow should allow a competent reviewer to consider the original application, challenge the criteria and change the progression decision before exclusion. Record the reviewer’s reasons and correction where relevant. Review capacity must match the actual volume and timetable. A process that makes independent review impossible cannot rely on a nominal approval field. (GDPR, Articles 5(2), 22 and 24; CNIL, Guide du recrutement, fiche 13.)
Automated rejection is not prohibited in every conceivable recruitment process. Article 22(2) permits limited exceptions for contractual necessity, explicit consent or authorisation by applicable EU or Member State law containing suitable safeguards. Commercial convenience alone does not establish necessity, and applicant consent must be freely given. Contractual and consent exceptions require safeguards, including human intervention, an opportunity to express a view and contestation. Special-category decisions face Article 22(4)’s additional restrictions. For the contractual and consent routes, French law also requires requested disclosure of the processing rules and principal implementation characteristics. (GDPR, Article 22(2)–(4); Law 78-17 of 6 January 1978, Article 47.)
An appeal after rejection may provide a safeguard for a lawfully authorised automated decision. It does not retroactively make the original decision human. Before activating that route, the employer must substantiate the specific exception and provide a review process capable of changing the result while the opportunity remains available.
Explanations must describe the procedure and principles actually applied, including how the person’s data affected the result. A complex formula or generic claim that “AI matched the vacancy” is insufficient. Where an access request raises a trade-secret objection, the Court of Justice requires the allegedly protected information to be provided to the competent authority or court for balancing. The supplier’s contract must allow the employer to meet those duties. (Case C-203/22, Dun & Bradstreet Austria, EU:C:2025:117, paragraphs 57–62 and 69–76.)
French recruitment law controls questions, criteria and staff information
The employer may request applicant information only to assess ability to perform the proposed job or professional aptitude. That information must have a direct and necessary connection to those purposes. Candidates must receive advance express notice of recruitment methods; results are confidential and the methods must be relevant. Personal information cannot be collected through a device that was not previously disclosed. These duties apply to clerical and evaluative versions. (French Labour Code, Articles L1221-6, L1221-8 and L1221-9.)
A generated question about family plans, an inferred health condition or a personality trait unrelated to the role fails that product boundary. The employer should approve a job-related question set and restrict personalised generation until it can validate relevance. Candidate-facing notices should identify the functions actually used, including extraction, ranking or automated exclusion where present. A general statement that recruitment involves technology does not describe an undisclosed assessment method.
Selection criteria must also comply with the prohibition of direct and indirect discrimination. A name, postcode, career gap or language feature can operate as a proxy for protected characteristics. The employer should document the job-related reason for each criterion and examine differential errors across relevant candidate groups. Historical hiring outcomes require scrutiny before use as labels because they may reproduce discriminatory choices. An occupational-requirement exception requires an essential and determining requirement, a legitimate aim and proportionality. (French Labour Code, Articles L1132-1 and L1133-1; Law 2008-496 of 27 May 2008, Article 1.)
For an apparently neutral criterion causing particular disadvantage, the distinct indirect-discrimination justification requires an objectively legitimate aim and appropriate, necessary means. Differential results therefore require investigation of the criterion, disadvantage and justification. The employer must also make the appropriate adjustments required for protected disabled applicants to access employment, subject to the disproportionate-burden qualification. The product should support an accessible alternative assessment where needed. (Law 2008-496, Article 1; French Labour Code, Article L5213-6.)
Records matter if a candidate establishes facts suggesting discrimination. Article L1134-1 then requires the defendant to prove objective reasons unrelated to discrimination. Preserve the criteria and model version used, the source information, corrections and the actual decision reasons within a justified retention policy. A supplier’s general fairness statement cannot explain an individual rejection.
For employers within the social and economic committee regime applicable to enterprises with at least 50 employees, Article L2312-38 requires prior information about recruitment-assistance methods and changes. It separately requires information about automated personnel-management processing and prior information and consultation for employee-activity monitoring. Recruitment-method information must not be relabelled as a universal consultation requirement. Article L2312-8 separately requires information and consultation on the introduction of new technologies and specified organisational or working-condition matters. Threshold rules, applicable agreements and the actual use determine the procedure. (French Labour Code, Articles L2312-1, L2312-8 and L2312-38.)
