voccess
Recruiting Compliance · Self-assessment

How legally compliant is your recruiting?

Salary information, equal treatment, GDPR, and EU AI Act: Check in about five minutes where your recruiting stands – with a traffic light for each area and concrete next steps.

Start checkRecruiting Compliance

The recruiting compliance check by voccess is a free self-test for companies in Austria. In 14 questions, you assess whether job ads, selection, data protection, and the use of AI in recruiting meet the main requirements of the Equal Treatment Act (GlBG), GDPR, and EU AI Act. You receive a traffic light for each area and concrete recommendations – your answers remain in your browser.

Content status: · No legal advice

  • About 5 minutes

    Yes, Partially, or No – for AI questions also "Not applicable."

  • Four legal areas

    Job ad, selection and documentation, GDPR, AI in recruiting.

  • Concrete recommendations

    A next step with legal basis for each open answer.

  • Nothing is saved

    The check runs in the browser. No answers are transmitted.

Self-assessment

The check: 14 questions in 4 areas

Answer each question as it is actually practiced in your company today. “Yes” counts two points, “Partially” one, “No” none; “Not applicable” is not considered. A section is green from 80 percent of possible points and without a “No,” yellow from 50 percent, below which it is red.

Data protection: Your answers are evaluated only in your browser – not saved and not sent to voccess or third parties. They are deleted when the page is reloaded.

01

Job ad

The first obligations arise before the first application is received: with the text of the job posting.

Question 1Do your job ads state the minimum salary according to the collective agreement (Kollektivvertrag) or law – and, if applicable, the willingness to pay more?

In Austria, every job advertisement must state the minimum salary applicable to the position and indicate any willingness to pay more. This obligation applies to employers and private recruitment agencies. In case of violations, a warning is initially issued, with an administrative fine in case of repetition.

Legal basis: § 9 Section 2 and § 10 GlBG

Question 2Are your job postings formulated in a gender-neutral way and free of requirements that are unjustifiably linked to age, origin, religion, or sexual orientation?

The Equal Treatment Act prohibits discriminatory job ads. This includes not only exclusively male or female job titles but also phrases like “for our young team up to 30” or “native German speaker,” if they aren’t objectively necessary for the role.

Legal basis: § 9 Section 1 and § 23 GlBG

02

Selection and documentation

Fair criteria and understandable reasoning protect against discrimination – and, in case of dispute, also your company.

Question 3Do you establish selection criteria before reviewing applications, and apply them equally to all candidates?

Objective, pre-set criteria from the job profile are the best basis for a fair decision. If criteria arise during the process or are applied differently per person, claims of disadvantage are difficult to refute.

Legal basis: § 3 Item 1 and § 17 Section 1 Item 1 GlBG

Question 4Do you document why candidates progress or are rejected – in a way you can substantiate months later?

If a rejected person credibly claims discrimination, the company must demonstrate that another, factual reason was decisive. Claims due to discrimination in establishing an employment relationship must be legally asserted within six months – during this time, the justification should be accessible.

Legal basis: §§ 12, 15, 26, and 29 GlBG (burden of proof and deadlines)

03

Data protection (GDPR)

Applications contain personal, often sensitive data. The GDPR regulates how you inform, store, transfer, and delete.

Question 5Do you inform candidates, at the latest upon receipt of the application, about the purpose, legal basis, and duration of data processing?

The GDPR requires that those affected are informed about the purpose, legal basis, recipients, storage duration, and their rights when their data is collected. The basis for processing an application is usually the initiation of an employment relationship. A dedicated data privacy notice for candidates is customary.

Legal basis: Art. 13 and Art. 6 Section 1 lit. b GDPR

Question 6Is there a defined storage period for documents of rejected candidates – and are data actually deleted afterward, including from mailboxes and files?

Personal data may only be stored as long as necessary for the purpose. In Austria, it is customary to retain documents of rejected candidates for about six to seven months after rejection: This covers the deadline for claims under the Equal Treatment Act, including a short buffer. Data should then be deleted – including copies in email mailboxes, printouts, and shared folders.

Legal basis: Art. 5 Section 1 lit. e and Art. 17 GDPR; § 15 and § 29 GlBG

Question 7Do you obtain a separate, voluntary consent before retaining applications for future positions (Talent Pool or evidence retention)?

To retain documents for future positions, consent is usually required. It must be given voluntarily, separate from the application, be revocable at any time, and include a set duration. Without consent, the normal deletion period applies. Choose “Not applicable” if you do not retain applications for future positions.

