As artificial intelligence (AI) becomes increasingly embedded in HR and recruitment processes, leaders in these fields face a complex regulatory landscape. The European Parliament’s Research Service recently released a report highlighting a critical tension between the EU’s Artificial Intelligence Act (AI Act), which entered into force in August 2024, and the General Data Protection Regulation (GDPR), a cornerstone of data protection since 2018. This tension revolves around the processing of "special categories of personal data" to mitigate bias and discrimination in high-risk AI systems - a goal central to the AI Act - while adhering to the GDPR’s stricter safeguards. For HR and talent acquisition leaders, this interplay raises pressing questions about compliance, ethics, and the practical deployment of AI tools.

Here, I explore the implications of this legal conflict, offering actionable insights for HR professionals navigating AI governance. Drawing on over two decades of experience in HR and recruitment, I aim to unpack the challenges, propose strategies, and challenge conventional approaches to integrating AI responsibly into your operations.


The AI Act and GDPR: A Clash of Objectives?

The AI Act is designed to foster trustworthy, human-centric AI while safeguarding fundamental rights, including the right to non-discrimination. It adopts a risk-based approach, categorising AI systems by their potential impact on individuals. "High-risk" systems (such as those used in recruitment, credit scoring, or autonomous decision-making) face stringent requirements, including bias detection and correction. To achieve this, Article 10(5) of the AI Act permits the processing of special categories of personal data (e.g., ethnicity, health, or biometric data) when "strictly necessary" to ensure fairness, provided robust safeguards are in place.


Contrast this with the GDPR, which governs personal data processing across the EU. Article 9 of the GDPR classifies special categories of data as highly sensitive, prohibiting their processing unless specific conditions are met - such as explicit consent or a basis in "substantial public interest." The European Parliament report flags a key issue: while the AI Act seeks to enable data processing to combat discrimination, the GDPR’s restrictive stance creates legal uncertainty. This misalignment could hinder the development and deployment of AI systems in HR, where fairness and compliance are non-negotiable.


Why This Matters for HR and Recruitment

AI is no longer a futuristic concept in HR. Algorithms screen CVs, assess candidate fit, and even predict employee performance. Yet, as the report illustrates, these systems can inadvertently perpetuate bias. Imagine an AI recruitment tool that prioritises male candidates for technical roles due to historical hiring patterns, or a credit-scoring algorithm that disadvantages applicants from certain postcodes. These scenarios aren’t hypothetical; they reflect documented risks that the AI Act aims to address.


For HR leaders, the stakes are high. Recruitment processes must not only comply with anti-discrimination laws but also align with organisational values and candidate expectations. The ability to process special categories of data - say, ethnicity or health status - could help identify and correct bias in AI tools. For instance, to determine if an algorithm unfairly filters out candidates based on gender or race, you’d need access to that data. However, under the GDPR, collecting such information without explicit consent is fraught with risk, leaving HR teams caught between competing legal frameworks.


Scenarios of Algorithmic Discrimination in HR

The European Parliament report outlines several contexts where AI systems may discriminate, many of which resonate with HR applications:


  1. Job Recruitment and Employment: Algorithms selecting candidates might embed biases related to gender, age, or ethnicity. A tool trained on past hires could, for example, undervalue female applicants in male-dominated sectors.
  2. Generative AI Systems: Chatbots used in candidate engagement might generate inappropriate or biased responses, subtly undermining diversity goals. While not inherently "high-risk" under the AI Act, such systems could still fall under scrutiny if they harm fundamental rights.
  3. Employee Monitoring: AI tools tracking performance or wellbeing might process health data (e.g., stress levels inferred from biometric inputs), raising GDPR compliance questions if not handled carefully.


These examples underscore a paradox: to build fairer AI systems, HR teams may need to process sensitive data, yet the GDPR’s restrictions complicate this effort. The report suggests that legislative reform or clearer guidance may be needed - an outcome that could take years. In the meantime, HR leaders must act decisively within the current framework.


