You post a job ad for a machine operator or a warehouse worker. A week later the recruitment inbox holds 180 CVs, and the shift supervisor reads them in the evenings because days belong to production. By the time she calls the best candidates back, half of them have taken other jobs. Someone on the team says: "let's put them into ChatGPT and have it pick the top twenty."
After reading this you will decide three things: whether AI pays off at all at your application volume, which part of screening you can hand to a model without legal risk, and what you need in place before the first CV goes into any tool.
Count before you buy anything
Reading one CV properly takes 2–4 minutes. With 150 applications that is 5–10 hours of work for someone who usually has another job. A model that extracts facts into a table cuts this to 1–2 hours of checking.
We typically see the threshold at around 50 CVs a month, or two to three large seasonal hiring rounds a year. Below that, setup and checking eat more time than you save.
The most common mistake: you automate ranking when the real problem is the job ad. If the ad does not say you require a forklift licence (in Poland, the UDT certificate) and three-shift availability, you will get 180 random applications. Two or three knock-out questions in the application form ("Do you hold a valid forklift licence?", "Can you work night shifts?") filter out half of them with no AI and no cost.
What to hand to the model — GDPR and the EU AI Act
The safe role for AI is fact extraction. The model reads a CV and fills in a table: licences, years of experience in a similar role, location, languages, availability. For each hard requirement it writes "yes", "no" or "no information". A person makes the decision, looking at both the table and the CV.
What not to hand over:
- A 0–100 "match score". You do not know where the number comes from, so you cannot explain it to the candidate.
- Automatic rejection. Article 22 GDPR gives people the right not to be subject to a decision based solely on automated processing that significantly affects them. Rejecting a job application is such a case. Source: GDPR, Article 22 (EUR-Lex).
- "Personality" or "culture fit" assessments. The model repeats patterns from its training data: age, career gaps, surnames.
The Polish Labour Code (Article 22¹) limits what data you may ask a candidate for: name, date of birth, contact details, education, professional qualifications and employment history. Source: Polish Labour Code (ISAP). Write it into the model's instructions explicitly: ignore date of birth, photo and gender.
The second issue is the tool. CVs are personal data, so a free chatbot account is out. You need a business plan with a data processing agreement and no training on your data. If your company has no rules for this yet, start there — we covered them in the post on an AI usage policy for SMEs.
EU AI Act: what applies to you and when. The EU AI Act classifies AI systems used for recruitment, in particular for filtering applications and evaluating candidates, as high-risk (Annex III, point 4). Source: Regulation 2024/1689 (EUR-Lex).
The application date for these rules was moved from 2 August 2026 to 2 December 2027. The AI literacy requirements, on the other hand, have applied since 2 February 2025. Source: Polish Ministry of Digital Affairs, gov.pl (in Polish).
As a company that only uses such a tool (a "deployer"), from December 2027 you will have to, among other things: use it according to the vendor's instructions, assign a competent person to oversee it, keep the logs it generates for at least 6 months (where they are under your control) and inform candidates that the system was used.
The practical takeaway: a process where the model only extracts facts and a person opens every CV before rejecting it can be built today and will not need rebuilding next year. The line between "extracts facts" and "filters applications" is thin, though. If the model's table is the only thing you read before saying no, the model is doing the filtering in practice.
Two examples
Where it worked. One of our clients, a furniture manufacturer with 45 staff, was hiring 6 CNC operators and helpers before the season. 220 applications came in over 3 weeks from two job portals. The company already ran Microsoft 365, so CVs from one mailbox went to a model hosted in a European cloud region, and the output landed in a spreadsheet: 5 requirements, each "yes/no/no information", plus a one-sentence summary.
Setup took 2 days of work (about PLN 7,000, roughly EUR 1,650), and model usage for the whole round cost under PLN 50 (about EUR 12). The supervisor's time on first-pass screening dropped from about 12 to 3 hours, and first calls to candidates went out after 2 days instead of 8. A person checked every "no" in a few seconds each. Two people marked "no information" on licences had them in a scanned attachment the model had not read. The lesson: "no information" is not "no" and must never be dropped automatically.
Where it cost more. A Polish accounting firm with 18 staff was hiring an accountant. They bought an off-the-shelf recruitment system with a "match score" and set automatic rejection below 60 points. Subscription: about PLN 400 a month (around EUR 95).
Over 3 months and two hiring rounds, only a handful of people reached interviews. One rejected candidate had 9 years of experience with Comarch Optima, a popular Polish ERP. She scored 52 because her two-column CV was parsed badly. She asked on what basis she had been rejected. The firm could not answer, because it did not know what the score was made of. Preparing a reply with a lawyer cost about PLN 3,000 (around EUR 700) and two stressful days. Automatic rejection was switched off. The lesson: if you cannot explain why someone was rejected, do not let the system reject.
When it does not make sense
- Low volume. Below about 50 CVs a month, or with one hiring round a year, read them yourself. It is faster and carries no risk.
- Specialist roles. An accountant, process engineer or B2B sales role usually draws 5–20 applications. Nuance matters here, and a table will not capture it.
- No written criteria. If you cannot name 3–5 hard requirements, the model will invent its own. That is worse than no model.
What it costs: an off-the-shelf recruitment system with AI features is typically PLN 200–800 a month (about EUR 50–190). A simple in-house process on your existing Microsoft 365 is usually PLN 6,000–15,000 (about EUR 1,400–3,500) and 1–3 weeks, plus 2–4 hours of checking per hiring round. The cheaper alternative: knock-out questions in the form and a filter in Excel, for zero.
Remember retention too. CVs of people you did not hire get deleted after the round closes, unless they have given fresh consent for future rounds. This includes copies in the AI tool and in the results spreadsheet. More on this in the post on data retention for SMEs.
What to do this week
- Count the CVs from the last 12 months and estimate the hours spent reading them. That tells you whether you have a problem at all.
- Write down 3–5 hard requirements for the role you hire for most often.
- Add 2–3 knock-out questions to the application form or the ad text.
- Ask the people who recruit, directly, whether they paste CVs into free chatbots. If they do, stop it today.
- Check the privacy notice in your job ad: does it say which tools you use and how long you keep CVs.
- Set a specific date for deleting CVs after a closed round and put it in the calendar.
AI in hiring pays off only at several dozen CVs a month, and only in one role: it extracts facts into a table, and a person who can explain the decision decides who is rejected.