Three phrases turn up on the homepages and privacy pages of AI CV tools. Each one sounds like a feature or a reassurance. Each one describes something narrower, or something worse, than the reader takes it to mean.
Three different failure modes. One is product honesty. One is technical. One is legal. What they have in common is the marketing.
"Auto-inject missing skills and keywords naturally"
That is not a tailoring feature. That is fabrication described as a feature.
Adding skills the candidate does not have is exactly the failure mode a CV tool should prevent. The mechanism is not mysterious. The model is asked to fill a section. The nearest evidence-shaped text in its context is the job ad. The posting's requirements become the candidate's credentials. You get through the ATS and fail the first technical screen.
We have the output, because we tested for it. A CV with no mention of Agile, Scrum, Docker or Jira, scored against a posting requiring all four. Without deterministic post-processing on the model's answer, the analysis came back at 90-95% fit, citing sprint rituals and backlog prioritisation the CV never contained. The posting had rewritten itself as the candidate's history.
"Auto-inject" sells that as a benefit.
"ATS-optimized PDF. Guaranteed."
ATS optimization has two layers, and the word is usually used for one of them.
The first layer is keywords: does your CV use the right language for this role. The second is parsing: can the system extract text from your file at all, before it reads a single word.
A two-column layout rendered server-side can produce non-linear text on extraction. Column one of row one flows straight into column two of row one. The ATS receives a sentence that was never written, made of two halves that were never adjacent.
Checking keywords without checking extraction is not optimization. "Guaranteed" requires both layers. Most tools that use the word have tested one.
"We use Standard Contractual Clauses"
SCCs are a legal transfer mechanism under GDPR Chapter V. They are not a slogan, and they carry a requirement: naming the third-country recipient. The specific company, the specific jurisdiction, the specific data categories covered.
Saying "we use SCCs" without naming a single provider is GDPR language. It is not GDPR compliance.
One policy in the set we audited earlier this year runs to 4,000 words. It invokes SCCs twice. The name of the AI provider reading your CV appears zero times.
None of this is illegal, and that is the point rather than a softening of it. The paperwork passes. The question it does not answer is where your CV actually goes.