Algorithmic Discrimination in Recruiting — Legal Status 2026

1. What is algorithmic discrimination?

Algorithmic discrimination in recruiting arises where AI-based or rule-based selection systems systematically place applicants at a disadvantage, directly or indirectly, because of a characteristic listed in § 1 of the German General Equal Treatment Act (AGG) (age, sex, ethnic origin, religion or belief, disability, sexual identity). In legal terms there are two forms: direct, where a person receives less favourable treatment on a ground referred to in § 1 AGG; indirect, where apparently neutral provisions are liable to put persons at a particular disadvantage (§ 3(1) and (2) AGG). Proxy variables are a typical pattern of indirect disadvantage: they look neutral and do not act neutrally. Typical sources:

• Training-data bias: models trained on historical hiring decisions reproduce historical inequalities. Check which decision years are contained in the training set.
• Proxy variables: postcode, club membership and an unbroken employment history can correlate strongly with protected characteristics. Have the provider name the features used and check each one individually against the catalogue in § 1 AGG.
• Feature engineering: 'cultural fit' scores, 'adaptability' indicators and 'digital native' filters often operate as age filters.
• Thresholds and cut-offs: pre-screening that rejects without human review multiplies the discriminatory effect. In Germany this additionally engages § 164(1) sentence 1 SGB IX: all employers must examine whether vacant positions can be filled with severely disabled persons; public employers must also invite severely disabled applicants to an interview (§ 165 sentence 3 SGB IX; unnecessary where professional aptitude is manifestly lacking, sentence 4).

Two rules make it difficult to fall outside the scope. First, § 7(1) AGG also applies where the person causing the disadvantage merely assumes the existence of a ground referred to in § 1 AGG — a model that only estimates a protected characteristic therefore does not escape the provision; conflicting stipulations in agreements are void (§ 7(2) AGG). Second, under Art. 6(3) AI Act a system listed in Annex III is exceptionally not regarded as high-risk where it does not pose a significant risk to health, safety or fundamental rights — that exception does not apply, however, where the system performs profiling of natural persons.

The employer is liable as deployer within the meaning of the EU AI Act, irrespective of whether it trains the model itself or obtains it from a provider. Whether a tool is an AI system is determined by the definition in Art. 3 no. 1 AI Act — quoted verbatim in the FAQ 'Does a rule-based ATS filter without machine learning count as an AI system?'. For the AGG this classification is irrelevant: § 7(1) AGG attaches to the disadvantage on a ground referred to in § 1, not to a technology.

Austria: there, protection is provided by the Austrian Equal Treatment Act (Gleichbehandlungsgesetz, GlBG), expressly including the establishment of the employment relationship; it also covers the instruction to discriminate (§ 5, § 6 GlBG Part I and § 19 GlBG Part II) — relevant where the selection logic is configured not in-house but at the service provider. Anyone setting up a bias review for an Austrian site works with a different legal basis for each dimension:

2. The § 22 AGG burden-of-proof reversal hits algorithms

With algorithmic selection the burden of proof shifts early: the applicant only has to establish indications, while the employer owes full proof that the process was free of discrimination — and only an employer who can itself trace the selection logic is able to furnish it. The wording:

§ 22 AGG: 'Where in a dispute one party establishes indications giving rise to a presumption of a disadvantage on a ground referred to in § 1, the other party bears the burden of proving that there has been no infringement of the provisions protecting against disadvantage.'

The rule is prescribed by EU law (Art. 19 Directive 2006/54/EC, Art. 10 Directive 2000/78/EC, Art. 8 Directive 2000/43/EC). For algorithmic decisions this has a twofold consequence:

1. The threshold for indications is low: statistical anomalies in selection rates, documented bias findings, or the very fact of a purely algorithmic rejection without human review may already qualify as an indication. The Federal Labour Court (BAG) has already based the burden-of-proof reversal under § 22 AGG on a statistical indication (BAG, 21 January 2021 — 8 AZR 488/19, median indication concerning § 22 AGG / § 3(2) sentence 1 EntgTranspG).
2. Full proof is demanding: the employer must positively demonstrate that the decision was free of discrimination. Anyone unable to examine the logic of the algorithm cannot furnish that proof.

