The right to explanation (GDPR Art. 22): what your ATS must be able to do.

GDPR Art. 22 gives a person the right not to be subject to a decision based solely on automated processing with significant effects — plus the right to human intervention and to contest it. Recital 71 adds: meaningful information about the logic involved.

What the candidate actually asks

"Did you use AI about me? How? Who made the final decision?" The answer must be in plain language, honest and verifiable — not a generic legal paragraph.

Why it is hard without infrastructure

If you did not log every inference with context, someone has to reconstruct what happened by hand. That means DPO + lawyer + days. At volume, it becomes impossible to sustain.

What done right looks like

The system drafts the explanation from the decision log itself, a human reviews and edits it, then it ships to the candidate — with the raw inferences attached for the DPO. Minutes, not days. And it explicitly states the final decision was human, which takes the case out of the strict Art. 22 regime.

The difference is not copywriting. It is architecture: either you logged from the start, or you improvise under pressure.