Skip to content
World Model Readiness
Engraved governance instrument

For your company

Governance & Compliance

Module · Recruiting AI is a high-risk class

The AI-in-Hiring Audit

AI-assisted recruiting sits in the EU AI Act's high-risk category, which makes bias testing, transparency, and human oversight legal duties, not best practices. This module checks whether your hiring AI would survive scrutiny: bias controls, candidate disclosure, meaningful human review, vendor accountability, and the evidence an auditor would ask for.

Question 1 of 5 · Bias is tested

Is your hiring AI tested for bias across protected groups, on a schedule?

A tool can screen thousands before anyone notices it disfavours a group. Disparate-impact testing, the four-fifths rule as a floor, is the check the high-risk regime expects you to run and record.

Question 2 of 5 · Candidates are told

Do candidates know when AI screens or scores their application?

Transparency to the person being assessed is a duty, not a courtesy. Disclosure buried in a privacy policy is disclosure in name only; it belongs where the candidate applies.

Question 3 of 5 · Humans really decide

Does a human meaningfully review AI decisions, or just approve them?

A reviewer who only clicks approve is not oversight, and auditors know the difference. Meaningful review means the time, information, and authority to actually overturn the machine.

Question 4 of 5 · Vendor duties are clear

Does your contract with the hiring-tool vendor cover bias, documentation, and audit access?

Standard terms protect the vendor, not you. The duties you need in writing are bias testing, technical documentation, and the right to audit; without them you carry a risk you cannot inspect.

Question 5 of 5 · Evidence exists

Could you produce the documentation an auditor or tribunal would demand?

Under a high-risk regime the burden is on you to show your work: bias tests, disclosures, review records, vendor documents. Evidence scattered across inboxes is, in practice, no evidence at all.

For the statistics · one click each

Three questions for the public picture

These do not affect your score. They feed the anonymised, aggregated statistics; groups under 8 respondents are never shown.

Where does AI touch your hiring today?

Do you tell candidates when AI assesses them?

Has your hiring AI been audited for bias?

Your context

Used to calibrate the report. Company size and sector remain in the anonymized dataset; your email does not.

What the five levels look like

Every dimension in this assessment is scored 1 to 5. This is what the levels mean, dimension by dimension. The graded report diagnoses where your own answers land and what to do about it.

Bias is tested

  1. 1Never tested
  2. 2Vendor says it is fine
  3. 3Tested once
  4. 4Regular testing
  5. 5Tested + documented

At the low end: Untested hiring AI is a liability that compounds with every candidate. Run a disparate-impact test across protected groups now; the four-fifths rule is a defensible starting line. What good looks like: Regular, documented bias testing is exactly what the high-risk regime demands. Keep the cadence and version the results against model updates.

Candidates are told

  1. 1Never disclosed
  2. 2Buried in policy
  3. 3On request
  4. 4Clearly disclosed
  5. 5Disclosed + explained

At the low end: Undisclosed AI screening is a transparency breach waiting to be complained about. Tell candidates plainly, at the point of application, that AI is involved. What good looks like: Clear disclosure with an explanation of the logic is the standard the Act imagines. Keep it accurate as your process changes.

Humans really decide

  1. 1AI auto-rejects
  2. 2Human rubber-stamps
  3. 3Review for edge cases
  4. 4Every rejection reviewed
  5. 5Documented human decision

At the low end: Fully automated rejection is the exact scenario the high-risk rules target. Insert a human with authority to overturn the machine before any candidate is dropped. What good looks like: Documented human decisions on every rejection is the defensible standard. Keep the record showing the human, not the model, made the call.

Vendor duties are clear

  1. 1No idea
  2. 2Standard terms only
  3. 3Some clauses
  4. 4Duties specified
  5. 5Duties + audit rights

At the low end: If you do not know what the vendor is contractually on the hook for, assume it is nothing. Get bias documentation, model information, and audit access into the contract. What good looks like: Specified vendor duties with audit rights is the mature position. Revisit them at renewal; vendors quietly shift obligations downstream over time.

Evidence exists

  1. 1Nothing
  2. 2Scattered emails
  3. 3Partial records
  4. 4Organised evidence
  5. 5Audit-ready file

At the low end: If the evidence lives in scattered emails, you effectively have none. Start one file: bias tests, disclosures, review records, vendor documents, in one place. What good looks like: An audit-ready file is a genuine asset under a high-risk regime. Keep it living, tied to every model change and hiring cycle.