By profession

AI in recruiting: what is allowed, and what tips into high risk

A recruiting team handles dozens of files full of personal data every week: career history, address, an age that can be inferred, sometimes health information. As generative AI reaches HR teams, one question is rarely settled precisely: at what point does an ordinary office use become a screening system classified as high-risk by the EU AI Act?

Published on August 2, 2026 by the Moon AI team. Legal references checked at their source on that date.

Three legal regimes apply to AI-assisted recruiting

Since August 2, 2026, Regulation (EU) 2024/1689 on artificial intelligence (the AI Act) has applied. Its Annex III, point 4(a), classifies as high-risk the AI systems intended for the recruitment or selection of natural persons, in particular to place targeted job advertisements, to analyze and filter job applications and to evaluate candidates. This classification depends neither on the size of the company nor on the volume processed. French labor law adds an earlier layer that is still in force: informing candidates in advance about the recruitment methods used, relevance of the information requested, non-discrimination, informing the CSE, the elected employee representative council. Finally, the GDPR governs automated individual decisions. A single project can fall under all three regimes at once, and an employer that uses such a system is its deployer within the meaning of the regulation, with the specific obligations of Article 26.

AI systems intended for the recruitment or selection of natural persons, in particular to analyze and filter job applications and to evaluate candidates, are classified as high-risk by Annex III, point 4(a), of Regulation (EU) 2024/1689. source (in French)
Candidates must be expressly informed, before they are used, of the recruitment methods and techniques applied to them. These methods must be relevant to the purpose pursued, and the results obtained are confidential (Article L1221-8 of the French Labor Code). source (in French)
The information requested from a candidate may serve only to assess their ability to do the job offered or their professional skills, and must have a direct and necessary link with the job (Article L1221-6 of the French Labor Code). source (in French)
No one may be excluded from a recruitment process because of, among other things, their origin, sex, age, state of health, disability, place of residence or religious beliefs (Article L1132-1 of the French Labor Code). Indirect discrimination produced by a statistical model is still discrimination. source (in French)
The CSE, the employee representative council, is informed, before they are used, about the methods or techniques used to help recruit job candidates and about any change to them (Article L2312-38 of the French Labor Code). source (in French)

What AI does in practice

Each case lists the personal data it involves, and therefore what Moon Blur removes before sending to the model.

Writing and fine-tuning a job posting

Write the posting from the job description, produce a short version for job boards and a long one for the careers site, and review the wording to spot phrasing that implicitly excludes a category of candidates: a mention of age, gendered wording, a mobility requirement unrelated to the job. Legally the simplest use, since no candidate data is involved.

Data involved: No candidate data at this stage. Only information about the job and the company is shared. Nothing to mask.

Building a structured interview guide

Derive from the job description a list of questions tied to observable skills, with a scoring grid shared by all candidates. A structured interview, identical for everyone, leaves a record of what was actually assessed, which makes the choices made easier to justify. This record does not prejudge how anything would be assessed in a dispute.

Data involved: The guide is built around the job, not the person. If a file is attached for context, Moon Blur removes contact details, address and date of birth before sending to the model; the name only if it is in your terms to mask.

Cleaning up interview notes

Turn notes taken on the fly into a structured report, aligned with the assessment grid, leaving out observations unrelated to the job offered. Useful for keeping several recruiters consistent on the same process, and for producing a usable document if the candidate one day asks for access to their file.

Data involved: Interview notes containing identity, age, family situation, sometimes health information mentioned spontaneously. Moon Blur removes the contact details, dates and identification numbers it recognizes before sending and restores them on return; names are masked only if they are in your terms to mask.

Summarizing an application without scoring or ranking it

Condense a long résumé or a cover letter into a few factual lines to prepare a human reading. The line is clear: as soon as the tool assigns a score, a rank or an automatic filter, the use falls under Annex III, point 4(a), and an employer that repurposes a general-purpose assistant for this may take on the role of provider (Article 25).

