Hiring AI Audit
Five-step audit to complete before August 2, 2026.
The EU AI Act's high-risk obligations become enforceable on August 2, 2026. High-risk deployer non-compliance carries fines of up to €15 million or 3% of global turnover, whichever is higher. And "the vendor said it was compliant" is not a defense. If you deploy the system, you are the deployer, and deployer obligations are yours.
The use case determines the risk class, not the underlying technology. A simple rule-based filter used for hiring is high-risk. An LLM used for marketing is not.
A provider develops an AI system and places it on the EU market under their own name — typically the vendor. A deployer uses an AI system under their own authority in their professional activity — typically the employer. Most companies using off-the-shelf hiring AI are deployers; the vendor is the provider. The line shifts under Art. 25: if you substantially modify a high-risk system, rebrand it, or change its intended purpose in a way that makes it high-risk, you take on provider obligations.
Inventory every system that touches candidate data
List every tool that ranks, screens, scores, filters, or generates output about candidates. The obvious ones go first — your ATS, your assessment platform, your sourcing AI — but those are not where most teams get caught. The shadow stack is:
- →The ChatGPT/Gemini account someone in TA pays for personally and uses to rewrite job descriptions.
- →The resume parser embedded in your ATS that you do not consciously think of as AI.
- →LinkedIn Recruiter AI features (Recruiter, AI-assisted search, AI messages).
- →Microsoft Copilot if recruiters use it for candidate research.
- →Any chatbot that pre-screens applicants before a human sees them.
Prioritise sourcing AI and resume screening for the deeper work in Steps 3–5. Sourcing is the highest-volume decision point in your funnel and the easiest to test for bias.
Classify each system as high-risk
If a system is used for recruitment, candidate screening, candidate ranking, promotion decisions, performance evaluation, or worker monitoring, it is high-risk under Annex III §4 of the Act. There is no judgment call because the use case decides.
The CultureGene Hiring AI Self-Assessment is a structured way to walk through the classification questions. It maps each question to the specific Article or Annex provision, including the Article 5 prohibitions you need to rule out first.
Get bias-audit documentation from every high-risk vendor
For each high-risk system, request the vendor's Article 11 / Annex IV technical documentation. Ask for it by name. If the vendor doesn't recognise the term, that's your answer.
The documentation should cover:
- →Training data composition and representativeness (Art. 10)
- →Bias testing methodology and results
- →Mitigation steps taken
- →Ongoing monitoring approach
- →The human oversight mechanism the system is designed to support (Art. 14)
- →Transparency information for deployers (Art. 13)
If the vendor cannot produce this, you have a procurement decision to make, not a compliance one.
Document your own deployment context
Vendor documentation is necessary but not sufficient. As the deployer, you are responsible for how the system is used in your specific context, and Article 26 puts that obligation squarely on you. Write down:
- →What decisions the system informs in your hiring process
- →Where humans review and can override its output
- →What training your recruiters received on the system's limitations
- →What monitoring you do for adverse impact in your own data
A 2023 University of Washington study found recruiters mirrored biased AI rankings at high rates — meaning a "human in the loop" is not the same as meaningful oversight. You need a human in the loop, not a human in the seat. Document what makes the difference.
Run an adverse-impact analysis on your last 12 months of hiring data
Pull selection rates by protected class at every stage where an AI system is involved. Apply the four-fifths rule: if any group's selection rate is less than 80% of the highest group's rate, you have an adverse-impact problem the Act expects you to identify and remediate.
Your highest-selecting group passes screening at 60%. Another group passes at 45%. That's 75% of the highest rate — below the 80% threshold. Document required, remediation plan required.
This is the single most important number in your compliance file. It shows you actually checked.
Run the Hiring AI Self-Assessment
A structured walkthrough mapping each classification question to the specific EU AI Act Article or Annex provision.
Start the self-assessment →