You applied. A week later the rejection arrives, and it is four sentences long. Somewhere between the two, software was involved — the posting said so, or the assessment link made it obvious, or you simply cannot account for a decision that arrived at nine on a Sunday morning.
There is a lot of writing this month telling you what you can now demand about that. Most of it describes the wrong law.
The date that moved, and the one that did not
The AI Act contains a provision written for exactly this situation. Article 86 gives any affected person subject to a decision taken by a deployer "on the basis of the output from a high-risk AI system listed in Annex III" the right to obtain from that deployer "clear and meaningful explanations of the role of the AI system in the decision-making procedure and the main elements of the decision taken".1 Recruitment tools are in Annex III.1 The employer, not the vendor, owes the answer.
That regime was due to start on 2 August 2026. It did not. Regulation (EU) 2026/1744 — the Digital Omnibus on AI — was adopted on 8 July 2026 and published in the Official Journal on 24 July. It rewrites the third paragraph of Article 113 of the AI Act so that Chapter III, Sections 1 to 3 now apply "from 2 December 2027 as regards AI systems classified as high-risk pursuant to Article 6(2) and Annex III".2 Those are the sections that carry the requirements on high-risk systems, and Article 6(2) is the classification rule that puts a hiring tool in that category in the first place. The reason given in the recitals is unglamorous: standards, common specifications and national authorities were not ready.2
Article 86 itself was not moved. It sits in a different chapter — Chapter IX, among the remedies — and no amendment in the Omnibus touches it.12 Whether a provision that refers to a classification not yet in application can be invoked on its own, against an employer, in a member state that has not yet designated the authority you would complain to, is a question nobody has answered. Our reading is that it is not the instrument to reach for this year. Treat anything that tells you otherwise as a claim to check rather than a plan.
Its third paragraph is the tell. Article 86 applies "only to the extent that the right referred to in paragraph 1 is not otherwise provided for under Union law"1 — it was drafted to fill a gap, not to be the main door. The main door has been open since 2018.
The request that already works
The General Data Protection Regulation has applied since May 2018, and an application is personal data. Article 15 gives you the right to ask a controller for a copy of the personal data it holds about you, together with the purposes, the recipients, the retention period and where the data came from. There is no fee for the first copy, and the controller has a month to answer — extendable by two more, if it tells you why within that first month.3
For an application, that reaches further than most people expect. The screening scores, the assessment results, the recruiter's notes on your file, the rejection reason recorded in the system, the stage at which you were dropped — these are personal data about you held by the employer, and a subject access request asks for them by default rather than as a favour.
Then there is Article 15(1)(h), which is the part worth knowing by number. Where automated decision-making within the meaning of Article 22 was involved, you are also entitled to "meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing".3
What "meaningful" turned out to mean
For years nobody could say what that sentence obliged anyone to write. In February 2025 the Court of Justice answered, in a case about an Austrian credit assessment rather than a hiring decision.4
A customer had been refused a mobile phone contract worth ten euros a month, on the strength of an automated credit score produced by Dun & Bradstreet Austria. She asked how. In its summary of the judgment, the Court put the duty like this: the controller "must describe the procedure and principles actually applied in such a way that the data subject can understand which of his or her personal data have been used, and how they have been used, in the automated decision-making".5 It may be appropriate, the Court added, to tell the person how far their data would have had to differ to produce a different result. And the obvious evasion is closed off: "the mere communication of an algorithm does not constitute a sufficiently concise and intelligible explanation."5
The other evasion is closed off too. Where a controller says the information contains trade secrets or third-party data, it cannot simply refuse. It must hand the allegedly protected material to the supervisory authority or the court, which then decides how much of it you get.4
That is a demanding standard, and it is already law across the EU and the EEA. It applies to a hiring tool on the same terms as a credit score, with one condition attached.
The condition is Article 22, and it is narrow
Article 15(1)(h) only opens where Article 22 is in play: a decision "based solely on automated processing" that produces legal effects or "similarly significantly affects" you.3 Recital 71 of the GDPR names the case directly, giving "e-recruiting practices without any human intervention" as its example.3 A fully automated rejection is squarely inside.
Solely is the load-bearing word, and most employers will tell you a person reviewed the shortlist. Sometimes that is true. Sometimes it means a recruiter approved a ranked list of two hundred in an afternoon.
