TalenIA — EU AI Act and Spanish AI Law

The EU AI Regulation (Regulation 2024/1689) classifies AI systems into four risk levels. Systems used for recruitment and personnel selection fall under Annex III as high-risk systems.

TalenIA falls into this category. We believe being transparent about it is the right stance, and that the correct response is not to avoid the classification but to design the product to meet its principles from day one.

The Annex III high-risk obligations, initially due on 2 August 2026, have been postponed to 2 December 2027 by the "Digital Omnibus" legislative package, approved by the Council of the EU on 29 June 2026 (pending formal publication in the EU Official Journal). Regardless of this extension, TalenIA already meets the key principles voluntarily and has started the registration process in the European Commission's AI Office public database, under Article 71 of the Regulation.

On 26 May 2026, the Council of Ministers approved the Draft Organic Law on the Good Use and Governance of Artificial Intelligence, currently going through parliamentary procedure, with final approval expected before December 2027. This law implements the EU AI Act's sanctioning regime into Spanish law and adds national specifics.

As a high-risk system (Annex III), TalenIA is subject to fines of up to €15 million or 3% of worldwide turnover for serious breaches, and up to €35 million or 7% for prohibited practices. TalenIA takes a proactive compliance stance, it does not wait for the national law to enter into force to apply its principles.

The Spanish law's specifics include an explicit ban on non-consensual sexual deepfakes and reinforced protection for minors and vulnerable groups against AI systems that exploit their vulnerabilities. TalenIA does not operate in either of these areas.

• You'll know if AI was used: the recruiter can send you a closing email that states this. If you don't receive one, you can request it directly from the employer.
• Your CV is not stored in an identifiable form: TalenIA pseudonymises names before processing them. The recruiter sees an initials code, not your real name, during the evaluation phase.
• No automated decisions are made about you: every action that affects you (advancing, rejecting, inviting to interview) is decided by a person.
• Right to an explanation (Art. 86 AI Act): if you were evaluated with TalenIA, you have the right to request an explanation of the results generated by the system and to ask for the decision to be reviewed by a person. To exercise this right, contact the company that ran the hiring process directly, or write to us at [email protected] stating the company name and the role.
• Your data is deleted: the CV text and identifying data are irreversibly purged once the archive period elapses (maximum 60 days after the process is closed or expires). Only numeric scores without direct identifiers are kept.

By using TalenIA to run hiring processes, your company acts as a deployer of a high-risk AI system within the meaning of the EU AI Act. This carries obligations of your own that TalenIA cannot fulfil on your behalf:

• AI literacy training (Art. 4, already in force since August 2025): you must ensure that staff using TalenIA have an adequate level of understanding of how AI systems work, their risks and their limitations. This obligation is enforceable now and must be documented.
• Effective human oversight: you must ensure that the people making hiring decisions understand TalenIA's scores as guidance, not a definitive criterion, and are trained to disregard or challenge them.
• Transparency towards candidates: you must inform candidates that an AI system was used in their evaluation. TalenIA makes this easier through the closing email templates. Using them is recommended.
• Legal basis for data processing: you are responsible for processing your candidates' data (Art. 28 GDPR). See our Data Processing Agreement (DPA) for details.
• AI system inventory: TalenIA must appear in your internal inventory of high-risk AI systems, classified under Annex III, personnel selection.

TalenIA makes the system's technical documentation available to clients and can assist with the Fundamental Rights Impact Assessment (FRIA) required for high-risk systems. Write to us at [email protected].

TalenIA processes candidates' personal data solely for the stated purpose: assessing suitability for a specific role. The legal basis is the employer's legitimate interest in the context of an active hiring process.

For more information on data processing, see our Privacy Policy.

For companies running due diligence, DPOs assessing TalenIA's use, or anyone who wants to understand the system's technical workings in detail:

If you're an organisation assessing TalenIA for internal use and need additional compliance information (FRIA, technical system documentation, signed DPA, coordination with your DPO), write to us at [email protected]. You can also raise queries with the AESIA (aesia.gob.es) as the national supervisory authority.