The Regulator's Letter Is Addressed to You — Not Your Vendor

Martin Burch applied to Bloomberg, was screened out by a gamified assessment he didn’t pass and about which he never saw the results, and did something almost nobody does: he pushed, citing his right not to be judged by software alone, until the company admitted in writing that the algorithm had decided.

Most candidates never get that admission. Under the EU AI Act, the law now goes looking for it on their behalf — and here is the part most HR teams have not fully absorbed: when it comes looking, the letter is addressed to you, the company using the tool. Not the vendor who built it

Share

You bought daily HR software. You inherited a high-risk AI system.

In most organisations, the recruiting tool was never really chosen for recruiting. It came bundled into the big HR-and-payroll platform, waved through by finance because it was nearly free to add. The CFO was the buyer. But under the Act, recruitment AI is high-risk, and the obligations land on the deployer — the employer who runs it. The function that signed the contract is not the function the regulator writes to. That gap is where the risk now lives.

And the obligations are not light. You have to be able to tell candidates when AI bears on the decision. You have to keep records. You have to show a real human was overseeing — not signing off, overseeing. For a platform that was built only to be fast and cheap, meeting all that after the fact is a scramble, and an expensive one.

With NoesisHiring, it isn’t a scramble — because it’s already how the platform runs.

We did not bolt compliance on when the Act arrived. The things the law now requires are the things ARM was built around in the first place. So for a company deploying NoesisHiring, most of the obligation is already satisfied by the way the system works day to day.

Transparency to the candidate. The Act says people must be told when a high-risk system affects them. In our process they don’t just get told — they get shown: the actual reading of their application, in plain language, with the right to reply. The transparency the regulation demands is not a notice we added. It is the product.

Human oversight — the real kind. This is the clause most tools will fail, because they read “human in the loop” as a person who rubber-stamps the score. The Act wants more than that, and so do we. In NoesisHiring the recruiter is the orchestrator: in command of the process, holding the AI’s output against the role, the context, and the expertise the model cannot see, and deciding — with the authority and the record to back it. The machine reads at scale. The person judges. That is human on the loop, not merely in it.

Record-keeping. Every step is logged. If a regulator, a worker representative, or a candidate asks what happened and why, the answer exists and can be produced. Auditability is not a report we generate under pressure; it is how the pipeline is built.

Data governance. Your candidates’ data is never used to train or fine-tune models — that is architectural, backed by no-training commitments with the AI providers we use. The information people trust you with does not quietly become someone’s training set.

So compliance stops being a cost and becomes a position.

For most of the market, the AI Act is a bill that has come due — years of treating transparency, oversight, and contestability as optional, now suddenly load-bearing. For a company running NoesisHiring, the same document reads differently. It is less a regulation to scramble against and more a description of how you were already operating — which means while your competitors rebuild under deadline, you are simply already there.

The law did not change what good hiring looks like. It changed what bad hiring is allowed to cost. We built for the version the regulator is now demanding — before it was demanded.

That is what NoesisHiring is building. And it is why, when the letter arrives, you will have the answer already written.

Antonio Specchia is the founder of NoesisHiring, an AI-powered recruitment platform. He is a researcher, Routledge author, and the creator of the Applicant Relationship Management (ARM) framework. His first book, Customer Relationship Management (CRM) for Medium and Small Enterprises (Routledge, 2022), laid the foundation.

A forthcoming book, Applicant Relationship Management (ARM): Human–AI Collaboration in the Agentic Economy, is in preparation for Routledge. His research on Applicant Relationship Management has been widely accepted among academics and HR professionals.