Sample AI Act readiness assessment — high-risk HR screening

Skarval Analytics ApS develops FitScreen, an AI ranking tool that scores and shortlists job applicants, and places it on the EU market under its own trademark. That makes Skarval the provider of a high-risk AI system: FitScreen falls under Annex III point 4(a) (recruitment and selection of natural persons), and the Art. 6(3) derogation is unavailable because the fetched text makes an Annex III system “always” high-risk “where the AI system performs profiling of natural persons” — which scoring applicants is.

The dates that bite: the AI Act's general high-risk regime applies from 2 August 2026. analyst-known fact — no row fetched in this run carries the application dates; the framing is the site's public AI Act timeline One date did arrive fetched: the Art. 6 text obliges the Commission to publish classification guidelines “no later than 2 February 2026” — those guidelines are a scoping input for the engagement.

Because FitScreen is already on the market, the transitional rule for pre-existing high-risk systems (Art. 111(2): systems placed on the market before the application date fall in scope upon a significant change in design) interacts directly with the quarterly-retraining question in §5 — whether retraining crosses that threshold decides when the register above starts to bind. Art. 111(2)'s second sentence adds an unconditional backstop: high-risk systems intended for use by public authorities must comply by 2 August 2030 regardless of design changes — so the analysis also turns on whether any FitScreen customer is a public body. analyst note — Art. 111 was not fetched in this run; the transitional analysis is scoped for the engagement, not concluded here

The register in §4 holds 12 obligations (11 on Skarval, 1 deployer-side that Skarval must enable). The heavy items: a documented lifecycle risk-management system (Art. 9), the Art. 16 duty stack — quality management, documentation, logs, conformity assessment, declaration of conformity, CE marking, registration — and the internal-control conformity route of Art. 43(2). Three items are not started; none of that is papered over. Readiness verdicts are analyst-assigned for the fictional client and would be evidence-checked in a real engagement.

Skarval Analytics ApS (fictional, Copenhagen) sells FitScreen, a B2B SaaS service that ingests applicant CVs and structured assessment results, computes a per- candidate fit score, and returns a ranked shortlist to enterprise recruiting teams. Models are retrained quarterly on pooled outcome data. FitScreen does no emotion inference and no biometric processing — facts that matter at the Art. 5 and Annex III boundaries walked in §3.

Role determination. Skarval develops FitScreen and places it on the EU market under its own name — the provider role. Its customers use the system on their own applicants — the deployer role. The functional split is visible in the fetched provisions themselves: Art. 16 binds providers to duties running “prior to its being placed on the market or put into service”, and the fetched Art. 26 is titled “Obligations of deployers of high-risk AI systems”. analyst — the definitional test itself lives in Art. 3, which this run did not fetch; the provider/deployer conclusions rest on that unfetched text and are flagged accordingly

Show the text form

[Skarval Analytics ApS — develops FitScreen, places it on the EU market]  = PROVIDER  (Art. 3 — analyst)
      |
[Art. 6(1): safety component of an Annex I product?]  -- no (analyst; Annex I not fetched)
      |
[Art. 6(2): intended use listed in Annex III?]  -- yes (fetched Annex III row)
      |
[Annex III point 4(a): recruitment or selection of natural persons]
      |
[Art. 6(3) derogation: no significant risk of harm?]
      |   conditions (a)-(d) never reached, because:
[Profiling override: "always be considered to be high-risk where the AI system
 performs profiling of natural persons"  ->  FitScreen profiles applicants
 ->  derogation UNAVAILABLE]
      |
[VERDICT: HIGH-RISK — Annex III point 4(a)]
      |-- provider side -->  [Art. 9 risk management]  [Art. 16 duties (a)-(l)]  [Art. 43(2) internal control, no notified body]
      |-- deployer side -->  [Art. 26 duties]  <--  [Enterprise customers = DEPLOYERS]

Every quoted span below is verbatim from text fetched during the run; bracketed ellipses […] mark our elisions. Steps that rest on unfetched text say so.