Moroccan support access requires a GDPR transfer route
The employer must map remote access as well as storage. Making candidate data available to a separate Moroccan supplier is an EU-to-third-country transfer even when the server remains in the EU. Morocco has no EU adequacy decision. The exporter therefore needs an available Article 46 safeguard unless a genuinely applicable exceptional derogation exists. Routine engineering access should not depend on repeated reliance on Article 49 exceptions. (GDPR, Articles 44–46 and 49; EDPB Guidelines 05/2021, version 2.0, section 2.)
For a French controller exporting to a Moroccan processor whose relevant processing is outside Article 3 GDPR territorial scope, the 2021 standard contractual clauses’ Module Two are the usual contractual route. Module Three concerns an actual processor-to-processor chain. The parties must identify who makes the data available, the importer’s capacity and each subprocessor; the hosting location alone does not answer those questions. (Commission Implementing Decision (EU) 2021/914, Article 1(1), Annex, Modules Two and Three.)
The 2021 clauses were adopted for importers whose relevant processing is not already subject to the GDPR. If the Moroccan supplier’s processing falls within Article 3(2), signing those clauses does not automatically provide the approved route. Another valid Article 46 mechanism is needed; individually negotiated clauses require the competent supervisory authority’s authorisation. The parties should resolve territorial scope before selecting the transfer instrument. (Decision (EU) 2021/914, Article 1(1); GDPR, Article 46(3)(a).)
Signing clauses also requires an assessment of whether the destination’s laws and practices allow their obligations to be met. The exporter and importer must examine the actual data, access, onward disclosures and relevant public-authority powers, then implement effective supplementary safeguards where needed. Clauses 14–16 address that assessment, authority requests and suspension or termination where compliance fails. (Decision (EU) 2021/914, Annex, clauses 14–16.)
EU-controlled keys and transport encryption do not protect data from a support user who is authorised to see readable content. The recommended access design uses approved support tickets, minimum fields, time-limited permissions, access logs and restrictions on downloads. Pseudonymisation helps only where the recipient cannot reidentify candidates using information available to it. Where effective protection cannot be established, the alternative launch design keeps identifiable support within the EU and provides Moroccan engineering staff with genuinely anonymous or synthetic debugging material. That is a change to the proposed operating model. It must prevent identifiable records reaching the Moroccan supplier through screens, tickets, logs or administration access, and identify the EU operator handling those records. (GDPR, Articles 25, 32 and 44–46; EDPB Recommendations 01/2020, version 2.0, Annex 2.)
Moroccan processing and return flows require their own formalities
Moroccan Law 09-08 can apply even though the employer and hosting infrastructure are in France or elsewhere in the EU. Article 2 covers a controller established abroad that uses processing means in Morocco beyond mere transit. Staff accessing and using candidate data for support can bring the operation within that rule. Article 2(3) then requires the foreign controller to notify Morocco’s data protection authority, the CNDP, of a representative established in Morocco. (Law 09-08, Articles 1(2) and 2(2)–(3).)
The French employer remains responsible for the recruitment purposes it determines. The controller or its properly notified Moroccan representative must make the applicable filing, with the supplier providing technical and security information. If the supplier uses data for its own training purpose, it needs a separate controller analysis and corresponding formalities. Describing the vendor as the controller solely because it is Moroccan would misallocate the recruitment duties. (Law 09-08, Articles 1(5), 2, 14–15 and 23.)
Article 12 requires prior authorisation for specified processing, including sensitive data, certain changes of purpose, national identity-card numbers and specified interconnections. Other processing generally requires prior declaration under Articles 13–15, subject to the statutory exemptions. The parties should establish the correct filing category and obtain the required receipt or authorisation before Moroccan access begins. Removing unnecessary identity-card and sensitive fields can reduce the processing requested, but does not eliminate the territorial analysis.
The controller must also satisfy Moroccan purpose and proportionality rules, identify an Article 4 ground and provide Article 5 information. Filing with the CNDP supplies no independent lawful basis. Article 23 requires sufficient processor-security guarantees, binding instructions and security terms. The service’s notices and processing agreement should address those duties alongside the GDPR requirements. (Law 09-08, Articles 3–5 and 23.)
