Can AI reject my job application? What the law gives you

Yes. A machine can reject your application without a person reading it, and it usually happens on a rule an employer typed into a settings page rather than on anything a model concluded. If you applied in the European Union, the rule that gives you something to ask for is Article 22 of the GDPR, in force since 2018.

It is not the AI Act. The AI Act's obligations for recruitment software were pushed back to 2 December 2027, which most of what was published about this in the last month has not caught up with.

The trigger is usually not your resume

Two mechanisms do most of the fast rejections, and I went through both in what actually happens when a rejection arrives minutes after you apply. An auto-reject rule fires on an answer you gave on the application form. A separate filter reads one stated fact out of your history, most often a break in your dates. Neither is AI in any interesting sense.

On top of that, some employers now run a model that summarises and ranks the applications which survive the rules. That layer is what people mean when they ask whether AI rejected them, and it is the layer the law is trying to describe.

The difference decides what you can do. There is no appeal against a knockout question you answered honestly. There may be something worth asking for when a ranking model shaped the outcome.

The AI Act headline moved to December 2027

Recruitment software is named in the Act. Annex III, point 4(a) covers "AI systems intended to be used for the recruitment or selection of natural persons, in particular to place targeted job advertisements, to analyse and filter job applications, and to evaluate candidates". That classification is high-risk, and it attaches to the employer and the vendor. It does not attach to a tool you run on your own document.

What changed is when it bites. The obligations for Annex III systems were due on 2 August 2026. Regulation (EU) 2026/1744 of 8 July 2026, the Digital Omnibus on AI, amended Article 113 and moved that date to 2 December 2027. It is not a proposal any more: it was published in the Official Journal on 24 July 2026, and the Commission's AI Act Service Desk now shows the amended text.

So the recruitment rules are law, and they are not yet in application. An article telling you the AI Act covers CV-sorting software today is quoting a date that was superseded before it arrived.

The Act does contain a right to an explanation. Article 86 gives any affected person subject to a decision based on the output of an Annex III high-risk system the right to "clear and meaningful explanations of the role of the AI system in the decision-making procedure and the main elements of the decision taken". Worth knowing about. Not worth invoking while the regime it hangs off sits more than a year out.

GDPR Article 22 is the rule that works today

Article 22(1) reads: "The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her."

Recruitment is not an edge case here. It is one of the two examples the legislation itself reaches for. Recital 71 names "e-recruiting practices without any human intervention" alongside the automatic refusal of an online credit application.

Three exceptions in Article 22(2) let an employer make such a decision anyway: where it is necessary for entering into or performing a contract, where Union or Member State law authorises it with safeguards, or where you gave explicit consent. Employers lean on the first one.

Here is the part that gets left out of most coverage. Under the contract and consent exceptions, the prohibition falls away but the safeguards in Article 22(3) do not. The employer must still give you "the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision". An exception is not a way out of the review. It is a way out of the ban.

A rubber stamp does not make it a human decision

This is the sentence the category never quotes, and it is the one with teeth. The EU regulators' guidance on automated decision-making says that to qualify as human involvement, "the controller must ensure that any oversight of the decision is meaningful, rather than just a token gesture. It should be carried out by someone who has the authority and competence to change the decision."

The same guidance closes the obvious loophole a paragraph earlier: "if someone routinely applies automatically generated profiles to individuals without any actual influence on the result, this would still be a decision based solely on automated processing."

A recruiter clicking through a machine-ordered shortlist and declining everyone below the fold has not made the decision human. That is a factual question about how the employer works, not a matter of what their careers page says.

What to ask for, and what you will not get

Send it to the employer. They are the data controller, not the software vendor, and the vendor will not answer you.

1. Name the role and the date you applied, so they can find the record.
2. Ask whether the decision was based solely on automated processing, including profiling.
3. Ask for meaningful information about the logic involved, and the significance and envisaged consequences of the processing.
4. Where Article 22 applies, request human intervention, and state your point of view in the same message so there is something for a person to weigh.

Article 12(3) gives them one month to respond, extendable by two further months for a complex request, and they have to tell you within the first month if they are taking the extension.

Now the limits, because they are real. The guidance is explicit that the GDPR requires "meaningful information about the logic involved, not necessarily a complex explanation of the algorithms used or disclosure of the full algorithm". You get the criteria and the rationale. You do not get the model, your position in a ranking, or a number. And none of this reverses a decision that a competent human made on the merits after considering your case. It gets you a decision made by a person. It does not get you the job.

If you applied in the United States

There is no federal equivalent of Article 22, and the state and city picture changes often enough that it is worth checking where you actually applied. Two rules show the range of what a law aimed at hiring software can give you.

New York City: notice, an audit, no appeal

Local Law 144 requires an employer using an automated employment decision tool to have had it through a bias audit within the previous year, to publish information about that audit, and to notify candidates who live in New York City at least 10 business days before using the tool. If you live anywhere else, you get no notice, but the audit summary is still public. The Department of Consumer and Worker Protection began enforcing it on 5 July 2023.