Hence the compliance imperative: anyone deploying AI in recruiting must keep it auditable — which building blocks belong to that, and with which deadline, is listed in the compliance path in section 7. Practice recommendation for the documentation chain that carries this full proof: set the selection criteria down in writing before the first application arrives, conduct structured interviews with a score sheet, give written reasons for every selection decision, and use an ATS with an audit trail. These are organisational recommendations without a statutory date; the statutory anchor behind them is § 12(1) AGG — the employer must take the measures necessary to protect against disadvantage, including preventive measures.

3. EU AI Act: HR recruiting as high-risk AI (Annex III point 4)

Recruiting AI is high-risk AI: Annex III no. 4 of the AI Act (Regulation (EU) 2024/1689) covers targeting of job advertisements, the analysis and filtering of applications and the evaluation of candidates; the high-risk obligations of Chapter III Sections 1 to 3 apply to Annex III systems from 2 December 2027 (Art. 113(3)(c)(i) AI Act as amended by Regulation (EU) 2026/1744, in force since 27 July 2026). The wording:

'Employment, workers' management and access to self-employment: (a) AI systems intended to be used for the recruitment or selection of natural persons, in particular to place targeted job advertisements, to analyse and filter job applications, and to evaluate candidates; (b) AI systems intended to be used to make decisions affecting terms of work-related relationships, the promotion or termination of work-related contractual relationships, to allocate tasks based on individual behaviour or personal traits or characteristics or to monitor and evaluate the performance and behaviour of persons in such relationships.'

2 August 2026 is at the same time the general date of application of the Regulation (Art. 113(2) AI Act: 'It shall apply from 2 August 2026.'); the diverging dates in Art. 113(3)(a) to (c) concern 2 February 2025, 2 August 2025 and — following the amendment by Regulation (EU) 2026/1744 — 2 December 2027 for Annex III systems (Art. 6(2), Chapter III Sections 1 to 3) as well as 2 August 2028 for Annex I systems (Art. 6(1)). This Digital Omnibus Regulation of 8 July 2026 has been in force since 27 July 2026; the postponement is therefore applicable law. The general date of application of 2 August 2026 — for, among other things, the transparency obligations in Art. 50 — remains unchanged.

3.1 Deployer obligations for employers

For deployers (employers) of Annex III systems, the following apply from 2 December 2027, inter alia (Chapter III Sections 1 to 3, Art. 113(3)(c)(i) AI Act as amended by Regulation (EU) 2026/1744):

• Art. 26(1): operation in accordance with the provider's instructions and the relevant technical instructions. In practice: the provider's instructions for use belong in the system file, not in the inbox.
• Art. 26(2) + Art. 14: ensuring effective human oversight by trained persons — and 'trained' is not a label here: Art. 4 AI Act (AI literacy) has applied since 2 February 2025 and, since 27 July 2026, in the version of Regulation (EU) 2026/1744 — providers and deployers take measures to support the development of the AI literacy of their staff; no particular level of competence is owed.
• Art. 26(5) + Art. 13: monitoring of operation on the basis of the instructions for use.
• Art. 26(6) + Art. 12: retention of the automatically generated logs for at least 6 months.
• Art. 26(7): information of the employees concerned and their representatives before putting into service in the workplace. (Art. 26(11), by contrast, concerns the information of natural persons who are subject to an Annex III decision of the system.)

3.2 The prohibition zone and the transparency zone

Before any high-risk documentation comes the question whether the tool may be used at all. Art. 5(1) AI Act prohibits, among other things, emotion recognition in the workplace and in education institutions ((f)) as well as biometric categorisation to deduce sensitive characteristics ((g)), both since 2 February 2025 (Art. 113(3)(a)). Anyone considering video, voice or facial expression analysis in the application process should therefore first clarify whether the product performs such functions — and only then turn to the high-risk obligations.

Above that lies the transparency layer of Art. 50 AI Act (since 2 August 2026): providers must ensure that AI systems intended to interact directly with natural persons inform them that they are interacting with an AI system (paragraph 1) — the application chatbot fits this pattern. Deployers of emotion recognition or biometric categorisation systems must inform the persons concerned (paragraph 3). Deployers who generate or manipulate deepfakes must disclose that the content has been artificially generated or manipulated (paragraph 4).

