Recruitment agency puts its AI use in order ahead of the EU AI Act

Situation

A recruitment agency in Frankfurt-Niederrad, 40 staff and about €7 million in annual revenue, places accountants and IT specialists. Over 18 months its staff had picked up AI tools one at a time: an assistant for writing job ads, a CV parsing feature inside the applicant tracking system, a chatbot on the website, a meeting notes tool that records candidate calls, and a plugin that ranks applicants for a role. Nobody had a list. The managing director had read that AI used in hiring decisions is treated as high-risk under the EU AI Act, and a large client’s procurement team had just sent a questionnaire about AI use. The agency has a law firm on retainer and wanted the work done with them, so that the legal position would hold.

Approach

Week one was the inventory. We interviewed the team leads, checked the contracts and settings of the five tools, and wrote down for each one what it does, whose data it touches, and who decided to use it.

Week two was the risk classification in plain words: what does the tool decide, about whom, and with what data. The applicant ranking plugin shapes decisions about people in hiring, which the EU AI Act treats as high-risk, with duties for the company that sells it and for the company that uses it. The other four are lower risk with lighter duties: the chatbot must say it is a bot, AI-written ads need a review step, and the notes tool needs candidate consent before a call is recorded.

Week three we drafted the AI use policy: which tools are approved, what data may go into them, who signs off a new tool, how candidates are told, and how a person stays in every hiring decision. Week four was two working sessions with the agency’s law firm, who checked the classification and the policy wording and wrote the legal position. We produce the operational side, the lawyers own the legal side, and the client has both.

Result

In this scenario five systems were inventoried and one was classified as high-risk.

The agency switched the ranking plugin off until the provider can show its conformity paperwork, and kept the CV parsing for extraction only, with no scoring. The chatbot got a disclosure line, the notes tool got a consent step. All 40 staff signed the policy after a one-hour briefing in week five. The client questionnaire was answered in full, and the readiness checklist with dates for the high-risk duties went to the law firm to keep current.

What it cost

The AI governance & readiness package cost €6,500, quoted as a fixed price before work started. That bought the inventory of up to five systems, the risk classification, the AI use policy, the readiness checklist, and two working sessions with counsel. The law firm’s own fees and any tool licences are third-party costs and are excluded. The work was covered by our 100% money-back guarantee: full refund on request within 14 days of delivery.

Every fixed-price engagement carries the 100% money-back guarantee. How the guarantee works →