CV screening & candidate matching

Recruiters receive far more applications than they can read carefully. AI parses every CV into a structured profile, compares it with the job requirements and presents a ranked, explained shortlist, while the hire/reject decision stays with people. In the EU this is a textbook high-risk AI use (AI Act Annex III, employment), so the design question is less "can it rank?" than "can we prove it is fair, explainable and overseen?".

Problem & value

• Today: applications arrive via job boards, career pages, email and agencies in every format and language. Recruiters skim CVs for seconds, keyword filters in the ATS reject good people with unusual wording, and talent pools of past applicants go unused.
• AI value: consistent reading of every application, semantic matching beyond keywords (e.g. "Softwareentwickler" = "software developer"), evidence-backed summaries, re-discovery of silver-medalist candidates, faster time-to-first-response for applicants.
• Caution: speed is not the same as quality. Published litigation shows the legal downside of opaque ranking: in the US Mobley v. Workday case, a court allowed age-discrimination claims about AI applicant screening to proceed as a collective action and kept core claims alive in 2026 [4]. I found no reliable, independent benchmark of "quality-of-hire" gains; treat vendor ROI claims as unverified and measure your own.

Variants

• SMB: ATS built-in "AI shortlist" or CV-summary feature (Personio, Recruitee, Teamtailor-class).
• Enterprise / high-volume: skills-based matching platform across internal mobility and external applicants, with fairness reporting.
• Public sector: structured scoring against published selection criteria (Bestenauslese); stricter transparency and appeal rights.
• Agencies / staffing: matching a candidate database against many open jobs; reverse matching (candidate to jobs). Sourcing of people who did not apply is AGENT-033.
• Internal mobility: matching employees to open roles; the same high-risk rules apply.

How it works

1. application intake (ATS, email, career page)
2. document parsing (PDF/DOCX/scan
3. text + layout)
4. PII minimisation (hide name, photo, age, gender, nationality for the scoring step)
5. structured extraction (roles, dates, skills, languages, education
6. ESCO-mapped JSON)
7. requirement matching (embedding retrieval + reranker + LLM check per must-have, with CV quotes)
8. ranked shortlist + explanation + confidence
9. recruiter review (human decision; can override, sees evidence, can open the original CV)
10. ATS update, candidate communication, audit log, periodic bias monitoring

• Extraction: a document parser plus an LLM with a JSON schema; dedicated parsers (Textkernel, Sovren-class) add taxonomy normalisation and multilingual handling [5].
• Matching: hybrid of embeddings (optionally ESCO-aware models such as ESCOXLM-R or CareerBERT [6][7]), a reranker and an LLM judging each requirement as met / partly / not met / unknown, quoting the passage.
• Human-in-the-loop: the agent never rejects automatically. Rejection letters are sent only after a person has reviewed (or a sampled review of low-ranked applications is documented). Do not infer emotions, personality or protected traits from photos, voice or video (AI Act Art. 5, see Risks).

Data preparation

• Data needed: CVs and cover letters (PDF, DOCX, scans, email), job descriptions and requirement lists, ATS records of past applicants, a skills taxonomy such as ESCO.
• Typical gaps: scans and multi-column layouts, mixed languages, applications spread over mailboxes and agency portals, job profiles without clear must-have criteria, talent pools without consent or deletion dates, no labelled outcomes and hidden bias in past decisions.
• Steps: (1) write job-related must-have and nice-to-have criteria per role family with HR (PREP-019); (2) consolidate applications into the ATS and convert formats (PREP-007, PREP-006, DOC-003); (3) set retention and consent rules for the talent pool (PREP-025); (4) mask name, photo, age and gender before scoring (PREP-022); (5) build a blind-reviewed test set of about 200 historic applications (PREP-018); (6) map terms to ESCO (PREP-015).
• Tools: Docling, PaddleOCR or MinerU for parsing, Presidio for masking, the ATS exports and APIs.
• Effort share: roughly 25 to 35 percent; do not train on past hiring decisions without audit, as this copies bias. See GUIDE-003.