3.3 No FRIA obligation for private employers

The fundamental rights impact assessment (FRIA) under Art. 27(1) AI Act does not apply to private employers that do not provide public services — it is tied to a narrow group of addressees. Only the following carry it out: (a) deployers 'that are bodies governed by public law, or are private entities providing public services', and (b) deployers of high-risk AI systems referred to in Annex III no. 5(b) and (c) (creditworthiness assessment/credit scoring as well as risk assessment and pricing in life and health insurance). For a private undertaking deploying recruiting AI under Annex III no. 4, the fundamental rights impact assessment is therefore at most voluntary best practice (and, where a DPIA under Art. 35 GDPR is required in any event, can in practice run alongside it there). It is not the degree of 'fundamental rights relevance' of the system that determines the obligation, but who the deployer is. For the private employer, Art. 26 AI Act and — in the case of a systematic and extensive evaluation of personal aspects with legal effect — Art. 35 GDPR therefore remain the relevant instruments.

3.4 Dates at a glance

For recruiting AI, the dates of 2 February 2025 for AI literacy and prohibitions and 2 August 2026 for the transparency obligations have already arrived; the high-risk obligations and the FRIA obligation of the addressees of Art. 27(1) apply to Annex III systems from 2 December 2027 (Art. 113(3)(c)(i) AI Act as amended by Regulation (EU) 2026/1744, in force since 27 July 2026); the high-risk obligations for Annex I products apply from 2 August 2028 (Art. 113(3)(c)(ii) AI Act).

Enforcement lies with the market surveillance authority that each Member State designates and whose contact details are publicly available; one of them also acts as single point of contact (Art. 70(1) and (2) AI Act). In Germany this has been the Federal Network Agency (Bundesnetzagentur) since 29 July 2026 (§ 2(1) KI-MIG), in so far as no sectoral authorities are competent; it is also the single point of contact (§ 6(1) KI-MIG). Austria had not designated a market surveillance authority under Art. 70 AI Act as at 17 August 2026; the AI service centre at RTR is an information and advisory body without supervisory powers.

4. CJEU C-203/22 (Dun & Bradstreet, 27 February 2025) — right of access to the algorithm's logic

On 27 February 2025, in Case C-203/22 (Dun & Bradstreet Austria), the Court of Justice of the European Union set out the scope of the right of access under Art. 15(1)(h) GDPR: in the case of automated individual decisions within the meaning of Art. 22 GDPR, data subjects are entitled to 'meaningful information about the logic involved' — and in such a way that the decision can be traced and reviewed. A blanket invocation of trade secrets is not sufficient; in the event of a conflict, the information must be disclosed to a competent authority or to the court, which weighs the interests in confidentiality against those in access.

Consequence for recruiting: anyone running AI-supported pre-selection must be able to explain the core logic of the decision to a rejected applicant (on request). Vendor contracts without audit or information rights are a compliance risk.

The period that runs in the meantime: the controller must respond to requests under Art. 15 to 22 GDPR without undue delay and in any event within one month of receipt; the period may be extended by two months where the complexity and number of requests so require — the data subject must be informed of the extension, with reasons, within the first month (Art. 12(3) GDPR). An access process built only after the rejection rarely meets that period.

What this means for the contract: where the provider processes applicant data on the controller's behalf, the controller may only work with data processors providing sufficient guarantees of appropriate technical and organisational measures (Art. 28(1) GDPR); the contract must reflect the minimum content of Art. 28(3) GDPR — subject matter and duration, nature and purpose of the processing, type of data, categories of data subjects as well as the obligations and rights of the controller. This is reviewed by a different line of authorities than AI market surveillance: in Germany, the authorities competent under Land law for non-public bodies (§ 40(1) BDSG), in Austria the Austrian Data Protection Authority (Datenschutzbehörde) (§ 18(1) DSG).

5. Reality check on damages

In the practice of the Federal Labour Court, compensation typically ranges between 1 and 3 gross monthly salaries per claimant — but the real lever in algorithmic selection is not the individual amount, it is the number of persons affected. § 15 AGG provides for two bases of claim:

• § 15(1) AGG: compensation for material damage (lost pay, application costs) — no cap; the claim lapses where the employer is not responsible for the breach of duty.
• § 15(2) AGG: compensation for non-material damage — in cases of non-recruitment capped at 3 gross monthly salaries for the position, provided that the applicant would not have been recruited even under a non-discriminatory selection.

Higher amounts are conceivable in individual cases but must be specifically justified (seriousness of the breach of duty, absence of compliance measures, repetition). The abuse-of-rights line has a limiting effect: applications made without any intention of taking up employment are not protected (BAG, 19 September 2024 — 8 AZR 21/24). That defence, however, succeeds only with the same documentation that full proof under § 22 AGG also requires.

