You applied at 22:40. The rejection landed at 22:43. No recruiter read your CV in three minutes, and you know it. The law already lets you demand answers.

Your feed spent the week getting the EU AI Act deadline wrong while missing this entirely. The fines reach 35 million euros. The rules changed in June. Here is what actually applies today, for the people who hire and the people who get hired.

What changed in June

The EU AI Act was written with 2 August 2026 as the big date. From that day, every AI tool used to screen, rank, or evaluate candidates was supposed to meet the strictest rules in the law.

That date moved. In June, the EU adopted a package called the Digital Omnibus. The main obligations for hiring AI now apply from 2 December 2027. The rules themselves did not change. The date did.

The penalty for non-compliance is up to 35 million euros or 7 percent of global annual turnover, whichever is higher. Companies gained sixteen months. Candidates did not lose a single right.

What is already in force, right now

Three things apply today, and they matter on both sides of the table.

First, emotion recognition at work has been banned since February 2025. Any tool that claims to read a candidate's feelings from their face or voice during an interview is already illegal to use in the EU.

Second, companies that use AI must train the people who use it. A recruiter running CVs through an AI screener without understanding what the tool does puts the company in breach today.

Third, as of 2 August 2026, candidates must be told when they are talking to a machine. An AI chatbot in a hiring funnel that pretends to be a person breaks the rules.

One more thing that surprises people. This law does not stop at the EU border. If a company screens a candidate for a role in the EU, it must comply, no matter where it is headquartered. A recruiter in London, Tel Aviv, or New York filtering applicants for a Limassol role is under this law the same as a company down the street.

If you hire people

If your organisation uses AI to screen CVs, rank candidates, or make shortlisting decisions, you have until 2 December 2027 to have documented oversight processes in place. That means a human who is actually reviewing AI outputs, not rubber-stamping them. It means candidates must be told AI is involved. And it means you need records. Sixteen months sounds like a long time. Building an audit trail is not a quarter's work.

If you are the candidate: how to know a machine rejected you

Three signals worth tracking.

Watch the clock. The rejection arrived before business hours in any time zone where the company operates, or within minutes of your submission. No human reviewed your application in that window.

Watch the questions. The application asked you to rank preferences, rate yourself on scales, or answer questions that felt oddly numerical. Those inputs often feed scoring models.

Watch the wording. The rejection says something like "after careful consideration" but arrived within hours of submission. That phrasing is often a template attached to an automated output.

None of these is definitive on its own. Together, they tell you something. And the law gives you the right to ask.

What you can do about it, step by step

These rights come from GDPR, which has been in force since 2018. You do not need to wait for 2027.

1. Document your application first. Screenshot the job posting, your submission, the confirmation, and the rejection. Timestamps matter, and this takes one minute.
2. Ask directly, in writing. Under GDPR Article 15, you are entitled to know what personal data of yours was processed and whether automated decision-making was involved in your application.
3. Request a human review. Under GDPR Article 22, where a decision was made solely by automated processing, you have the right to human intervention, to put your case, and to contest the decision. Ask for a named person to review your application.
4. Count the days. The company has one month to respond. Silence past that date is itself a breach, separate from anything about your application.
5. If they stonewall, the complaint costs nothing. In Cyprus, the Commissioner for Personal Data Protection takes complaints online for free. Every EU country has an equivalent authority.

What the reply tells you

Some companies are genuinely trying to use AI responsibly in hiring. They are building in oversight, flagging edge cases for human review, and thinking carefully about what their models are actually selecting for.

Others are using it to process volume and cut cost, with minimal human involvement and no real audit trail. Most will reply that a human was involved. Sometimes that is true. Sometimes the human is approving the machine's shortlist in bulk, which is exactly what the incoming rules refuse to accept as real oversight.

Either way, the response you get when you ask about automated decision-making is its own form of signal. A company that answers clearly has shown you how it treats people. A company that cannot explain how it rejected you has shown you that too.

From December 2027, one more right arrives. Companies will have to tell you when a high-risk AI system helped decide your application, and explain its role in the decision. Until then, ask anyway. The good companies will answer now.

The summary

The bans and the transparency duties are in force. The candidate rights above work today. The main obligations for hiring AI arrive on 2 December 2027, moved there in June. Anyone who told you otherwise this week read a headline and skipped the legislation.

The email that asks the question, with the legal wording already written, is free here.

Anca