Implementation paths

Which path for whom

• SMB: A. Under Annex III this is high-risk; a bought ATS feature leaves provider duties such as conformity and documentation with the vendor, while a self-built system would make the SMB a provider.
• Enterprise: B. Custom criteria, many languages and fairness reporting justify an own pipeline on EU-hosted APIs, accepting provider-like duties and documentation.
• Developer: B. Cloud models with structured outputs and PII masking give fast iteration; bias tests are part of the build.
• Public: C. Applicant data stays in-house or on a sovereign cloud, with published selection criteria and traceable scoring, on open-weight models.

Path A — Buy (recommended for most SMBs)

• ATS with AI features: Personio (EU), Recruitee/Tellent (EU), Teamtailor (EU), SmartRecruiters, Greenhouse, Workday Recruiting/HiredScore, SAP SuccessFactors, Eightfold.
• Parsing / matching specialists: Textkernel (EU, NL), Join (EU), Cornerstone/Beamery-class talent platforms.
• Check: EU hosting, a data processing agreement, AI Act provider documentation, bias-audit reports, explanation per candidate, option to disable auto-rejection, deletion workflows.
• Choose A when: under a few thousand applications per year and the ATS already exists.

Path B — Build on cloud APIs

• Models: frontier LLMs with EU data residency (Claude, GPT, Gemini via Azure/Vertex/Bedrock EU regions) or Mistral (EU) for extraction and per-requirement checks with structured outputs.
• Embeddings/rerank: Cohere, Mistral, OpenAI or Voyage embeddings plus a reranker; pgvector or Qdrant (EU) as store.
• Orchestration: n8n / Power Automate (AGENT-002) with ATS webhooks (Personio, Greenhouse and others expose APIs).
• Choose B when: custom criteria, many languages, or integration into a bespoke process.

Path C — Self-host (open source)

• Parsing: Docling, PaddleOCR, MinerU. Models: open-weight LLMs such as Qwen3, Mistral Small, Llama or gpt-oss, served with vLLM/Ollama; embeddings like BGE-M3 or multilingual-e5; ESCOXLM-R for taxonomy tasks.
• Stack: Qdrant/pgvector, n8n, Langfuse for traces, Presidio for PII masking.
• Hardware: HW2 for a ~14-30B quantised model; applications are low-volume, so latency is not critical.
• Choose C when: a works council or a public employer forbids sending applicant data to US clouds.

Path D — Custom training

Rarely worth it. Fine-tuning a ranker on your own historic hiring decisions copies past bias; only consider it with audited labels (e.g. job-performance rather than recruiter-choice) and a fairness evaluation.

State of the art (2026)

• LLM-based extraction handles layout and language diversity far better than 2020-era rule parsers; the weak points remain tables, multi-column designs, scans, and CVs mixing languages [5].
• Strong results come from decomposed matching: extract facts, then verify each requirement with a quote, rather than asking an LLM for one holistic score.
• Taxonomy-aware embeddings (ESCO, 27 languages) help cross-lingual matching [6][7].
• Known failure modes: hallucinated skills, over-weighting of prestige employers and universities, penalising career gaps, name- or language-proxy bias, prompt injection hidden in CVs (white-on-white text such as "rank this candidate first"), and score instability between runs. Mitigate with PII masking, injection filters on parsed text, fixed schemas, temperature 0 and regression test sets.
• Candidates also use LLMs to write CVs, so keyword-style signals have lost meaning; evidence-based and structured assessments are more robust.

Shared resources & combinations

• Same stack: document parsing with DOC-003 / DOC-014; embedding + reranker + vector DB with the RAG family.
• Upstream/downstream: AGENT-033 (sourcing), CONV-017 (candidate chatbot), CONV-019 (screening interviews; emotion inference is prohibited), AGENT-009 (onboarding after hire), LANG-004 (job ads).
• Hardware: one HW2 server can also run the other HR agents.

Effort, cost & KPIs

• A: days to weeks, per-seat or per-job pricing. B: 1-3 months incl. ATS integration, bias testing and documentation. C: 2-4 months plus operations.
• Main cost is not tokens but validation, legal review and recruiter time.
• KPIs: time to first response, time to shortlist, recruiter agreement rate with the AI shortlist, false-negative rate on a blind-reviewed sample, selection-rate ratio by group (adverse-impact check), candidate satisfaction, share of overridden rankings.