• Step 0 — prohibited-practices screen (Art. 5). FitScreen does no emotion inference or social scoring, so no Art. 5 prohibition appears engaged. The run fetched the AI Office's prohibited-practices guidelines as a guidance row (AI Office — prohibited-practices guidelines) but not the Art. 5 text itself, so this screen is analyst draft — held for senior review. The guidance row is still load-bearing for step 2: its Art. 5(1)(f) discussion points at “the list of high-risk AI systems in Annex III, referring to self-employment at 4”.
• Step 1 — Art. 6(1): the product gate. The fetched Art. 6(1) makes a system high-risk where it “is intended to be used as a safety component of a product, or the AI system is itself a product, covered by the Union harmonisation legislation listed in Annex I” and that product needs third-party conformity assessment. FitScreen is stand-alone recruiting software, not a safety component. analyst — Annex I was not fetched; the negative (“HR software is not an Annex I case”) rests on analyst knowledge of that list Art. 6 — Reg (EU) 2024/1689
• Step 2 — Art. 6(2): the Annex III route. Fetched: “In addition to the high-risk AI systems referred to in paragraph 1, AI systems referred to in Annex III shall be considered to be high-risk.” The run's Annex III row arrived as a search fragment ending the employment heading (“…to self-employment:”) and opening point (a): “AI systems intended to be used for the recruitment or selection of natural persons, in particular…”. Scoring and shortlisting job applicants is squarely that use. The point-4 numbering is corroborated by the fetched AI Office guidance row quoted in step 0 — the direct Annex III provision lookup returned nothing (§7). Annex III — Reg (EU) 2024/1689 · AI Office — prohibited-practices guidelines
• Step 3 — Art. 6(3): the derogation test. Fetched: “By derogation from paragraph 2, an AI system referred to in Annex III shall not be considered to be high-risk where it does not pose a significant risk of harm to the health, safety or fundamental rights of natural persons, including by not materially influencing the outcome of decision making.” It applies where any of four fetched conditions holds: (a) “a narrow procedural task” — no, FitScreen ranks candidates end-to-end; (b) “improve the result of a previously completed human activity” — no, it runs before human review, not after; (c) detecting “decision-making patterns or deviations from prior decision-making patterns” without replacing human assessment — no; (d) “a preparatory task to an assessment relevant for the purposes of the use cases listed in Annex III” — arguable for a shortlisting tool, but the question is never reached, because of step 4. Art. 6 — Reg (EU) 2024/1689
• Step 4 — the profiling override closes the derogation. Fetched, same paragraph: “Notwithstanding the first subparagraph, an AI system referred to in Annex III shall always be considered to be high-risk where the AI system performs profiling of natural persons.” FitScreen evaluates personal aspects of applicants — predicted job performance — to score and rank them: profiling. The derogation is therefore unavailable to Skarval regardless of how condition (d) would have come out. analyst — “profiling” takes its meaning from Art. 3(52) / GDPR Art. 4(4), which this run did not fetch; reading applicant scoring as profiling is the conservative reading and is flagged as analyst reasoning Art. 6 — Reg (EU) 2024/1689
• Step 5 — Art. 6(4): if Skarval disagreed. Fetched: “A provider who considers that an AI system referred to in Annex III is not high-risk shall document its assessment before that system is placed on the market or put into service”, with registration under Article 49(2). Not exercised here — Skarval accepts the high-risk classification — but recorded so the road not taken is visible. Art. 6 — Reg (EU) 2024/1689

Verdict: FitScreen is a high-risk AI system under Annex III point 4(a); Skarval is its provider. Everything in §4–§6 follows from those two findings.

One row per obligation, grounded in a quoted span of the fetched article text. Readiness verdicts are analyst-assigned for the fictional client — in a paid engagement each verdict is evidence-checked before it ships.

Quoted spans are verbatim from the fetched Art. 9 / Art. 16 / Art. 26 / Art. 43 texts; […] marks our elisions. Cross-referenced articles (13, 17, 18, 19, 20, 47, 48, 49) appear in the fetched Art. 16 text by number only — their content was not fetched in this run, so actions stop at what the fetched span requires and say so.

