Human Oversight in AI Hiring: Lessons From Spain’s AEPD

Artificial intelligence now reads CVs, scores candidates and ranks shortlists at a speed no recruiter can match. But a regulator in Europe has just reminded every employer that human oversight in AI hiring cannot be a rubber stamp: someone has to genuinely review, question and own each decision.

On 23 September 2026, Spain’s data protection authority, the Agencia Española de Protección de Datos (AEPD), publicised a preventive warning issued to a company that was preparing to roll out an AI tool to analyse CVs, score applicants and filter candidates. The tool was not even live yet. That timing is the story: regulators are now stepping in at the procurement stage, before a single candidate is screened. Here is what happened, why it matters well beyond Spain, and how Indian HR teams can build oversight that actually stands up.

What Spain’s AEPD Actually Said

According to Adara Legal’s summary of the AEPD warning, the regulator accepted that AI screening tools can make recruitment more efficient, but insisted that data protection safeguards must be built in from the start, not bolted on later. The authority set out several expectations:

• Meaningful human review: supervision cannot be merely procedural. A person must properly examine algorithmic outputs rather than click “approve”.
• An impact assessment before go-live: where processing is likely to be high-risk, the evaluation must happen before implementation.
• Transparency to candidates: employers should explain what data is processed, how the system reaches its scores, and how errors can be corrected.
• Data quality and bias control: input and training data must be vetted so the tool does not produce discriminatory or inaccurate outcomes.
• Clear accountability: roles between the employer (controller) and the technology vendor (processor) must be defined.

Writing on 25 September 2026, employment lawyers at Ogletree described the move as a formal preventive warning and highlighted the regulator’s definition of “effective” oversight: the decision-maker must be able to critically assess the score or output the system produces and reach their own independent conclusion. In other words, a human who simply accepts the AI’s ranking is not oversight at all.

Why Human Oversight in AI Hiring Is Becoming Non-Negotiable

The AEPD warning sits inside a wider regulatory wave. The European Commission’s AI Act policy page confirms that the Act’s transparency rules came into effect in August 2026, and that rules for high-risk systems used in areas including employment will apply from 2 December 2027. Deployers of those systems will be expected to ensure human oversight and monitoring once a tool is in use.

Ogletree notes that recruitment tools which screen and filter candidates fall into the Act’s high-risk category, bringing duties such as a human oversight protocol that lets staff analyse, challenge and override outcomes, documentation of how much the process relies on AI, and staff training. The penalties are significant: up to €35 million or 7% of global annual turnover under the AI Act, and up to €20 million or 4% under the GDPR.

Crucially, the Spanish case shows that regulators are not waiting for 2027. They are already using existing data protection powers to test whether an employer’s “human in the loop” is real.

What This Means for Indian Employers and Staffing Firms

It would be easy to treat this as a European problem. That would be a mistake, for three reasons.

First, cross-border hiring is routine. Indian IT services firms, global capability centres and RPO providers regularly screen candidates for European clients or European roles. If your process touches EU candidates, EU expectations travel with it.

Second, India’s own privacy regime is maturing. The Digital Personal Data Protection (DPDP) Rules were notified on 13 November 2025 and are being phased in. As AZB & Partners explains, provisions on consent managers activate after one year, and the core obligations — notice and consent, legitimate uses, duties of data fiduciaries and data principal rights — take effect after eighteen months, in mid-May 2027. Candidate data collected through AI interviews, recordings and scorecards will sit squarely inside that framework.

Third, trust is a hiring advantage. Candidates increasingly want to know whether a machine rejected them. A process that can show a named person reviewed the evidence is easier to defend to candidates, clients and auditors alike.

What Genuine Oversight Looks Like in Practice

“Human in the loop” means very little on its own. Drawing on the AEPD’s expectations, meaningful human oversight in AI hiring usually has five practical ingredients:

1. Humans set the rules before the AI runs. Job requirements, interview questions and scoring rubrics should be approved by people who understand the role — not generated and deployed automatically.

2. No silent auto-rejection. If an algorithm can quietly drop candidates before any person sees them, oversight is theoretical. Every advance, hold or reject decision should have a human owner.

