Drug testing in recruitment raises high-risk AI questions under the AI Act

The supervision

IMY, the Swedish Data Protection Authority, has opened supervision of ICA Gruppen Aktiebolag concerning the processing of personal data in connection with drug testing during recruitment ^[4]. The authority is examining the extent of the processing and whether it complies with data protection law.

The case sits at the intersection of two regulatory frameworks. Drug testing generates personal data about job applicants, which must meet GDPR's requirements on lawfulness, necessity and security ^[2]. At the same time, recruitment is explicitly listed as a high-risk application in Annex III of the AI Act if AI is involved in shortlisting, evaluating or selecting candidates ^[1].

IMY has not stated whether ICA Gruppen uses AI in its recruitment process. The supervision concerns data protection, not AI compliance. But the case shows how closely the two regimes now sit together, and how a decision in one area can trigger questions in the other.

High-risk AI in recruitment

Article 6 and Annex III of the AI Act classify AI systems used for recruitment, evaluation of candidates, promotion decisions and task allocation as high-risk ^[1]. The classification applies whether the system ranks applicants, flags certain CVs or supports a hiring manager's decision.

From 2 December 2027, providers of such systems must meet requirements on risk management, data governance, technical documentation, automatic logging, human oversight and quality management, and undergo conformity assessment before placing the system on the market ^[1]. Users face their own obligations under Article 26 ^[3].

One of those obligations is information. Article 26.7 requires users to inform workers' representatives and affected workers before a high-risk AI system is put into use in the workplace ^[3]. For certain users, Article 27 adds a requirement to carry out a fundamental rights impact assessment before deployment ^[5].

Drug testing itself is not AI. But if an AI system is involved at any stage of the recruitment process, these obligations apply to that part of the process. The question then is whether the organisation knew, documented and prepared for that classification.

Data minimisation and necessity

GDPR requires that personal data be adequate, relevant and limited to what is necessary for the purposes for which it is processed ^[2]. That principle, often called data minimisation, applies to all processing, including drug tests.

IMY's supervision will examine whether ICA Gruppen's drug testing meets that standard. The authority has not published findings, so it is too early to draw conclusions. But the principle is clear: a data controller must be able to explain why the processing is needed, what legitimate aim it serves and whether a less intrusive measure would achieve the same result.

For employers, the question is whether a drug test is proportionate to the role. A test for a safety-critical position may be easier to justify than one for an office role. The assessment depends on the facts, and it has to be documented.

If the recruitment process also uses AI to evaluate candidates, the data fed into that system must meet the same standard. An AI trained on more data than necessary, or on data that reveals more than the role requires, puts the user at risk under both GDPR and the AI Act.

Transparency and the right to explanation

Article 26.11 of the AI Act requires users of high-risk systems to inform natural persons that they are subject to the use of a high-risk AI system ^[3]. If the system supports a decision that produces legal effects or similarly significantly affects someone, that person has a right under GDPR to be told about the logic involved and the significance and envisaged consequences of the processing ^[2].

In recruitment, that means an applicant who is rejected after an AI-supported evaluation can ask what role the system played. The user must be able to answer. A vague statement that AI was involved somewhere in the process will not meet the standard.

The fundamental rights impact assessment under Article 27 is required for certain users, including those using high-risk AI for credit scoring of natural persons or pricing of life and health insurance ^[5]. Recruitment is not on that list, but private actors providing public services are, and the boundary is not always obvious. The safest approach is to map the requirement early and be ready to document the decision either way.

What this means for you

If your organisation uses AI in recruitment, ask these questions now:

• Does the system rank, evaluate or select candidates? If so, it is likely high-risk under Annex III.
• Have you informed workers and their representatives before putting the system into use, as Article 26.7 requires?
• Can you show that the personal data processed, whether through AI or other means, is limited to what is necessary for the role?
• If an applicant asks what role AI played in a decision, can you give a clear answer?
• Do you keep logs that show what the system did, when and on what basis?

The obligations apply from 2 December 2027 for Annex III high-risk systems ^[1]. Preparation takes time. Mapping what you use, checking what it does and documenting your assessments cannot be done the week before the deadline.

IMY's supervision of ICA Gruppen concerns GDPR compliance, not AI. But it is a reminder that the two frameworks now run in parallel. A question about data processing can quickly become a question about AI, and the other way around. The organisation that can answer both is in a stronger position than the one that prepared for only one.

What to watch

The AI Act's high-risk requirements for Annex III systems, including recruitment AI, apply from 2 December 2027 ^[1]. User obligations under Articles 26 and 27 follow the same date ^[3][5].

IMY has not indicated when it expects to conclude its supervision of ICA Gruppen. Findings, if published, will offer guidance on how Swedish authorities interpret data minimisation in recruitment contexts.

The AI Office is expected to publish further guidance on fundamental rights impact assessments and on what counts as necessary human oversight. Both will matter for anyone deploying high-risk AI in the workplace.