The fetched Art. 43(2) settles the route for FitScreen: “For high-risk AI systems referred to in points 2 to 8 of Annex III, providers shall follow the conformity assessment procedure based on internal control as referred to in Annex VI, which does not provide for the involvement of a notified body.” FitScreen sits in point 4 — inside points 2 to 8 — so Skarval self-assesses under Annex VI; no notified body is involved. The notified-body alternatives in the fetched Art. 43(1) apply only to “high-risk AI systems listed in point 1 of Annex III”, which FitScreen is not. (Annex VI itself was not fetched; the route is named here, its contents are scoped in the engagement.)

Two more fetched Art. 43 findings matter to a quarterly-retrained system. First: “High-risk AI systems that have already been subject to a conformity assessment procedure shall undergo a new conformity assessment procedure in the event of a substantial modification”. Second, the learning carve-out: “changes to the high-risk AI system and its performance that have been pre-determined by the provider at the moment of the initial conformity assessment and are part of the information contained in the technical documentation […] shall not constitute a substantial modification.” Practical consequence for Skarval: describe the quarterly retraining envelope — data sources, metrics, thresholds — inside the initial assessment's technical documentation, or every retrain risks re-opening conformity. Art. 43 — Reg (EU) 2024/1689

Skarval's customers carry their own obligations as deployers. A provider that makes those duties hard to discharge is selling its customers a compliance problem — so the readiness assessment treats deployer-enablement as provider work. Each row quotes the fetched Art. 26 span and names what FitScreen must ship.

All spans from the fetched Art. 26 — Art. 26 — Reg (EU) 2024/1689. Art. 26(7) (informing workers' representatives before workplace use) binds deployers-as-employers and is noted for the deployer playbook rather than rowed here.

• Sources fetched through the Ansvar gateway. The EU AI Act provisions cited here — Arts. 6, 9, 16, 26 and 43 — were fetched as full-text provision rows; Annex III arrived via search; the AI Office guidance row via the guidance fan-out. Every linked citation preserves the fetched source URL, publisher, and license. Nothing is cited from model recall.
• The Annex III lookup limitation, on the record. A direct provision lookup for the annex returned “No provision matches EU AI_ACT annex_III.” The grounding row for point 4(a) came from the search fan-out instead, and its fragment is short — which is why the point-4 numbering leans on the fetched AI Office guidance row for corroboration (§3, step 2). A paid engagement closes this by citing the full annex text.
• Off-topic search rows, named and excluded. The high-risk employment search also returned rows from Regulation (EU) 2023/1542 (batteries, Art. 79), Directive 2014/47/EU (roadside-inspection risk rating, Arts. 5–6), and Regulation (EU) No 3/2014 (vehicle definitions, Art. 2) — lexical matches on “high-risk” phrasing. They were excluded as off-topic; they are listed so the exclusion is checkable.
• Refusal discipline. Unfetched text is never quoted. Marked analyst in this document: the Art. 3 role definitions (§2), the Annex I negative (§3 step 1), the Art. 5 screen (§3 step 0), the profiling definition (§3 step 4), the application dates (§1), and the contents of the cross-referenced Arts. 13, 17, 18, 19, 20, 47, 48 and 49 (§4). Gaps are marked, never filled with plausible text.
• What a paid engagement adds. Your real system and a scoping call; the full Section 2 requirements walk; evidence-checked readiness verdicts instead of analyst-assigned ones; the deployer playbook; and a named senior reviewer who confirms or corrects every row before it ships.

Senior review:   [shown for format — fictional sample, nothing to certify]
Reviewer:        [named reviewer — AI-governance / EU-regulatory]
Date:            [—]

A paid engagement ships only after the named reviewer has validated every row and signed here. This sample is published unsigned, on purpose, so you can read the document exactly as it leaves the engine.

Want this for a real system?

Try the free AI Act high-risk checker →