Before a check begins

1. Define a specific job-related purpose. 2. Establish a valid legal basis. 3. Minimise checks to information necessary and proportionate to the role. A standard screening package does not make every included search lawful.

During the investigation

4. Use AI to assist, not independently determine facts. 5. Verify original sources. 6. Confirm identity before attributing findings. Treat apparent matches as leads until they have been adequately checked.

Protect candidates and employees

7. Assess errors, bias and discrimination. 8. Respect special-category and criminal-record restrictions. Publicly accessible personal data cannot be reused without regard to purpose and legality.

Govern systems and vendors

9. Document security, processors, transfers, retention and impact assessments where required. Determine whether the AI use is prohibited or high-risk and prepare for the applicable EU AI Act implementation dates.

Keep human judgement meaningful

10. Ensure reviewers can challenge, correct, reject and explain findings and respect individuals’ rights. These rules support good governance but cannot replace a role-specific and sector-specific legal assessment.


This fifth article concludes our series on AI, background checks and human risk management in Spain.

Discuss responsible screening

Validato helps organisations design proportionate, documented, role-specific background checks. Contact our team to discuss your requirements.