AndurilFR / ENScope an audit

AI compliance/AI in HR

Vertical

Audit of the AI systems used in human resources.

Tools that screen applications, score candidates or match profiles are classed as high risk under the Act. This audit records the ones you use, measures their risks and sets out what remains to be done, under the AI Act, GDPR and employment law.

Duration
4 to 6 weeks
Access required
None to the vendor’s model
Frameworks
AI Act, GDPR, employment law
Output
Formal opinion and roadmap
Scope an HR audit

You are a deployer, with duties of your own

The tool comes from a vendor, but the company using it to recruit or to assess answers for that use: human oversight, relevance of input data, retention of logs, information to workers. The contract signed with the vendor does not transfer those duties.

A closed tool can still be audited

We submit counterfactual CVs to the tool, identical but for one characteristic, and measure what changes in the outcome. The method runs black box: it needs no access to the vendor’s model.

Scope

Three bodies of rules, one audit.

A single recruitment tool falls under AI regulation, data protection and employment law at once. We examine them together, across the whole candidate and employee journey.

Inventory and classification. CV screening and ranking, scoring, skills matching, automated sourcing, interview analysis, internal mobility: each system is recorded, classified under Annex III and assigned a deployer or provider role.
Deployer obligations. Human oversight, relevance of input data, logging and information to workers, under Article 26.
Fundamental rights. An impact assessment that identifies possible harm to the rights of candidates and employees, and the measures that reduce it.
Data protection. The data protection impact assessment and a review of automated decision-making in the recruitment process.
Differences in treatment. Quantitative tests comparing selection rates across groups of candidates, by gender, age, origin or disability.
Proxy variables. Detection of data that indirectly reproduces a prohibited criterion.
Employment law. Under French employment law: relevance of recruitment methods, information to candidates, works council consultation and non-discrimination.
Vendor due diligence. The vendor’s technical documentation, instructions for use, CE marking and contractual clauses.

Worth checking

Features added by the vendor. An applicant tracking tool can gain a ranking or scoring feature through an update. The inventory picks these up, including the ones nobody asked for.

How it runs

Six steps, from inventory to opinion.

  1. ScopingThe recruitment and people-management stages covered, the tools in scope, and the people involved: HR, HRIS, legal, data protection.
  2. Inventory and qualificationEach AI system is recorded, classified by risk tier and assigned a deployer or provider role.
  3. Obligations reviewDeployer obligations are mapped one by one, together with the impact assessments and the employment law review.
  4. TestingQuantitative tests of differences in treatment, counterfactual auditing of the black-box tool, and a search for proxy variables.
  5. Vendor reviewWhat the vendor documents, what it commits to by contract, and what stays with you.
  6. Opinion and action planA formal opinion, the residual-risk register with its compensating controls, and a prioritised roadmap.

Deliverables

What you receive.

HR AI system inventory Classification and role qualification Mapping of deployer obligations Fundamental rights impact assessment Data protection impact assessment Quantitative bias testing Proxy-variable detection Counterfactual audit of the recruitment tool Employment law review Vendor due diligence Human-oversight design Residual-risk register Remediation roadmap Works-council information pack AI literacy plan for HR teams Executive summary and evidence pack

Who the HR audit is for

HR leaders and HRIS leads, most often deployers of tools built by a vendor, together with the legal functions and data protection officers who work alongside them.

Around the HR audit

A vertical of the audit, not a separate exercise.

The base · Assess

AI system compliance audit

The same method, for any other AI system in the organisation.

 After · Remediate

AI Act remediation

Execution of the roadmap, through to a file a third party can review.

Next step

Scope an HR audit.

Tell us which AI tools are used in your recruitment and talent management. We will come back with a proposed scope, a duration and a fixed fee.

Write to us
Scroll to Top