Every agent · Other · various

AI recruiting and screening tools

Q: What can AI recruiting and screening tools act on?

Drafts for a human. Employment decisions are a high-risk use under the EU AI Act and regulated in several US states and cities. The tool drafts a ranking; the obligations attach to the employer that relies on it.

Q: Is a human in the loop with AI recruiting and screening tools, and does data leave the tenant?

Human in the loop by default: yes. Data leaves the tenant by default: yes. It drafts and a person decides, so the loop is real; what it can read is the question. Data leaves your tenant to the vendor by default.

Employment decisions are a high-risk use under the EU AI Act and regulated in several US states and cities. The tool drafts a ranking; the obligations attach to the employer that relies on it.

drafts for a human

acts on

yes

human in the loop by default

yes

data leaves the tenant by default

Candidate applications, interview recordings and assessments

reaches by default

What that means for the register

It drafts and a person decides, so the loop is real; what it can read is the question. Data leaves your tenant to the vendor by default. Pasted with only its name it lands as control until an owner is named.

This week

Confirm a human makes the decision, candidates are told, and a bias evaluation exists.

What holding it is evidence for

Requirement text and artefacts from a human-verified corpus licensed to Agent Register.

Customer-facing or people-affecting without supervision ISO 42001 A.8.2 · ISO 42001 A.5.4 · ISO 42001 A.8.4 · EU AI Act Art.50 · EU AI Act Art.6 · EU AI Act Art.86 · EU AI Act Art.27

ISO 42001 A.8.2 System documentation and information for users

The organization shall determine and provide the necessary information for users of the AI system.

Evidence an auditor accepts: User documentation; Instructions for use; Training materials

ISO 42001 A.5.4 Assessing AI system impact on individuals or groups

The organization shall assess and document the potential impacts of AI systems to individuals or groups of individuals throughout the system's life cycle.

Evidence an auditor accepts: Per-system impact assessments; Fairness analysis; Privacy impact (link to PIA where relevant)

ISO 42001 A.8.4 Communication of incidents

The organization shall determine and document a plan for communicating incidents to relevant interested parties.

Evidence an auditor accepts: Incident communication plan; Incident notification records; Notification criteria and timing

EU AI Act Art.50 Transparency obligations for providers and deployers of certain AI systems

Providers and deployers of certain AI systems (incl those interacting with natural persons, emotion recognition, biometric categorisation, generative AI producing synthetic content, deepfakes, and AI-generated/manipulated text for public-interest information) shall inform users that they are interac...

Evidence an auditor accepts: User-facing AI-interaction notification; Machine-readable labelling of synthetic content; Deepfake/AI-text disclosure

EU AI Act Art.6 Classification rules for high-risk AI systems

Determine and record, for each AI system, whether it is high-risk. A system is high-risk where it is intended to be used as a safety component of, or is itself, a product covered by the Union harmonisation legislation listed in Annex I and that product must undergo third-party conformity assessment,...

Evidence an auditor accepts: A classification record per AI system naming the Annex I legislation or the Annex III use case considered, and the conclusion reached; The documented Art.6(3) assessment where an Annex III system is judged not high-risk, dated before placing on the market; Evidence the profiling rule was applied, so any system profiling natural persons is classified high-risk regardless of the derogation

EU AI Act Art.86 Right to explanation of individual decision-making

A deployer must, at the request of an affected person who has been subject to a decision the deployer took on the basis of the output of an Annex III high-risk AI system other than one listed under Annex III point 2, and which produces legal effects or similarly significantly affects that person in ...

Evidence an auditor accepts: A documented procedure for receiving and answering explanation requests, with an owner and a response time; Explanation templates per decision type, covering both the role of the AI system in the procedure and the main elements of the decision; A register of requests received and the explanations given

EU AI Act Art.27 Fundamental rights impact assessment for high-risk AI systems

Before deploying a high-risk AI system referred to in Art.6(2) (Annex III), public-law-governed deployers (and certain private deployers providing public services + financial services) shall perform a fundamental rights impact assessment (FRIA) describing the deployment context, the categories of af...

Evidence an auditor accepts: FRIA per in-scope deployment; Notification to market surveillance authority

Data leaving the tenant to a model vendor ISO 42001 A.10.3 · ISO 42001 A.4.3 · ISO 42001 A.7.3 · ISO 42001 A.10.2 · EU AI Act Art.10 · EU AI Act Art.25

ISO 42001 A.10.3 Suppliers

Establish a process ensuring that the organization's use of services, products or materials provided by suppliers aligns with its approach to the responsible development and use of AI systems.

Evidence an auditor accepts: supplier assessment criteria covering responsible AI; completed assessments for AI suppliers including model, dataset and component providers; contract terms binding suppliers to the organization's AI requirements

ISO 42001 A.4.3 Data resources

As part of identifying resources, the organization shall document information about the data resources utilized for the AI system.

Evidence an auditor accepts: Data inventory; Data lineage records; Datasheets

ISO 42001 A.7.3 Acquisition of data

The organization shall determine and document details about the acquisition and selection of data used in AI systems, including provenance and consent where applicable.

Evidence an auditor accepts: Data acquisition records; Provenance documentation; Consent records

ISO 42001 A.10.2 Allocating responsibilities

Ensure responsibilities across the AI system life cycle are allocated between the organization, its partners, suppliers, customers and third parties.

Evidence an auditor accepts: RACI or equivalent covering each life cycle stage and each external party; contract clauses that state who is accountable for what; evidence the allocation is reviewed when the arrangement changes

EU AI Act Art.10 Data and data governance

High-risk AI systems that make use of techniques involving the training of AI models shall use training, validation and testing data that meet the quality criteria in Art.10(2)-(5): appropriate data governance, examination for possible biases, identification of data gaps/shortcomings, statistically ...

Evidence an auditor accepts: Data governance procedures; Bias examination records and remediation; Data-quality assessment per dataset

EU AI Act Art.25 Responsibilities along the AI value chain

Distributors/importers/deployers/other third parties become providers when they place on the market or put into service under their own name or trademark, substantially modify the system, or modify the intended purpose making it high-risk. The original provider shall cooperate with the new provider,...

Evidence an auditor accepts: Documented allocation of provider status across the value chain; Cooperation agreements between original and new providers

Do this for every tool your teams use

Paste the list and get this classification for every entry at once, with the owner column, the findings per department, and the controls the register is evidence for. Ten entries free, no account.

Build my agent register

Autonomous SDR agents · HR and performance AI