When data processed in Morocco are sent or made available abroad, Articles 43–44 require a separate outbound-transfer assessment. France appears on the CNDP’s sufficient-protection list. Deliberation 236-2015 expressly preserves notification under the appropriate regime for all transfers. The actual EU hosting country and every destination must be identified; an “EU-hosted” label is insufficient. The CNDP’s procedure also connects the transfer filing with the underlying processing declaration or authorisation. (Law 09-08, Articles 43–44; CNDP Deliberation 236-2015 of 18 December 2015, Article 1.)
The flows therefore require distinct records: the French exporter’s GDPR route for access from Morocco; the Moroccan processing formalities for the relevant controller; and the outbound arrangements for data or identifiable results returned from Morocco. Permission in one direction does not establish permission in the other.
Moroccan restrictions on automated decisions also need attention where the processing falls within Law 09-08. Article 11 addresses decisions producing legal effects based solely on automated processing that defines a profile or evaluates personality. It treats a decision made in concluding or performing a contract as not solely automated where the person could present observations. It separately excludes decisions satisfying the person’s request from that category. Compliance with that provision leaves the French employer’s GDPR and employment duties applicable. (Law 09-08, Article 11; GDPR, Article 22.)
Evidence for evaluation must connect supplier testing with employer operation
Before ranking or shortlisting begins, the employer should complete a data protection impact assessment. Article 35 requires one for processing likely to create high risks; CNIL’s mandatory list specifically includes recruitment profiling. Human review does not itself remove that requirement. The supplier must assist under Article 28(3)(f). If high residual risk cannot be reduced, Article 36 requires prior consultation with the supervisory authority. A genuinely clerical version needs a documented assessment of whether the threshold is met. (GDPR, Articles 28, 35–36; CNIL Deliberation 2018-327 of 11 October 2018, annex.)
For an evaluative version within the applicable AI Act regime, the provider needs risk management, data controls, technical documentation, logging capability and instructions enabling the employer to interpret outputs. Testing should establish performance for the intended French jobs, French and English input, relevant qualifications and foreseeable errors. The dossier should identify training, validation and test-data origins, original collection purposes, preparation and suitability for that use. It must also document the required accuracy, technical robustness and cybersecurity measures. The supplier should record acceptance criteria, limitations and corrections before the customer enables assessment. These requirements follow Articles 9–15 and Annex IV; obtaining that evidence earlier is the recommended contractual condition.
Bias testing needs a lawful data design. New Article 4a exceptionally permits strictly necessary special-category processing for specified bias detection and correction, subject to cumulative safeguards. Those include unavailable effective alternatives, restricted reuse and access, documented necessity, deletion limits and a prohibition on making the data accessible to other parties. It does not permit routine candidate trait scoring or unrestricted sharing of sensitive audit data with the Moroccan vendor. Employer-controlled testing with genuinely anonymous aggregate results is the recommended starting design. (Regulation (EU) 2024/1689, Article 4a, inserted by Regulation (EU) 2026/1744, Article 1(6); GDPR, Articles 5 and 9; Law 09-08, Article 12.)
The applicable high-risk provider package also includes quality management, the conformity assessment, the declaration of conformity, CE marking, registration and post-market arrangements. Recruitment systems in Annex III, point 4, ordinarily use the internal-control route under Article 43(2) and Annex VI. CE marking therefore must not be presented as an individual regulator’s approval. Article 18 requires specified provider documentation to be kept for ten years; that period does not authorise ten years of candidate-CV retention. (Regulation (EU) 2024/1689, Articles 16–18, 43(2), 47–49 and 72–73.)
The employer’s corresponding duties include following instructions, assigning competent people with authority to oversee use, checking input data within its control and monitoring operation. Provider and deployer logs under their control have a minimum six-month retention rule within the applicable regime, unless other applicable law provides otherwise. Workers, representatives and affected candidates must receive the information required by Article 26, alongside existing French and GDPR duties. (Regulation (EU) 2024/1689, Articles 19 and 26(1)–(7), (11).)
