What can an AI agent do for hiring in a 20-person business?
In a small business, hiring time mostly goes on what surrounds the decision: replying to each applicant, finding the CV that arrived by email ten days ago, offering three time slots, chasing the person who never confirmed, preparing interview questions. An AI agent can take these tasks on because they repeat and are easy to correct. It can also read each application and place it in a grid you wrote (required qualification, driving licence, availability, experience with a given software), noting the reason. That sorting helps the person hiring: they read the applications that tick every box first, and see at a glance what the others are missing. What the agent does not do is reject, select or score a candidate without someone reviewing it. For current employees, it can answer recurring questions (leave, health cover, remote work) from your own documents, and pass the question to a person as soon as the answer commits the business.
| Hiring step | What the agent can do | What a person keeps |
|---|---|---|
| Receiving applications | Acknowledge, gather CV and cover letter in one file, flag a missing document | Nothing to approve except the message template |
| First sort | Place each application against your written criteria, with the reason | Read the sort, decide who is turned down |
| Rejections | Draft the rejection message | Approve each rejection before it is sent |
| Interviews | Offer time slots, chase, prepare a pack per candidate | Run the interview, judge |
| Hiring | Prepare the list of documents and formalities | Choose, sign |
Why must the hiring decision stay with a person?
Because the rules already say so, before the AI Act even applies. Article 22 of the GDPR gives everyone the right not to be subject to a decision based solely on automated processing that significantly affects them. Turning down a job application is such a decision. The exceptions (contract, law, explicit consent) always come with the right to obtain human intervention, to express one's point of view and to contest the decision. A rubber stamp, where someone clicks "send" on a hundred rejections without reading them, does not count as human intervention: the guidelines of the European data protection authorities require the reviewer to have the authority and competence to change the decision.
If you hire in France, the Labour Code adds two simple duties. Candidates must be expressly told, before they are used, which methods and techniques assist the recruitment, and those methods must be relevant to the job (article L1221-8). No personal information may be collected through a system the candidate was not told about (article L1221-9). In practice, one sentence in the job ad and in the acknowledgement is enough: applications are sorted with the help of a tool, against these criteria, and a person reads every application.
Does the EU AI Act treat a CV-screening agent as high risk?
Yes, in most cases. Annex III of the EU AI regulation (point 4) lists as high risk the systems used to recruit or select people, in particular to analyse and filter applications and to evaluate candidates. A tool that only performs a narrow procedural task can fall outside that category, but a tool that profiles candidates is always high risk (article 6, paragraph 3). According to the timeline published by the European Commission, as amended by the Digital Omnibus, the rules for these systems apply from 2 December 2027.
For the business using the tool (the "deployer" in the text), article 26 requires among other things:
- human oversight by a competent, trained person with the authority to say no;
- use in line with the provider's instructions, with input data relevant to the job;
- keeping the logs the tool produces for at least six months;
- informing employees and their representatives before such a system is put into service at the workplace.
None of this prevents you from using an agent for scheduling, follow-ups or acknowledgements, which sort nobody. The line runs between what organises and what selects.
How do you set up a recruiting agent without losing control?
Start with the tasks that sort nobody, then add the sorting of applications once the criteria are written and reviewed. In order:
- Write down the job criteria, the required ones and the nice-to-have ones. If you cannot write them, the agent cannot apply them, and you could not justify them to a candidate who challenges a decision.
- Tell candidates in the job ad and the acknowledgement: a tool helps sort applications, a person reads every one, here is who to contact.
- Hand over the organising first: acknowledgements, follow-ups, scheduling, interview packs.
- Add the sorting of applications against the grid, with a written reason for each. Check on the first twenty applications that the agent sorts the way you would have.
- Have every rejection reviewed by a named person before it goes out. Keep a record of who approved what.
This is the rule we apply to our own agents at Équipage IA: they prepare, and a person approves anything that commits the business to someone outside it. We explain that split in what to open to an AI agent and what to keep, and the difference between an agent and a simple assistant in what an AI agent really does in a business.
What about current employees?
The questions that come back every week (leave balance, health cover, remote work rules, payday) suit an agent that answers from your own documents and quotes the passage it used. Two limits: it does not run payroll in place of your payroll software, and it hands over to a person as soon as an answer commits the business (a refused leave request, a personal situation). In France, from 50 employees, introducing a new technology requires informing and consulting the staff committee (article L2312-8 of the Labour Code). A 20-person business is below that threshold, but telling the team before you start is still the best way to keep them from distrusting the tool. Other changes to expect in a team that size are covered in what AI changes in a 20-person business.
What the pages on this topic leave out
Method: on 20 October 2026, we read, in part for some, three pages ranking well on Google France for "agent IA RH": an HR trade publication, a chatbot vendor and a skills-management software vendor.
In the parts we read, none mentions the French rule that candidates must be told before an assessment tool is used on them. Only one gives the date the AI Act applies to hiring, and it is written for the HR director of a large organisation. The other two mainly present their own product. Our reading: a small business owner who hires two or three people a year is less interested in a definition of an HR agent than in the exact line between what can be handed over and what must be kept. That line is what this article draws.
We do not yet have measured figures on hiring handled by our agents. When we do, they will be added to this page.
FAQ
Can an AI agent reject a job application on its own?
No. A rejection significantly affects the candidate: article 22 of the GDPR gives them the right to human intervention and to contest the decision. The agent can draft the rejection, a person reviews and approves it.
Do you have to tell candidates an AI tool sorts their CV?
In France, yes: article L1221-8 of the Labour Code requires candidates to be expressly told about the recruitment methods and techniques used on them, before they are used. Under the GDPR, candidates must also be told about any automated decision-making. One sentence in the ad and the acknowledgement covers it, as long as it says a person reads every application.
Does the EU AI Act already apply to hiring?
The rules for high-risk systems in Annex III, which include filtering applications, apply from 2 December 2027 according to the timeline published by the European Commission. The GDPR obligations apply already.
Which HR tasks should you hand to an agent first?
The ones that sort nobody: acknowledgements, follow-ups, scheduling, interview packs, and answers to employees' recurring questions from your own documents. Sorting applications comes next, once the criteria are written down.
Sources: Regulation (EU) 2016/679 (GDPR), articles 13 and 22, text published by the CNIL (cnil.fr, read 20 October 2026) and CNIL page on profiling and fully automated decisions (cnil.fr, read 21 October 2026) · Article 29 Working Party, guidelines WP251 on automated individual decision-making and profiling, published by the CNIL (cnil.fr, read 21 October 2026) · French Labour Code, articles L1221-8, L1221-9 and L2312-8 (code.travail.gouv.fr, read 20 October 2026) · Regulation (EU) 2024/1689 on artificial intelligence, article 6, Annex III and article 26 (AI Act Service Desk, European Commission, consolidated text as of 27 July 2026, read 21 October 2026) · European Commission, AI Act implementation timeline including the Digital Omnibus (ai-act-service-desk.ec.europa.eu, read 21 October 2026: Annex III rules apply from 2 December 2027) · Reading of three pages ranking well on Google France for "agent IA RH", 20 October 2026. No client is named.