Prepared for a Series B conversational screening platform selling into the United States, the United Kingdom and the EEA. Company details redacted; findings reproduced as issued.
The Platform has spent eighteen months preparing for the wrong jurisdiction. Its EU position is now comfortable and its US position is not, and both facts are the result of changes made between May and July 2026.
Governance practice remains materially better than governance documentation. The controls largely exist. The evidence does not.
The Platform conducts structured conversational interviews and returns a scored assessment used by employer customers to decide which candidates progress. A material share of its customers recruit for roles in the EEA, and a larger share recruit in California, Illinois, Connecticut and New York City.
On 24 July 2026 the Official Journal published Regulation (EU) 2026/1744, which moved the Annex III high-risk obligations from 2 August 2026 to 2 December 2027. The Platform's roadmap, its board reporting and its budget were all built around the earlier date. Sixteen months of pressure came off in a single instrument, and nobody inside the company had registered it at the point this review began.
Three obligations did not move, and the Platform is exposed on all three:
The review identified eleven findings: three critical, four high, two medium and two low. None arise from negligence. Every one is the ordinary consequence of building a capable product faster than the record of how it was built, and then aiming the remediation at a deadline that moved.
Because Article 111(2) keys its grace period to the date Chapter III applies, and that date moved, a system placed on the market before 2 December 2027 sits outside Chapter III sections 1 to 3 until it undergoes significant changes in its design. The Platform's next major architecture revision is currently scheduled for Q1 2028. Moving it forward, or splitting it, is now a decision with regulatory consequences and it is being taken as a purely product decision. Two caveats apply: the Omnibus narrowed the grace so it holds only where the type and model was already placed on the market, and it does not assist at all where the deployer is a public authority.
The commercial exposure is more immediate than any of the above. Three of the Platform's last five enterprise procurement cycles included an AI section the sales team could not complete without escalating to engineering. Two remain open. That is the cost being paid today, before any regulator is involved.
Three weeks, conducted remotely, in three stages. No access to production systems, no integration, no data pipeline.
Week one, inventory and classification. Structured intake across product, engineering, legal and sales. Review of the model card, training data provenance, deployment architecture, customer contracts and the last four completed security questionnaires. Inventory precedes classification; every model, rule set, score and third-party dependency in the decision path is listed before any of it is classified.
Week two, role and gap analysis. Role determination per jurisdiction, then assessment against the instruments that reach the Platform: Regulation (EU) 2024/1689 as amended by 2026/1744; California's FEHA employment regulations and the CPPA ADMT rules; Illinois HB 3773 and the AI Video Interview Act; Connecticut Public Act 26-15; Colorado SB 26-189; New York City Local Law 144; and GDPR Articles 22 and 35. Evidence was requested for every control claimed.
Week three, reporting. Findings register, obligation calendar, Annex IV coverage map, questionnaire response pack, ninety-day roadmap.
Where a control was described but no artefact existed, it is recorded as absent. That is the standard an auditor and an enterprise customer will apply, and applying a gentler one here would only move the disappointment later.
The question most teams cannot answer, and the one every enterprise legal review opens with.
| Component | Function | Classification | Basis |
|---|---|---|---|
| Conversational interview engine | Conducts and transcribes candidate interviews | High-risk, deferred | Annex III(4)(a), evaluation of candidates. Obligations apply 2 Dec 2027. |
| Scoring and ranking model | Produces comparative candidate scores | High-risk, deferred | Annex III(4)(a), filtering applications and evaluating candidates |
| Candidate-facing chat | Interacts directly with candidates | Live obligation | Art. 50(1), in force since 2 August 2026. Not deferred. |
| Transcription layer | Speech to text | Not high-risk | Preparatory task. Art. 6(3) exemption arguable; assessment must be documented, and see F-07 on registration. |
| Scheduling assistant | Calendar coordination | Not high-risk | Purely administrative, no evaluative function. Outside Connecticut's AEDT definition. |
| Jurisdiction | Role | Test applied |
|---|---|---|
| European Union | Provider | Develops the system and places it on the Union market under its own name. Art. 2(1)(a) and (c) both engaged: output is used in the Union and the system reaches the market through EEA customers. |
| California (FEHA) | Employer | Performs a function the employer traditionally performed, namely applicant screening. 2 CCR § 11008(b); § 11008(h) expressly includes automated-decision-system providers within "employment agency". This is the classification the Platform disputes and, in our view, will lose. |
| Connecticut | Developer | Public Act 26-15. Duty from 1 Oct 2026 to supply deployers what they need to comply, or assume the disclosure obligations by contract. |
| Colorado | Developer | C.R.S. § 6-1-1701 et seq. Makes a covered ADMT commercially available in Colorado. No size threshold. |
| New York City | Neither | Local Law 144 binds the employer and the employment agency, not the tool vendor. See F-11: this is a commercial exposure rather than a legal one. |
The California determination is the most consequential in this report and the one the Platform's counsel is most likely to contest. We note that in Mobley v. Workday the court held on 22 June 2026 that FEHA may reach a California-based vendor even for hiring conducted outside California, and that a separate theory is being tested in Kistler v. Eightfold AI, argued 4 August 2026 with judgment pending, that an AI hiring vendor is an unregistered consumer reporting agency under the FCRA. Neither is settled. Both point the same way.