3. Reviewers see the evidence, not just a score. A single number invites rubber-stamping. Reviewers need the underlying transcript, recording, competency breakdown and any integrity flags so they can reach their own conclusion — the exact standard the AEPD described.

4. Decisions can be challenged and redone. If a round was affected by a technical glitch or a questionable flag, there must be a clean way to repeat it.

5. Everything is logged. An audit trail showing who approved what, and when, is what turns good intentions into demonstrable compliance.

Alongside these, keep a written record of your pre-deployment assessment, tell candidates plainly that AI assists your process, and agree with your vendor who is responsible for which data.

How InstaDataAssess Keeps People in Charge

InstaDataAssess was designed around a simple principle: AI does the volume. Your people make the calls. Here is how that maps onto the oversight checklist above:

• HR approves the plan. When a job description is uploaded, the AI drafts the interview plan, questions and scorecards — and HR approves them before anything goes to candidates. Round-specific scorecards for expert video rounds are likewise AI-drafted and HR-approved.
• Nothing is auto-rejected. AI interview scores and expert panel scores are fused into one advance / hold / hire recommendation with full evidence. The decision itself stays with your team.
• Evidence-rich reports. The Decision Cockpit shows per-skill and competency scores, a behavioural (OCEAN) profile, a question-by-question transcript, the recording and an integrity timeline, so reviewers can critically assess the output rather than accept a number.
• Governed by design. One decision per level, HR-gated invites, the ability to re-do any round, and a complete audit log. HR can also silently watch any live interview.
• Your brand, your data, your keys. The platform is white-label and multi-tenant, and organisations can use their own AI and email credentials — useful when you need clarity over who processes candidate data.

Integrity checks are part of that evidence too. The Integrity Shield gates interviews with government-ID face matching and records proctoring events (face presence, multiple faces, tab focus, second screen) on a severity timeline, so a reviewer can see exactly why a round was flagged instead of guessing.

InstaDataAssess does not make an organisation compliant on its own — compliance depends on your policies, notices and assessments. But it gives HR teams the structure that regulators are now asking for: human approval up front, evidence in the middle, and an accountable human decision at the end. You can read more on responsible hiring technology on the InstaDataHelp blog.

A Quick Readiness Checklist for HR Leaders

Before your next AI-assisted hiring drive, ask:

• Can we name the person accountable for every final hiring decision?
• Do reviewers see transcripts and recordings, or only scores?
• Can any candidate’s round be re-run if something went wrong?
• Have we documented a pre-deployment risk assessment?
• Do our candidate notices explain that AI assists — and that humans decide?
• Is our vendor contract clear about who stores and processes candidate data?

If any answer is “not sure”, that is where to start.

Frequently Asked Questions

What is human oversight in AI hiring?

It means a qualified person genuinely reviews AI-generated scores or rankings, understands the evidence behind them, and makes their own independent decision. Spain’s AEPD has stressed that oversight which is merely procedural does not count.

Why did Spain’s AEPD warn an employer about AI CV screening?

On 23 September 2026 the AEPD publicised a preventive warning to a company preparing to deploy an AI tool that would analyse CVs, score applicants and filter candidates. The regulator stressed impact assessment, transparency, data quality and meaningful human review before the tool goes live.

Does the EU AI Act apply to recruitment tools?

Yes. AI systems used in employment, including tools that screen and filter candidates, are treated as high-risk. According to the European Commission, the high-risk rules for employment apply from 2 December 2027, while transparency rules took effect in August 2026.

Does InstaDataAssess reject candidates automatically?

No. InstaDataAssess fuses AI and expert scores into an advance, hold or hire recommendation with full evidence, but nothing is auto-rejected. HR approves interview plans and invites, can re-do any round, and every action is captured in a complete audit log.

Sources

• AEPD press release on safeguards for using AI to analyse CVs (Spanish)
• Adara Legal: AEPD warning on guarantees required when using AI to screen CVs
• Ogletree: Employer obligations under GDPR and the EU AI Act when deploying AI recruitment tools
• European Commission: AI Act regulatory framework and application timeline
• AZB & Partners: India’s DPDP Act phased rollout and compliance milestones

Want AI to handle interview volume while your people keep every decision? Explore InstaDataAssess and see how evidence-first, audit-ready hiring can go live in a week. Write to info@instadatahelp.com to book a walkthrough.