Hiring questions
What should you check before using AI to screen CVs?
Seven things. Where candidate data is stored, whether it trains AI models, whether a person makes every decision, whether every score has a reason you can check, which languages it reads and asks in, when the data is deleted and what candidates are told. Recruitment screening is high risk under the EU AI Act, so these are the questions a regulator would ask too.
1. Where is candidate data stored?
A CV is personal data, and the employer answers for where it goes. Ask where it is stored, who else processes it and on what legal basis it leaves the EU, if it does.
Staffholm. Stored in the EU. The CV text and the answers are sent to Anthropic in the US to be read, under Standard Contractual Clauses. Every processor is on the sub-processors page.
2. Is it used to train AI models?
A CV used for training can shape someone else's product for years. Ask for the answer in writing.
Staffholm. No. We do not use employers' or candidates' data to train AI models, and Anthropic does not train its models on data sent through its API. Privacy policy →
3. Does a person make every decision?
Software that rejects people on its own makes a decision about a person, which GDPR Article 22 restricts. It also turns away good people for reasons nobody checked.
Staffholm. Yes. It ranks candidates and gives reasons. It never rejects anybody on its own.
4. Does every score come with a reason you can check?
A number without a reason cannot be explained to a candidate, a colleague or a regulator.
Staffholm. Every reason names a requirement from your advert and quotes the line of the CV behind it, and every score splits into recorded parts. AI transparency notice →
5. Which languages does it read and ask in?
A tool built for English misreads Estonian CVs and puts off candidates who would rather answer in their own language.
Staffholm. It reads CVs in Estonian and English and asks its questions in either, following the advert and the language the candidate chose.
6. When is the data deleted?
GDPR allows keeping personal data only as long as it is needed, and an old CV nobody needs is only a risk.
Staffholm. An application that is never sent is deleted within a day. A sent one is kept for 240 days, or 180 days after the job is filled if that comes first, and the files go with it. Candidate privacy notice →
7. What are candidates told?
Candidates have a right to know that software reads their CV and what it does with it.
Staffholm. A candidate privacy notice and an AI transparency notice are public in Estonian and English, and Staffholm helps you answer every candidate.
One thing to rule out
Tools that read emotions from a face or a voice. The EU AI Act has banned AI that infers emotions in the workplace since 2 February 2025, except for medical or safety reasons. Staffholm reads the CV and the candidate's answers and nothing else.
How Staffholm compares with job portals and recruitment systems →
EU AI Act (Regulation (EU) 2024/1689), Article 5 and Annex III. GDPR, Article 22. Written on 25 September 2026.