| ID | Finding | Severity | Reference | Bites |
|---|---|---|---|---|
| F-01 | Art. 50(1) disclosure present but not surfaced at the point of interaction | Critical | Art. 50(1) | In force |
| F-02 | Four-year retention of automated-decision-system data not met; current retention 90 days | Critical | 2 CCR § 11013(c) | In force |
| F-03 | No developer information package for deployers; Connecticut duty unaddressed | Critical | CT P.A. 26-15 | 1 Oct 2026 |
| F-04 | Colorado developer documentation absent: intended uses, harmful uses, training-data categories, limitations, monitoring | High | C.R.S. § 6-1-1702 | 1 Jan 2027 |
| F-05 | Bias testing performed but unversioned and unretained against releases | High | Art. 10(2)(f); 2 CCR § 11009(f) | Evidential now |
| F-06 | Art. 111(2) placing-on-market window not reflected in the release plan | High | Art. 111(2) | By 2 Dec 2027 |
| F-07 | Art. 6(3) self-assessment undocumented; registration position unresolved | High | Arts. 6(3), 6(4), 49(2) | Contested |
| F-08 | No technical documentation in Annex IV form | Medium | Art. 11, Annex IV | 2 Dec 2027 |
| F-09 | Human oversight assumed, not specified or evidenced | Medium | Art. 14 | 2 Dec 2027 |
| F-10 | No DPIA covering automated evaluation of candidates | Low | GDPR Arts. 22, 35 | In force |
| F-11 | Customer LL144 obligations not supported by Platform documentation | Low | NYC Admin. Code § 20-871 | Commercial |
Note the reordering. Under the pre-July position, F-08 and F-09 would have been the critical items and F-02 and F-03 would not have appeared at all. The severity column reflects what binds the Platform now, not what looked most alarming a year ago.
ObservedInterview transcripts, model inputs and scores are retained for 90 days, then purged, on a schedule designed around a data-minimisation policy written in 2024. California's Civil Rights Council amended 2 CCR § 11013(c) from two years to four, effective 1 October 2025, and the retained categories expressly include "automated-decision system data".
Why it mattersThis is the only finding in this report where the Platform is currently, continuously, and unambiguously in breach of an instrument that is in force. It is also self-inflicted in an unusual way: a privacy control is producing a discrimination-law exposure. Every purge cycle destroys the evidence the Platform would need to defend an adverse-impact claim, and § 11013(c)(4) extends the duty further once a complaint is filed.
RemediationChange the retention schedule to four years for ADS data specifically, separated from the general data-minimisation policy. Confirm the change does not conflict with candidate deletion rights, which it may where a candidate is in Illinois and invokes 820 ILCS 42/15. That tension needs a documented position rather than a default. Roughly one engineering day plus a policy amendment.
ObservedThe team runs demographic parity and equal-opportunity checks before significant model updates, using an internal notebook. Results are discussed in review and not retained. No record links a given test to a given deployed version. The team reports it cannot test more thoroughly because it does not hold candidate demographic data.
