Skip to content
World Model Readiness
Engraved team-functions instrument

For your team

Teams by Function

Module · AI on people is high-risk

The HR Team AI Check

When your HR team points AI at candidates and employees, it is not automating a workflow, it is making decisions about people under the strictest tier of the EU AI Act. Screening, ranking and assessment tools sit in the Act's high-risk class, with duties that attach whether or not you noticed. This module checks the five things that decide whether your people processes are defensible: whether you test the screening for bias, whether candidates are told, where a human actually decides, what employee data your tools ingest, and whether the works council was in the room before any of it went live.

Question 1 of 5 · Screening tested for bias

Do you test your AI screening for bias against protected groups, on your own data?

An AI trained on who you hired before will reproduce who you hired before, including the patterns you would never write into a policy. A vendor's fairness certificate is not evidence about your roles and your applicant pool. Under the AI Act this testing is not optional diligence, it is a documented duty for high-risk hiring tools.

Question 2 of 5 · Candidates are told

Are candidates told when AI is used to screen or assess them?

People have a right to know when a machine is judging their application, and increasingly a right to a human review and an explanation. Silent AI screening is the fastest route to a complaint, a regulator, and a headline. Disclosure costs you a sentence; the alternative costs you the story.

Question 3 of 5 · A human decides

Is there a point where a human actually makes the hiring decision, not just rubber-stamps the AI?

Meaningful human oversight is a legal requirement for high-risk hiring AI, but a human who always agrees with the ranking is oversight in name only. The question is whether your recruiters have the information, the authority and the habit to overrule the machine, and whether they ever do.

Question 4 of 5 · Employee data stays bounded

Do you control what employee data goes into AI tools, and where it ends up?

Performance notes, health-related absences, salary, disciplinary records: the moment this data flows into a general AI tool, you have lost the boundary that data-protection law demands you keep. HR handles the most sensitive category of employee information there is, and a convenient chatbot is the easiest place to leak it.

Question 5 of 5 · Works council involved

Was the works council involved before you deployed AI that affects employees?

In Germany and much of the DACH region, introducing AI tools that monitor or assess staff triggers the works council's co-determination rights. Involving the Betriebsrat early is not a courtesy, it is a precondition: skip it and a deployment can be blocked, unwound, or dragged before a labour court after you have already rolled it out.

For the statistics · one click each

Three questions for the public picture

These do not affect your score. They feed the anonymised, aggregated statistics; groups under 8 respondents are never shown.

Where does your HR team already use AI on people?

Have you tested your hiring AI for bias on your own data?

Was the works council involved before your employee-facing AI went live?

Your context

Used to calibrate the report. Company size and sector remain in the anonymized dataset; your email does not.

What the five levels look like

Every dimension in this assessment is scored 1 to 5. This is what the levels mean, dimension by dimension. The graded report diagnoses where your own answers land and what to do about it.

Screening tested for bias

  1. 1Never tested
  2. 2Trust the vendor
  3. 3One-off check
  4. 4Tested on our data
  5. 5Tested and monitored

At the low end: An untested screening model can filter out protected groups at scale while nobody sees the pattern. Run a disparate-impact test on your own hiring data now, and keep the results; the Act expects you to have them. What good looks like: Bias testing on your own data, repeated over time, is what makes an AI hiring tool defensible under the high-risk regime. Keep monitoring; a model that was fair last year drifts as your roles and applicants change.

Candidates are told

  1. 1Never disclosed
  2. 2Buried in policy
  3. 3On request
  4. 4Clearly disclosed
  5. 5Disclosed with rights

At the low end: Screening candidates with AI and not telling them invites exactly the complaint you cannot defend. Add a plain-language notice to your application flow before the next role opens. What good looks like: Clear disclosure paired with the right to a human review and an explanation is the standard the Act is moving toward. Keep the notice current as your tools change; a stale disclosure is as bad as none.

A human decides

  1. 1AI auto-rejects
  2. 2Human rubber-stamps
  3. 3Human reviews top only
  4. 4Human decides, informed
  5. 5Human decides, overrides tracked

At the low end: AI that auto-rejects candidates with no human in the loop is precisely the automated decision the Act restricts. Put a person with real authority between the model's output and any rejection. What good looks like: Informed human decisions with overrides that actually happen are what meaningful oversight looks like on paper and in practice. Track the override rate; if it is always zero, your humans are rubber-stamping again.

Employee data stays bounded

  1. 1No boundary
  2. 2Policy only
  3. 3Approved tools listed
  4. 4Access-controlled tools
  5. 5Controlled and logged

At the low end: With no boundary on where employee data goes, sensitive records are one paste away from a public model. Define which tools may touch personnel data and block the rest before someone pastes an appraisal into a chatbot. What good looks like: Access-controlled tools with logging keep the most sensitive data you hold inside a boundary you can prove. Keep the approved list tight and the logs reviewed; sensitive-data handling is exactly where auditors look first.

Works council involved

  1. 1Not consulted
  2. 2Told afterwards
  3. 3Consulted late
  4. 4Consulted early
  5. 5Formal agreement in place

At the low end: Deploying employee-facing AI without the works council invites a challenge that can freeze the whole rollout. Bring the Betriebsrat in now and treat co-determination as a gate, not a formality. What good looks like: A formal works agreement negotiated before rollout is what makes employee-facing AI durable in a co-determined workplace. Revisit it when the tools change; the agreement covers what you deployed, not what you deploy next.