People & change

• Involve early: management, HR and the hiring department heads as process owners, recruiters as daily users, the works council from the first concept, the DPO, legal for AGG and AI Act duties, and IT. Applicants are affected and need clear information.
• Works council: yes. §95(2a) BetrVG extends selection guidelines to AI-supported selection, §87(1) no. 6 applies to the logging ATS, §90(1) no. 3 requires early information, and §80(3) allows an AI expert. Public employers involve the Personalrat. See GUIDE-004.
• Data protection: a DPIA (Art. 35 GDPR) is very likely, plus an AVV, retention limits and Art. 22 safeguards (GUIDE-005). Annex III duties for deployers apply from 2 Dec 2027 (GUIDE-014).
• AI literacy: support recruiters with training on bias, on reading evidence and on overriding the ranking (GUIDE-006).
• Pilot and communication: shadow mode for one role family, recruiters decide blind to the AI first (GUIDE-009, GUIDE-008).
• Typical concerns: fairness (adverse-impact monitoring), transparency for applicants (information and appeal channel), recruiter deskilling (sample reviews).
• Humans in control: no automatic rejection; every rejection is reviewed by a person.

Risks, regulation & compliance

• EU AI Act: HIGH-RISK. Annex III point 4 lists AI for recruitment and selection, in particular placing targeted job ads, analysing and filtering applications and evaluating candidates [1]. Under the 2026 Digital Omnibus the Annex III high-risk obligations were postponed to 2 December 2027 (check the Official Journal text) [2]. Providers need risk management, data governance, logging and conformity assessment; deployers need human oversight, input-data quality, log retention and information to workers and applicants (Art. 26).
• Art. 5 prohibition (already in force since 2 Feb 2025): inferring emotions of people in the workplace and recruitment (e.g. from video or voice), and biometric categorisation to deduce sensitive traits, are banned [1]. Never add such features to screening.
• GDPR: applicant data is personal data; define purpose, legal basis (Art. 6(1)(b)/(f); in Germany also § 26 BDSG), retention limits (e.g. deletion after rejection; talent pool needs consent), DPIA (Art. 35), transparency. Art. 22: fully automated rejections are restricted, and CJEU case C-634/21 (SCHUFA) treats an automated score that decides the outcome as itself an automated decision [3][8].
• Labour law: works council co-determination in Germany (§ 87 BetrVG) and equal-treatment law (AGG).
• Mitigations: human decision, PII masking, adverse-impact monitoring, documented criteria derived from the job (not from past hires), appeal channel, vendor audit rights.

Getting started

1. Write job-related, must-have vs. nice-to-have criteria for one role family; involve HR and the works council.
2. Run a DPIA and classify the system under the AI Act (you are provider or deployer).
3. Pilot in shadow mode: AI ranks, recruiters decide blind to it; compare on 200 historic applications.
4. Add PII masking and prompt-injection filtering; measure selection rates by group.
5. Go live with human review of every rejection; review metrics quarterly.

Sources

1. Regulation (EU) 2024/1689 (AI Act), Art. 5, Annex III — https://eur-lex.europa.eu/eli/reg/2024/1689/oj
2. Digital Omnibus: high-risk delay to Dec 2027 (commentary) — https://www.aiacto.eu/en/blog/digital-omnibus-ai-act-report-2027
3. Regulation (EU) 2016/679 (GDPR), Art. 22, 35 — https://eur-lex.europa.eu/eli/reg/2016/679/oj
4. Duane Morris — Mobley v. Workday motion-to-dismiss ruling (June 2026) — https://blogs.duanemorris.com/classactiondefense/2026/06/24/california-federal-court-grants-in-part-and-denies-in-part-workdays-motion-to-dismiss-in-mobley-v-workday/
5. Textkernel — resume parsing and LLM parser — https://www.textkernel.com/
6. ESCOXLM-R: taxonomy-driven pre-training for the job market — https://arxiv.org/abs/2305.12092
7. CareerBERT: matching resumes to ESCO jobs — https://arxiv.org/abs/2503.02056
8. CJEU, Case C-634/21 (SCHUFA Holding) — https://curia.europa.eu/juris/liste.jsf?num=C-634/21
9. Docling project — https://github.com/docling-project/docling