Article 86 separately requires an explanation from the deployer where an applicable high-risk recruitment system’s output supports a qualifying adverse decision. The decision must produce legal or similarly significant effects that the person considers adverse to their health, safety or fundamental rights. The explanation covers the system’s role and the main elements of the decision. Human participation does not by itself remove this right. Article 86(2)–(3) preserves lawful restrictions and limits the right to what is not already provided by EU law. The contract should therefore support explanations for qualifying decisions assisted by AI, alongside GDPR Article 22 cases. (Regulation (EU) 2024/1689, Article 86.)
A fundamental-rights impact assessment under Article 27 is not automatically required of every private employer. It applies to the specified deployers, including public-law bodies and private entities providing public services. An employer within those categories must assess that additional duty. The amended Article 27(4) permits relevant cross-references to a DPIA; the assessments still require their respective elements. (Regulation (EU) 2024/1689, Article 27, as amended by Regulation (EU) 2026/1744, Article 1(13).)
The first customer contract should control activation, changes and failure
The first release should enable scheduling and verified clerical extraction, with evaluation permissions disabled. Before real candidate data enter the service, the parties need executed processor terms and the employer needs its lawful-basis and notice decisions, required staff information and DPIA screening. Applicable transfer safeguards and Moroccan formalities must be complete before data are made available to the Moroccan supplier. These conditions arise from existing data and employment duties, independently of the later Chapter III date. (GDPR, Articles 5–6, 13–14, 28, 35 and 44–46; French Labour Code, Articles L1221-8–9 and L2312-38; Law 09-08, Articles 2 and 12–15.)
The contract should identify each enabled function, its intended use and who may approve a change. It should require advance notice of model replacements, prompt or scoring changes and new training sources. Subprocessors need prior specific or general written authorisation; general authorisation requires notice of additions or replacements and an opportunity to object. The employer needs access to performance evidence, incident information and explanations sufficient for its legal duties. The vendor needs enforceable restrictions on repurposing an administrative version for unsupported assessment. Licentium’s data protection work for AI products covers lawful-basis analysis, DPIAs and supplier-contract documentation relevant to those arrangements. (GDPR, Article 28(2)–(4); Regulation (EU) 2024/1689, Articles 13, 25 and 26, within their applicable regime.)
The processor terms must provide for the required return or deletion at service end, access to compliance evidence and audits. For this AI hiring software, GDPR rights assistance should identify who retrieves a candidate’s inputs, corrects an extraction error and explains the recorded decision. Those duties need service arrangements that the employer can use during an active recruitment round. (GDPR, Article 28(3)(e)–(h).)
Generic question drafting may follow after a separate assessment of content, applicant information and Article 50 duties. Ranking and shortlist recommendations should follow only after the employer’s DPIA, job-related validation, effective pre-exclusion review and the agreed provider dossier are complete. Automatic rejection requires its own Article 22 justification and safeguards; biometric emotion inference remains excluded. Activation should record the approved version, purpose, configuration and persons responsible for monitoring it.
The failure procedure must work while a vacancy is still open. If a parsing error or unsupported ranking excludes candidates, the employer should suspend the affected automation, preserve necessary evidence and arrange fresh review of affected applications. The supplier should correct the defect and assist with rights requests. A selection error is not automatically a reportable personal-data breach; discriminatory harm can separately engage the AI Act’s serious-incident test for infringements of EU fundamental-rights obligations. Require immediate internal escalation so the responsible party can assess the event and meet applicable notification periods. (GDPR, Articles 5(1)(d), 16, 18, 28(3)(f), 33–34; Regulation (EU) 2024/1689, Articles 3(49)(c), 20, 26(5) and 73, where applicable.)
The agreement should allocate investigation costs, remediation assistance, suspension rights and termination or migration where lawful operation cannot be restored. Those provisions cannot prevent candidates exercising statutory rights or transfer the employer’s decision duties to a software disclaimer. Expansion into another Member State should require a fresh national employment-law check before that destination is enabled. For the first French customer, release authority should remain conditional on the documented function, lawful data flow and review process actually operating as agreed.