Why it mattersTwo things have changed. California's § 11009(f) makes evidence of anti-bias testing, or the lack of it, relevant to both claim and defence, so an unretained test is worse than no test: it evidences awareness without evidencing diligence. And Texas makes substantial compliance with the NIST AI RMF an affirmative defence, which is the only place in the United States where this documentation converts directly into a legal shield.
RemediationVersion the notebook, persist outputs to durable storage keyed to model version, adopt a fixed test set retained across releases. Roughly two engineering days and the highest-value item in this report relative to effort. On the demographic data objection: the new Article 4a introduced by Regulation 2026/1744 permits processing of special categories of personal data where strictly necessary for bias detection and correction, subject to cumulative safeguards. The standing reason for not testing has a lawful answer as of 27 July 2026.
ObservedThe Platform treats the transcription layer as outside the high-risk perimeter. We agree with that conclusion. No document records the assessment, and no position has been taken on registration.
Why it mattersArticle 6(4) requires the assessment to be documented, and on the better reading requires registration under Article 49(2) even where the system is assessed out. The Commission proposed deleting that duty in the Omnibus; the co-legislators reinstated it. There is then a genuine interpretive problem: Article 113(3)(c) defers Chapter III sections 1, 2 and 3, and Article 6 sits in section 1, but Article 49 sits in section 5, which was not deferred. On the face of the text the registration machinery applies from 2 August 2026 while the classification rules that give it content do not. Covington and Freshfields both read Article 49 as not deferred. No Commission guidance resolves it.
RemediationDocument the Article 6(3) assessment now, which is required regardless and costs a day. On registration, we recommend preparing the filing but not submitting until the position clarifies, and recording the reasoning contemporaneously. We flag rather than resolve this, and any adviser who tells you it is settled has not read section 5.
Dated to 2 December 2027, per jurisdiction. Reproduced here in summary; the delivered version is per-obligation.
| Date | Jurisdiction | What falls due |
|---|---|---|
| In force | California, Illinois, New Jersey, Texas, EU art. 50 | Retention, notice, transparency, non-discrimination. Five instruments, all live at the date of this report. |
| 1 Oct 2026 | Connecticut | Developer duty to supply deployers; WARN reporting where reductions relate to AI |
| 2 Dec 2026 | European Union | Art. 50(2) marking grace ends for synthetic-content systems on the market before 2 Aug 2026 |
| 1 Jan 2027 | Colorado, California (CPPA) | Developer documentation package and three-year retention; ADMT pre-use notice, opt-out or human appeal, and a risk assessment completed before processing |
| 1 Oct 2027 | Connecticut | Pre-decision notice naming the tool and its data categories |
| 2 Dec 2027 | European Union | Chapter III sections 1 to 3 in full. Also the placing-on-market pivot under art. 111(2). |
Two dates in this calendar did not exist when the Platform's compliance plan was written, and one date that did exist has moved sixteen months. That is the argument for maintaining a calendar rather than producing one.
Assessed against the AI sections now standard in enterprise procurement, using the four questionnaires the Platform had most recently received.
| Question area | Can answer today | After remediation |
|---|---|---|
| Model provenance and training data rights | Partially | Yes |
| Retention and evidence over 90 days | No | Yes |
| AI subprocessor disclosure and data flows | No | Yes |
| EU AI Act classification and timeline | No | Yes |
| US state law coverage by jurisdiction | No | Yes |
| Bias testing methodology and results | Partially | Yes |
A policy nobody has audited does not satisfy a control question. The distinction procurement teams draw is between a stated intention and a retained record, and it is the distinction on which the Platform's two open deals are stalled.
Ordered by what binds soonest and what returns most, not by regulatory grandeur. The Annex IV work that would have dominated this roadmap under the old timetable now sits last, because it is due in fifteen months and nothing commercial turns on it in the interim.
Seven documents, for the fixed fee.
The review identifies documents. It does not write them. The Annex IV technical documentation, the deployer instructions under Article 13, the Connecticut and Colorado developer packages, the bias testing protocol and the DPIA were each scoped and quoted separately, and the Platform commissioned four of the five on a continuing engagement from month two.
Also expressly outside this engagement: any bias audit within the meaning of Local Law 144, which requires statistical work with a statutory definition and a signatory and is properly commissioned from a specialist; ISO/IEC 42001 certification, which only an accredited certification body can issue; conformity assessment under Article 43; and legal advice, which this is not.