Legal basis: Art. 6 Section 1 lit. a and Art. 7 GDPR

Question 8Do you have a data processing agreement with all service providers processing applicant data on your behalf – like the applicant management system or video interview tool?

If a service provider processes personal data on your behalf, the GDPR mandates a contract with minimum content. For providers outside the EU, there's additional review on the basis for data transfer to a third country.

Legal basis: Art. 28 and Art. 44 ff. GDPR

Question 9Is it regulated who may access applications – and do only the persons involved in the specific process have access?

Application documents often contain sensitive information. The GDPR requires appropriate technical and organizational measures so that only authorized personnel can access them. A common risk is documents being forwarded to large email distribution lists.

Legal basis: Art. 5 Section 1 lit. f and Art. 32 GDPR

04

AI in recruiting (EU AI Act)

The ban on certain AI practices and the obligation to ensure AI competence have been in effect since February 2025. Obligations for high-risk AI – which includes AI in personnel selection – were originally planned for August 2026; however, the EU has initiated a postponement with the so-called Digital Omnibus. Regardless of the exact deadline, it’s worth implementing these points now: Many are already required by the GDPR.

Question 10Are you aware of which of your recruiting tools use AI, for instance, to sort, evaluate, or rank applications or to target job ads?

The EU's AI Act classifies AI systems intended for hiring or selecting individuals as high-risk, such as those targeting job postings, analyzing and filtering applications, or evaluating candidates. Many applicant management systems now include such features. Those who use them are considered "operators" and have their own obligations. As of February 2025, AI for emotion recognition in the workplace is among the prohibited uses. If you do not use AI, respond with "Yes."

Legal basis: Art. 5 para. 1 lit. f, Art. 6 para. 2 and Annex III no. 4 AI Act

Question 11Does a human always make the decision in pre-selection and rejections, even if a tool pre-sorts or evaluates applications?

Decisions with legal or similarly significant effects must not be made solely by automation. Therefore, an automatically sent rejection is sensitive. For high-risk AI, the AI Act additionally requires effective human oversight by individuals who understand the system and can override its results.

Legal basis: Art. 22 GDPR; Art. 14 and Art. 26 AI Act

Question 12Do you inform candidates when AI is involved in selection or evaluation, and involve the workforce representation before introducing such systems?

Operators of high-risk AI must inform individuals affected or whose decisions it supports. Before workplace implementation, employee representation and affected employees must be informed; in Austria, Works Council involvement according to the Arbeitsverfassungsgesetz (Austrian Labor Constitution Act) may also be necessary. Choose "Not applicable" if no AI is involved in the selection process.

Legal basis: Art. 26 para. 7 and 11 AI Act; Art. 13 GDPR; §§ 96 and 96a ArbVG

Question 13Do you use AI features according to the provider's instructions, monitor their operation, and retain the automatically generated logs?

Operators of high-risk AI must use the system according to the operating instructions, check input data – where they can control it – for suitability, monitor its operation, and generally retain automatically generated logs for at least six months. Choose "Not applicable" if no AI is used in the selection process.

Legal basis: Art. 26 AI Act

Question 14Are the employees working with AI in recruiting trained on its functionality, limitations, and risks like biases?

Since February 2025, the AI Act requires companies using AI systems to make every effort to ensure their staff has adequate AI competence. This also includes general AI tools, such as those for drafting job ads. Choose "Not applicable" only if no AI is used in recruiting.

Legal basis: Art. 4 AI Act

0 of 14 questions answered

Additional content

No legal advice

The Compliance Check provides general information on the legal situation in Austria and serves as guidance. It does not replace legal advice or the review of your individual case; it does not guarantee completeness or legal conformity. Especially the deadlines of the EU Artificial Intelligence Act (AI Act) can change due to ongoing legislation. For a binding assessment, please consult lawyers or data protection experts.

Status:

Frequently asked questions about the Compliance Check.

What the self-check accomplishes – and what it doesn't.

No. The check runs entirely in your browser. Your answers are neither saved nor sent to us or any third parties; they are cleared when you reload the page. If you wish to keep the results, print them out or save as a PDF.

Any questions?

We offer non-binding advice on your personnel strategy.

Get in touch

Looking for your next key appointment?

Together, we'll find the specialists and executives who will sustainably advance your company.

Get in touch

Ready for the next career step?

We connect you with companies that truly match you. Find your next job.

Find job