How large the lever becomes follows from the number of persons affected: with 40 rejections from the same model version and 1 to 3 gross monthly salaries per successful claim, 40 to 120 times a monthly salary is at stake — from a single model. In Germany the cases are bundled in time by the two-month period in § 15(4) AGG, running in the case of an application from receipt of the rejection (under civil law § 21(5) AGG); the Austrian periods are set out in the Germany/Austria box in section 2.

Depending on the facts, further exposure is added: GDPR damages under Art. 82 GDPR, the fine risk under EU AI Act Art. 99(4) (for infringements of the deployer obligations in Art. 26, up to EUR 15 million or 3% of worldwide annual turnover, whichever is higher — the deployer obligations in Art. 26 apply to Annex III systems from 2 December 2027, Art. 113(3)(c)(i) AI Act as amended by Regulation (EU) 2026/1744), the fine risk under GDPR Art. 83 — as well as reputational and follow-up costs. The maximum amounts are tiered and depend on which obligation was infringed:

6. BAG trend: BAG 8 AZR 300/24 (23 October 2025, Daimler Truck)

BAG 8 AZR 300/24 is an equal pay judgment and not an algorithm judgment — but it shows a trend in the case law that is highly relevant to algorithmic discrimination: the Federal Labour Court has made clear that a pairwise comparison with a single, highest-paid male colleague is already sufficient to trigger the presumption of discrimination under § 22 AGG / § 7 EntgTranspG. A median comparison is not required.

Applied to algorithmic discrimination: if even a single comparison case suffices as an indication, then a documented bias finding concerning a selection algorithm should all the more qualify as an indication within the meaning of § 22 AGG. The threshold for indications is tending to be lowered by the more recent BAG line — which increases the compliance pressure on employers to audit and document preventively.

This line rests here on three pay decisions: 21 January 2021 — 8 AZR 488/19 (already cited in section 2), 16 February 2023 — 8 AZR 450/21 ('better negotiating skills' do not justify a pay difference) and 23 October 2025 — 8 AZR 300/24 (a pairwise comparison suffices). For algorithmic selection this means two things: selection rates from your own ATS are the same type of data from which an indication was derived here, and a subjective justification formulated after the event is unlikely to carry the counter-evidence under the existing pay line (BAG 16 February 2023 — 8 AZR 450/21).

To be explicit: all three decisions are pay cases. As at the state of the sources reviewed (2 May 2026), no supreme court decision on algorithmic applicant selection is documented. Plan with documentation, therefore, not with a precedent.

7. What you must do — the compliance path

The path begins with the inventory and does not end with the contract with the provider: without a complete list of the systems deployed, neither the Annex III classification nor full proof under § 22 AGG can be furnished. The column 'Deadline / trigger' names statutory dates and — each expressly designated as such — practice recommendations; practice recommendations are organisational proposals without a statutory date.

7.1 Inventory and classification: the order matters

Review each system in this order: (1) Does a prohibition under Art. 5(1)(f) or (g) AI Act apply (section 3.2)? (2) Is it an AI system under Art. 3 no. 1 AI Act? (3) Does the intended purpose fall under Annex III no. 4 — job advertisement targeting, analysis, filtering, evaluation? Where the system performs profiling of natural persons, the exception in Art. 6(3) AI Act is not available. Whatever the outcome, the AGG remains applicable (section 1).

7.2 The data protection side strand: DPIA and data protection officer

Recruiting scoring can trigger the DPIA obligation under Art. 35 GDPR — and in Germany then entails the designation of a data protection officer irrespective of the number of employees. A data protection impact assessment must be carried out under Art. 35(1) GDPR where a type of processing — in particular using new technologies — is likely to result in a high risk to the rights and freedoms of natural persons; Art. 35(3) GDPR names as a standard example the systematic and extensive evaluation of personal aspects (profiling) with legal effect. The chain effect behind this: § 38(1) BDSG requires a data protection officer as soon as processing operations are subject to a DPIA under Art. 35 GDPR (alongside the 20-person threshold); in Austria the designation obligation follows directly from Art. 37(1) GDPR, and there is no additional numerical threshold there. Check also whether the system processes data revealing characteristics under Art. 9(1) GDPR (such as ethnic origin, health data, biometric data for unique identification) — these are subject to a general prohibition of processing with narrow exceptions.