December 2027 Was Never the Deadline

Europe's privacy chiefs just told HR departments the compliance date they've been planning around is a decoy. GDPR Article 22 has governed automated hiring since May 2018. The Digital Omnibus only postponed the AI Act's high-risk paperwork to December 2027. If your AI screener rejects candidates without a human who can actually override the score, the exposure is already live — and 25 regulators are now asking for proof it isn't.

What happened Thursday:

• On July 9, the European Data Protection Supervisor and European Data Protection Board hosted "Hired by an Algorithm" at the European Parliament in Brussels.
• EDPS Supervisor Wojciech Wiewiórowski delivered opening remarks — institutional weight for a trainee-organized event.
• Regulators' message: the Omnibus extension does not suspend GDPR. Article 22 applies today.

The quote that matters: Wiewiórowski warned employers are building "a recruitment landscape where AI meets AI, well before a human enters the picture at all." He added: "Efficiency should never come at the cost of unfairness, discrimination and structural bias."

Why December 2027 misled everyone:

• On June 29, the Council of the EU gave final approval to the Digital Omnibus, pushing Annex III high-risk AI obligations — including employment screening tools — from August 2, 2026 to December 2, 2027.
• Freshfields confirms Article 50 transparency rules (chatbot disclosure, synthetic-content marking) still kick in August 2, 2026 — 22 days from now.
• The Omnibus deferred documentation and conformity assessments. It did not touch GDPR.

What Article 22 actually requires:

• Job applicants have the right not to be subject to decisions based solely on automated processing that significantly affects them.
• Three narrow exceptions exist: contract necessity, specific legal authorization, or freely given explicit consent.
• Regulators say consent is structurally unavailable when the only way to apply is through the employer's AI gate.
• No EU member state has specifically authorized automated rejection in recruitment as of 2026.

The rubber-stamp problem:

• A recruiter who forwards an AI shortlist without reviewing rejected candidates does not satisfy Article 22.
• The CJEU's SCHUFA ruling (Case C-634/21, December 7, 2023) held that a scoring tool that materially influences a downstream decision falls within Article 22 — even when a human formally clicks approve.
• Applied to hiring: if recruiters advance only candidates above an AI threshold, the algorithm is the decision-maker regardless of audit-trail sign-offs.
• Vendors whose scores employers rely on without independent review may themselves bear Article 22 liability under the same standard.

Enforcement is not waiting:

• The EDPB's 2026 Coordinated Enforcement Framework action has 25 national data protection authorities auditing transparency under GDPR Articles 12–14.
• France's CNIL is coordinating; Germany's Brandenburg authority is specifically targeting recruitment agencies.
• Spain's Foundever ruling (Audiencia Nacional, July 4, 2025) voided HR algorithm practices and ordered disclosure of parameters to worker representatives.
• Amsterdam's Court of Appeal "robo-firing" case (April 2023) barred terminations lacking meaningful human judgment.
• None of these cases rested on the AI Act.

What employers should do now:

• Audit whether human reviewers genuinely evaluate rejected candidates — or merely ratify machine output.
• Update privacy notices to disclose algorithmic screening, profiling logic, and candidate rights.
• Clarify Article 22 controller status in vendor contracts before August's Article 50 transparency deadline arrives.

What we cannot verify:

• Whether any specific HR vendor named at the conference faces imminent enforcement action.
• How many employers have actually paused AI screening workflows since Thursday.

Convina's view: Brussels played a cruel trick on compliance teams: it extended the AI Act calendar while reminding them the law that already bites is eight years old. Vendors selling "2027-ready" hiring AI are marketing a deadline that never governed rejections. The SCHUFA standard means rubber-stamp human review is worse than no review at all — it is evidence you knew the machine decided. If your HR stack cannot show a qualified person independently evaluated every rejected file, you are not behind on compliance. You are already out of it.