Data involved: Full résumé: identity, contact details, date of birth, photo, address, nationality. Moon Blur removes contact details, date of birth and address before sending (the name only if it is in your terms to mask; the photo and nationality are not masked); the summary comes back matched to the right file.

Writing replies to candidates

Produce personalized, readable rejections instead of silence, and prepare interview invitations, follow-ups and requests for documents. The recruiter reviews and approves every message. The time saved is on writing, not on the decision, which is still made and owned by a person.

Data involved: Name, email address, position applied for, stage in the process. Moon Blur replaces the email address before sending to the model (the name only if it is in your terms to mask); the values are put back on return, on the recruiter’s side.

Producing employer branding materials

Careers pages, social media posts, a presentation of the onboarding path, a FAQ for candidates, a brochure presenting the company’s jobs. Deliverables come out directly as Word, PDF or PowerPoint files, with no reformatting needed.

Data involved: No candidate data. If employee testimonials are used, the employees’ consent must be obtained before any use, whatever the tool.

Eight questions to ask about a tool

This checklist applies to any tool on the market. The last column gives Moon AI’s answer, including when it is no.

Checklist for evaluating an AI tool for recruiters
Criterion	Why it matters here	Moon AI
Where hosting and processing take place	Applications contain data the employer remains responsible for. Hosting in the Union simplifies the analysis of transfers and the answer to a candidate who asks where their data is and who can access it.	App and storage at OVHcloud, Strasbourg and Roubaix. The third-party models it calls run at their respective publishers.
Reversible masking before sending to the model	A résumé sent as it is exposes the name, address, date of birth and sometimes health information to a third-party provider. Removing these elements upstream reduces exposure and cuts some of the biases linked to a name or a place of residence.	Moon Blur masks more than 150 categories of personal data it detects before sending and restores them on return; names are masked only if they are in your terms to mask, and detection may be incomplete.
What happens to content sent to third-party models	An application reused to train a model escapes the employer’s control and makes any later erasure request from the candidate ineffective.	Partial. Moon Blur limits what reaches third-party models; each provider’s retention policies remain its own and should be checked.
Processing agreement and record of processing activities	The employer remains the data controller. Without a data processing agreement within the meaning of the GDPR and an entry in the record of processing activities, even occasional use of AI in recruiting is hard to justify during an inspection.	Data processing agreement available. Publisher identified in France: Stellarr Studio SAS, Pont-Audemer, SIREN 101 691 103.
Traceability of use and logging	The deployer must be able to show who used what, when and with what result. Without a usable log, there is no serious answer to a candidate who disputes how their file was handled.	History per workspace, member and role management. No certified audit trail within the meaning of the AI Act.
Where the human decision actually sits	Article 22 of Regulation (EU) 2016/679 gives data subjects the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them. The tool must make human involvement structural, not a box ticked after the fact.	The tool produces texts and analyses; it does not rank or reject any application on its own. Write actions by connectors ask for approval, unless you choose “Act without asking”.
Reversibility and content export	An HR team changes tools. Interview guides, reports and reply templates must be exportable in an open format, without exit fees or negotiation with the provider.	Conversation export and generation of Word, PDF, Excel and PowerPoint documents. No bulk export API to date.
Transparency about the model actually used	Informing a candidate properly means knowing which processing applies. A tool that hides which model answers, its version and its publisher makes it impossible to write accurate information within the meaning of Article L1221-8.	The model is shown and can be chosen among more than 100, including Moon 6, the in-house model. They run at their publishers.

When to rule out a tool

Objective criteria, verifiable in any publisher’s public documentation.

A tool that scores, ranks or rates candidates’ fit without documenting its logic: this falls under Annex III, point 4(a), of the AI Act and commits the employer well beyond a simple subscription.
A tool that infers a candidate’s emotional state from their face, voice or posture: Article 5(1)(f) of the regulation prohibits these systems in the workplace, except for medical or safety reasons.
Hosting or processing outside the European Union without the provider documenting the transfer mechanism or the list of its own subprocessors.
Applications sent to third-party models in plain text, with no prior reversible masking step and no way to check what was actually sent.
A provider that refuses to sign a data processing agreement: the employer remains the data controller and does not transfer that responsibility by buying a license.