Read what it gives you carefully. It is a disclosure and audit regime aimed at the employer. There is no right to a human decision in it.

Connecticut: in force since 1 October 2026, and widely misread

Connecticut's Governor signed Public Act 26-15 on 27 May 2026. Its hiring sections carry an effective date of 1 October 2026. That date is real. It is not the date applicants get notice.

The notice duties are written for a deployer who, in the Act's words, "on or after October 1, 2027, deploys" a covered tool. From that point, before an employment-related decision is made about an "employee or applicant for employment in the state", the employer must tell you in writing:

1. That it uses an automated employment-related decision technology.
2. What the tool is for, and what kind of decision it feeds.
3. The tool's trade name.
4. Which categories of your personal data it analyses, and how they are assessed.
5. Where that data came from.
6. Who to contact.

A tool that interacts with you directly, such as a chat screen, also has to be disclosed as a machine, unless a reasonable person would find that obvious.

What the Act does not contain is an appeal. Sections 7 to 12 hold no right to human review and no right to correct your data. An employment-law newsletter published on 17 September told employers that the law "requires" them to "offer a right to appeal". The statute does not say that. Enforcement belongs to the Attorney General alone, and the Act states that it creates no private right of action.

The definition is wider than "AI". It covers any technology that processes personal data and generates a "prediction, recommendation, classification, ranking, score or other information" that meaningfully alters the outcome. So it is written to reach rankings and scores, which is where most of the rejecting happens.

What did change on 1 October 2026 is narrower, and more useful if it applies to you. Connecticut's anti-discrimination statute now says the use of such a tool "shall not be a defense against a complaint alleging a discriminatory practice". If you believe a screening tool rejected you because of your age, a disability, your sex or another protected characteristic, the employer cannot answer that the software made the call. The commission or the court may still weigh the employer's anti-bias testing.

The three rules side by side

What to do with the twenty minutes instead

Filing a request is the right move when a decision looks automated and the role mattered to you. For the next fifty applications it is not where the return is.

The thing you can actually control is whether your own document survives being read by software, and that is checkable rather than arguable. Three things are worth your time: whether a parser reads your file correctly, whether your resume uses the words the job description uses, and whether the layout scrambles the reading order. I set out how to check each one in the honest version of the ATS question, and what an ATS score actually measures covers why the percentages sold alongside those checks are not measuring anything.

If you want to see what a parser pulls out of your own file, Upload your resume. No account, and the review is complete rather than a teaser with the findings behind a lock.

The short version

A machine can reject you, and most of the time the machine is a rule rather than a model. In the EU, Article 22 of the GDPR is the rule with force behind it today: where a decision was solely automated and significantly affects you, you can ask for information about the logic and for a person to look again, and a recruiter rubber-stamping a ranking does not count as that person. The AI Act will cover recruitment software from 2 December 2027, not from August 2026. Anyone telling you otherwise is more than a year early. In Connecticut, written notice arrives in October 2027, and the Act has no appeal in it at all.

If your application was killed by a knockout question, none of this helps, and knowing that is worth something too. Upload your resume and fix the part you control.

Sources

• Regulation (EU) 2026/1744 of 8 July 2026 (Digital Omnibus on AI), OJ L, 2026/1744, 24.7.2026, which amends Article 113 of Regulation (EU) 2024/1689 and moves the Annex III date to 2 December 2027.
• European Commission AI Act Service Desk, Annex III, point 4(a) on recruitment, and Article 113, which now shows the amended date.
• Article 22 GDPR and Article 12 GDPR. Verbatim text of Regulation (EU) 2016/679.
• Article 29 Data Protection Working Party, Guidelines on Automated individual decision-making and Profiling for the purposes of Regulation 2016/679 (wp251rev.01), endorsed by the European Data Protection Board. Pages 20 to 21 for meaningful human involvement, page 25 for the logic involved.
• NYC Department of Consumer and Worker Protection, Automated Employment Decision Tools, for the bias audit, the 10 business day notice and the enforcement date. Frequently Asked Questions, section VI.1, for the limit of notice to New York City residents.
• Connecticut General Assembly, Public Act 26-15 (Substitute Senate Bill 5), approved 27 May 2026. Sections 7 to 12 for the definitions, the 1 October 2027 notice trigger and Attorney General enforcement. Section 13 for the amendment to section 46a-60 that removes the software defense.
• Employment Law Letter, Connecticut's AI Act Takes Effect October 1, 17 September 2026. Quoted as the source of the "right to appeal" claim, which the statute does not support.
• Article 99 GDPR, for the 25 May 2018 date of application.

The Connecticut, Article 99, NYC FAQ, Regulation (EU) 2026/1744 and Article 113 sources were accessed 6 October 2026. All others were accessed 9 September 2026.