Decoding the Legal Tension

The AI Act’s Article 10(5) allows processing special categories of data for bias mitigation in high-risk systems, but it operates within the GDPR’s orbit. The GDPR remains the overriding authority, meaning any data processing must satisfy its conditions - such as consent or substantial public interest (Article 9(2)(g)). The report posits that the AI Act itself could serve as the "Union law" justifying processing for public interest, with non-discrimination as the goal. However, this interpretation is untested, and the GDPR’s principles (e.g., data minimisation, necessity) impose additional hurdles.


Consider a practical example: an HR team deploys an AI tool to screen job applicants. To ensure the algorithm doesn’t discriminate by ethnicity, they need to analyse outcomes across ethnic groups. Under the AI Act, this might be permissible if safeguards like encryption and anonymisation are in place. Yet, under the GDPR, collecting ethnicity data without consent could breach Article 9, unless framed as a public interest necessity - a justification that regulators might challenge.


This tension extends beyond special categories. Data like age or gender, while not "special" under Article 9, can also fuel discrimination. Here, Article 6 of the GDPR offers broader grounds (e.g., legitimate interest), but aligning these with the AI Act’s risk-based approach remains tricky.


Main Challenges for HR Leaders

The report identifies several conditions for reconciling the AI Act and GDPR, each with implications for HR:


  • Robust Cybersecurity: Processing sensitive data demands top-tier security to prevent breaches - a non-negotiable under GDPR’s integrity and confidentiality principle.
  • GDPR Compliance Principles: Data minimisation (collect only what’s needed), purpose limitation (use data only for specified aims), and privacy by design must guide AI deployments.
  • Necessity Test: Processing must be "strictly necessary" to protect rights like non-discrimination, a threshold that requires careful justification.
  • Legal Grounds: Explicit consent or public interest must underpin data use, yet obtaining consent in recruitment (where power imbalances exist) is often impractical.


A further wrinkle: bias can stem from non-sensitive data (e.g., postcode as a proxy for socioeconomic status), which falls under Article 6’s lighter rules. This creates an uneven playing field - easier to address some biases than others - leaving HR teams to navigate a patchwork of requirements.


Strategies for HR and Talent Acquisition Leaders

So, how can HR leaders move forward amidst this uncertainty? Here are five practical steps to integrate AI governance into your strategy:


  1. Conduct an AI Risk Audit: Map your AI tools against the AI Act’s high-risk criteria (Article 6). Recruitment and employee management systems often qualify - assess their data inputs and potential biases. This isn’t just compliance; it’s a chance to rethink how technology serves your goals.
  2. Embed Privacy by Design: Work with IT and legal teams to build AI systems that prioritise data minimisation and security from the outset. For example, use pseudonymised data where possible to test for bias without triggering GDPR red flags.
  3. Leverage Public Interest: Frame bias correction as a substantial public interest under GDPR Article 9(2)(g). Document how your AI efforts advance fairness and inclusion, aligning with the AI Act’s ethos. Seek legal advice to bolster this stance.
  4. Engage Candidates Transparently: Where consent is viable, communicate clearly with applicants about data use. A simple opt-in for bias monitoring (e.g., “Help us ensure fairness by sharing your ethnicity”) can bridge compliance and ethics.
  5. Stay Ahead of Guidance: The report hints at forthcoming reforms or guidelines. Join industry forums, consult with regulators like the UK’s ICO, and monitor EU developments to anticipate shifts.


A Provocative Thought: Is Consent Overrated?

Here’s a challenge to conventional wisdom: in recruitment, consent is often hailed as the gold standard for data processing. Yet, candidates - eager to secure a job - rarely refuse, rendering consent a formality rather than a safeguard. Relying on public interest or legitimate interest might better reflect reality, shifting the burden to employers to justify fairness proactively. This isn’t about bypassing rights; it’s about designing systems that protect them by default.


The Road Ahead

The interplay between the AI Act and GDPR isn’t a theoretical debate, it’s a live issue shaping HR’s future. Left unresolved, it risks stalling AI adoption in recruitment, leaving organisations exposed to bias or penalties. The European Parliament’s call for reform signals a long-term fix, but HR leaders can’t wait. By aligning AI tools with both frameworks now, you position your organisation as a pioneer in ethical innovation.


Start today: audit your AI systems (use Warden AI), consult your legal team, and rethink how data drives fairness. The goal isn’t just compliance, it’s building a recruitment process that candidates trust and regulators applaud.