What Moon AI does not do

A page for professionals that concedes nothing is not credible to them.

Moon AI does not screen, score or rank applications. This is deliberate: these functions fall under Annex III of the AI Act and require a system designed, documented and assessed for that specific use.
Moon AI is not an applicant tracking system. It does not replace job posting management, the talent pool or the retention periods specific to your recruiting tool.
Moon Blur reduces the exposure of personal data but does not eliminate it. Free text can still identify someone through its content alone; reviewing before sending remains necessary.
Moon AI is not a certified health data host and is not suited to medical fitness files or occupational health monitoring.

€9.90 per seat per month, VAT included

Lune plan. More than 100 models included, Moon Blur on, hosted in France. 20% off each extra seat in the same workspace. No commitment. See all five plans.

Start for free

Frequently asked questions

Can I use generative AI to screen résumés?

Two actions need to be told apart. Summarizing an application to prepare a human reading remains assisted office work. Filtering, ranking or scoring applications falls under Annex III, point 4(a), of Regulation (EU) 2024/1689: the system is then high-risk, and the employer that uses it is its deployer, with the obligations of Article 26 (human oversight assigned to competent people, informing workers and their representatives, informing the people concerned). Article 6(3) provides for cases where an Annex III system escapes this classification, but it specifies that a system remains high-risk whenever it performs profiling of natural persons. In other words, the margin is narrow in recruiting.

Do I have to tell candidates that I use AI?

Yes, on two separate grounds. Article L1221-8 of the French Labor Code requires informing the candidate expressly and in advance of the recruitment methods and techniques used on them. Article L1221-9 adds that no information about them may be collected by a means that has not been brought to their attention beforehand. If the system is high-risk, Article 86 of the AI Act also applies: a person affected by a decision based on the system’s output can obtain clear and meaningful explanations of the role of AI in the decision-making procedure and of the main elements of the decision.

Do I have to inform the CSE, the employee representative council?

Yes, but the rule targets companies with at least fifty employees. Article L2312-38 of the French Labor Code sits in the section on the powers of the CSE in companies with at least fifty employees. In that setting, the council is informed, before they are used, about the methods or techniques used to help recruit job candidates, and about any change to them. The same article requires prior information on automated personnel management processing. In companies with eleven to forty-nine employees, the CSE does not have this power; however, the candidate information obligations under Articles L1221-8 and L1221-9 apply regardless of headcount. Where it is required, skipping this step is a breach in its own right, separate from any data protection question.

Is it risky to rewrite a job posting with AI?

It is legally the simplest use, with one caveat. Annex III, point 4(a), covers in particular the placement of targeted job advertisements: algorithmic distribution to a segment of the population is a subject in itself, separate from writing the text. On the text itself, the point to watch is Article L1132-1 of the French Labor Code: wording that implicitly excludes a protected category is still discrimination, whether a person wrote it or a model suggested it. Human review is not a formality.

What if I build my own pre-screening tool on a general-purpose assistant?

Article 25(1)(c) of the AI Act covers exactly this case: anyone who changes the intended purpose of an AI system, including a general-purpose one, in such a way that it becomes a high-risk system within the meaning of Article 6, is considered a provider of that high-risk system. In other words, connecting a general-purpose assistant to your talent pool to produce a ranking can change your role and shift the heaviest obligations of the regulation onto you. It is a compliance decision, not just a choice of tool.

How long can I keep applications processed with AI?

Using AI does not change the retention rule: the CNIL, France’s data protection authority, asks for a period defined in advance, consistent and justified, since data cannot be kept indefinitely. The point to watch that is specific to AI lies elsewhere: extracts of applications pasted into a conversation are an additional copy, which must follow the same deletion policy as the original file. See our privacy policy and our data processing agreement.

Sources

References checked on August 2, 2026. This page describes the law that applies in France as it stood on that date and is not legal advice. If you are unsure about a specific situation, consult your professional body or an adviser. Spotted an error? Write to contact@stellarrstudio.com.