Many applications no longer go straight to a person. Software can read CVs, sort them by keywords and check formats. Applicants therefore ask whether a filter decides their chances and what rights they have. This guide explains what such systems typically do, what the German data protection authorities say about them, and how to prepare your documents so that they remain readable for both software and people.
Short answer: Software can pre-sort applications, for example by keywords, qualifications and format. According to the guidance of the German Data Protection Conference, decisions with legal effect under Article 22 GDPR may in principle only be taken by people. A formal human involvement is not enough. As an applicant, you can request information about the logic involved. Last updated: November 2026.
The Most Important Points at a Glance
- Pre-sorting by software is not the same as an automated decision about your application.
- According to the guidance, decisions with legal effect may in principle only be made by people.
- Under this guidance, a person who merely confirms an automatic selection does not provide sufficient involvement.
- You have information rights about the logic involved and the scope of the processing.
- Clear wording and a readable layout help both software and people.
What Do Filters Do With Your Application?
This guide uses the term AI filter for systems that capture and pre-sort application documents automatically. Whether and how a company uses such tools is not publicly standardised. Typical functions include reading job titles, qualifications and career stages, recognising key terms from the advert, or checking formal features of a file. The result is usually a ranking or a marker that a person reviews afterwards.
No official list exists of the criteria such systems use. If you read claims about specific products or percentages, check the source. This guide therefore names no providers and no hit rates.
What Does the Data Protection Authority Say?
In its guidance on artificial intelligence and data protection, the German Data Protection Conference addresses automated decisions. It states that decisions with legal effect under Article 22(1) GDPR may in principle only be taken by people. A merely formal involvement of a person is not sufficient. As an example, the paper describes an AI application that evaluates all applications for a position and independently invites candidates to interviews. It considers this a breach of Article 22(1) GDPR.
Source: Guidance of the German Data Protection Conference (DSK): Artificial Intelligence and Data Protection, version 1.0, 6 May 2024 (in German). The wording of the provision can be found at Article 22 GDPR (DSGVO), gesetze.legal (German text).
| Situation | Assessment under the guidance | What you can do |
|---|---|---|
| Software sorts by keywords, a person reviews the list | Pre-sorting with a human decision | Nothing special, but make your documents clear |
| Software rejects or invites, a person only nods it through | Not sufficient according to the guidance | Request information about the logic |
| Software decides with legal effect without a person | In principle not permitted under Article 22(1) GDPR, exceptions in paragraph 2 | Check information rights and consider a complaint to the data protection authority |
Why the Human Decision Matters
The core of the rule is simple. Software may pre-sort, but a machine may not decide alone on an application with legal effect. For applicants, this means a person should actually have examined the documents and should be able to reconsider the result. Whether that examination takes place in practice cannot always be seen from outside.
The distinction between a ranking and a rejection also matters. A ranking is an order that serves as a basis for a human decision. A rejection sent without human review affects your rights directly. The guidance treats both under the heading of decisions with legal effect, and the question is which of them is actually made by a person.
Which Rights Do You Have as an Applicant?
The guidance describes transparency duties. Controllers must provide information about the logic involved in an automated decision, as well as its scope and possible effects. An explanation of the processing method in the concrete case is required. The paper also points to rights to rectification and erasure, and it stresses that erasure must ensure that a personal link can no longer be restored.
Ask for information in writing and name the advert and the period of your application. That makes the request traceable and allows the company to assign it clearly to your application.
How Should You Prepare Your Documents?
Whether a person or software reads first, clarity counts. The following points are practical recommendations, not official requirements. They help ensure that content is captured correctly even when formatting is not carried over.
- Use common headings such as work experience, education and skills.
- Keep the CV layout simple, without complex columns or graphics.
- Use concrete terms from the advert where they fit your experience.
- Save the PDF so that text can be selected and copied.
You can also prepare a cover letter that refers to the specific requirements. How to use AI tools responsibly for this is explained in the German guide Bewerbung mit KI schreiben: Was erlaubt ist und was auffällt.
Frequently Asked Questions
May a company use AI to pre-sort applications?
According to the wording of the cited passages, the prohibition concerns decisions with legal effect, not every kind of support from software. The decisive point is that such decisions are not made solely by automated processing. Whether a specific use is lawful depends on the individual case.
Must I be told that software is used?
The guidance refers to transparency duties under Articles 12 et seq. GDPR. For automated decisions, information about the logic involved belongs to what must be provided. You can request that information.
Does changing my CV format help?
A clear structure helps every reader. Whether a particular software reads one format better than another is not publicly documented. Focus on readability rather than tricks that make the document harder for people to read.
What if a rejection arrives without reasons?
A rejection is not automatically a sign of software involvement. If you have doubts, ask about the procedure. Guidance on handling rejections is available in the German guide Bewerbungsabsage erhalten: Was du jetzt tun kannst (in German).
What does formal involvement of a person mean?
It means involvement that exists only on paper. A person who takes over or confirms a software result without their own review provides no substantive control. The guidance names exactly this case as insufficient, so the review has to be able to change the outcome.
What to Do Now
- Read the job advert and mark the central requirements.
- Check your CV for clear headings and readable formatting.
- Make sure every requirement is backed by evidence.
- Note which company you applied to, in case you later want to request information.
Related Articles
- Student CV: How to Build a Strong One Step by Step
- Student Job Application: Cover Letter and Tips
- Email job application: structure, attachment and subject line
- Job Interview Tips: How to Make a Confident Impression
- Job application without work experience
Sources: Guidance of the German Data Protection Conference (DSK): Artificial Intelligence and Data Protection, version 1.0, 6 May 2024 (in German); Article 22 GDPR (DSGVO), gesetze.legal (German text).
Last updated: November 2026. This guide is general information, not individual advice.