The Court has been unwilling to let the boundary be drawn by convenience. In SCHUFA, decided in December 2023, it held that a credit agency's automated production of a probability value is itself automated individual decision-making under Article 22(1) where the third party receiving it "draws strongly on" that value in deciding whether to contract.6 That was about credit scoring. The structure will be familiar to anyone who has applied through a large employer: a vendor computes the score, the employer acts on it, and each can point at the other. The parallel is not a ruling, and no court has applied it to a hiring decision. It is a reason not to accept the two-step as a complete answer.
In practice this means the question to ask is not "was a human involved" — the answer is always yes. It is narrower: who reviewed my application, what did they see, and could they have reached a different conclusion from the tool's? An employer that answers is telling you something useful. An employer that will not put it in writing is also telling you something.
In the UK, this changed in February
If you are applying in the United Kingdom, do not quote Article 22 at anyone. It is gone.
Section 80 of the Data (Use and Access) Act 2025 replaced it with new Articles 22A to 22D of the UK GDPR, and those provisions were commenced on 5 February 2026.78 The framework is more permissive: solely automated significant decisions are broadly allowed, rather than prohibited with three exceptions, and the tighter regime is reserved for decisions based on special category data.
Two things in the replacement are worth having. Article 22A defines the phrase everything used to turn on — a decision is based solely on automated processing "if there is no meaningful human involvement in the taking of the decision"7 — so the vagueness that employers used to shelter in is now a statutory test. And Article 22C requires safeguards: the controller must give you information about the decision, let you make representations about it, let you obtain human intervention, and let you contest it.7 The scope of that duty is the part to hold on to: Article 22C is triggered wherever a significant decision is "based solely on automated processing", whatever kind of personal data went into it.7 Fewer decisions are prohibited outright. None of them lose the safeguards.
New York publishes it without being asked
One jurisdiction puts some of this on the record whether anyone requests it or not. It is a narrow one: New York City, and its rules are written around candidates who live in the city.
Local Law 144's rules require an employer using an automated employment decision tool to put the results of its most recent bias audit on the employment section of its website "in a clear and conspicuous manner" before the tool is used. Not a statement that an audit happened: the source and explanation of the data used, the number of applicants, the selection or scoring rates, and the impact ratios for every category.9 It has to stay up for at least six months after the tool was last used.9 Notice to a candidate who resides in the city has to go out at least ten business days before the tool is used, and it has to allow them to request an alternative selection process or an accommodation.10 The type of data the tool collects, the source of that data and the employer's retention policy are available either way: on the careers page, or — in the Code's words, "[i]f not disclosed on the employer or employment agency's website" — on written request, answered within thirty days.109
Three honest limits. The trigger is the use of the tool, not your application, so an employer that screens a batch weeks after the closing date can satisfy both the audit posting and the ten days' notice while you are already in the pile — the rules guarantee the disclosure exists before the tool runs, not before you decide to apply. The notice must tell you how to request an alternative selection process, but the rules say plainly that nothing in them "requires an employer or employment agency to provide an alternative selection process".9 And the impact ratios describe the tool's behaviour across a candidate population, not what it did to your application. Still, where it applies: a published table of selection rates, sitting on the careers page, is more than the rest of the world gives you.
What to actually do
Work out first which rule you are under, because the answer is not the same everywhere. The subject access request below is a GDPR and UK GDPR instrument; if neither reaches your application, what you have is whatever your own jurisdiction gives you, which in New York City is the published audit and the notice above, and in much of the world is nothing.
Where it does reach: send the request. One email to the employer's privacy or data protection address, naming the role, the reference number and the dates you applied, asking under Article 15 for the personal data held about your application. Add the Article 15(1)(h) information to the same email, conditionally — if the decision was taken solely by automated means, which is the threshold that provision hangs on, ask for the logic, the significance and the envisaged consequences. Putting it that way is deliberate. It makes the employer answer the question of whether a person actually decided, rather than leaving it for you to guess. Keeping a record of what you applied to and when is what makes the request specific enough to be hard to wave away, which is one of the duller reasons to keep the list somewhere other than your sent folder.
Expect a thin answer. Ask once more, quoting what the Court said an explanation has to describe. If it stays thin, the complaint goes to your supervisory authority — the national data protection authority in an EU or EEA state, the Information Commissioner's Office in the UK — and it costs nothing but the time.
None of this gets you the job. What it gets you is the ability to tell the difference between an application that was read and rejected, and one that was never read — and that changes what you do next week far more than another rewrite of your opening paragraph would.
