Algorithmic recruitment systems are emerging in the EU job market. Such systems could technically rely on AI and automated decision-making, but it is unclear whether it is lawful. In addition to other rules, the ambiguously worded GDPR Article 22 regulates automated decision-making. It remains unresolved whether the main rule in GDPR Article 22(1) grants applicants a right not to be subject to automated decisions or prohibits employers from making automated decisions. Further, it appears undetermined as to what counts as automated decision-making under GDPR Article 22(1) and whether the GDPR Article 22(2) exceptions to the main rule apply in a recruitment context. This article examines the legal boundaries set by GDPR Article 22(1) and (2) on the use of automated decision-making in algorithmic recruitment systems. The aim is to clarify whether employers in the EU are allowed to use algorithmic recruitment systems with automated decision-making capabilities. The examination indicates that, even if deemed a prohibition, GDPR Article 22 does not completely disallow such systems. Instead, the analysis suggests that automated decision-making could be allowed for recruitment under the contractual necessity exception of Article 22(2)(a), for instance, in a case where it would be impossible to go through the abundance of applications by hand in a reasonable time and manner. However, the explicit consent exception of Article 22(2)(c) would only apply in an extremely limited number of recruitment cases, if ever. Consequently, it seems that regardless of the rather strict legal boundaries, algorithmic recruitment systems could utilise automated decision-making in certain limited cases and after diligent assessments. Automated decision-making could be worthwhile, for example, in mass scale recruitment processes which could not reasonably be handled without automation.