AI Hiring Compliance

AI Recruiter by Nexprove is a screening aid. A voice agent conducts a structured first-round interview, produces a verbatim transcript, and returns a scored report against a rubric the recruiter defined before the interview began. That is the full scope of the system.

The product does not extend offers, does not reject candidates, and does not advance candidates through a pipeline on its own. Every hiring decision — whether to shortlist, progress, or pass — is made by a person at the customer organisation. The AI score is one input among several that the recruiter weighs alongside the transcript, the résumé, and their own judgement. Under the EU AI Act this distinction matters because Article 6 and Annex III treat a system that substantially influences the outcome of recruitment as high-risk regardless of whether a human formally signs off; we therefore treat the stricter classification as the operating standard rather than attempting to argue our way out of it.

The same logic applies to NYC Local Law 144. The statutory test is whether the tool "substantially assists or replaces" the discretionary decision. We design the product, the report layout, and the rubric workflow so that a recruiter can defensibly say the score is an input, not the decision — and we document the human-review step in the audit log so that posture is provable rather than asserted.

This page describes how we have built and operate the product. It is our position; it is not legal advice. Recruiters should consult their own counsel about how the statutes below apply to their specific hiring program, jurisdiction, and rubric.

Candidates should always know they are speaking with an AI before the interview begins. We require recruiters who use AI Recruiter to disclose AI use to candidates in writing, in advance, as part of the invitation to interview. This obligation is reflected in our customer Terms and is required to maintain access to the product. It also aligns with the EU AI Act's Article 50 transparency obligation, which requires natural persons to be informed when they are interacting with an AI system, in a clear and distinguishable manner, no later than the first interaction.

We also enforce disclosure in the product itself. Every candidate sees a prejoin screen before the call connects that names the product, states that an AI voice agent (not a human) will conduct the interview, explains that the conversation will be recorded and transcribed, identifies the recruiter on whose behalf the interview is being conducted, and links to this page and our privacy policy. The candidate must affirmatively acknowledge that screen before the agent starts; the acknowledgement and its timestamp are stored against the interview record.

If a candidate is uncomfortable with an AI interview, the prejoin screen tells them how to contact the recruiter to request a human alternative. We do not penalise candidates who decline, and our Terms forbid recruiters from doing so either. Where NYC Local Law 144 applies, the 10-business-day notice window described below sits on top of this in-product disclosure rather than replacing it.

• Written disclosure in the interview invitation (recruiter obligation).
• In-product prejoin screen naming the AI before the call starts.
• Plain-language explanation of recording, transcription, and scoring.
• Documented route to request a human alternative without penalty.

Recruiters are the controllers of the hiring process and are responsible for obtaining the candidate's consent under whatever law applies to the role's location and the candidate's location. We provide the tooling to capture and store consent; we do not decide on a recruiter's behalf whether the form of consent collected is sufficient for a given jurisdiction.

Where Illinois AIVIA (820 ILCS 42/5), NYC Local Law 144, GDPR Article 6/9 conditions, or similar rules apply, recruiters must collect written consent before the interview is recorded, not after. Our invitation flow includes a consent checkbox and stores the timestamp, IP address, user agent, and the exact language the candidate agreed to, along with the rubric version that was in force at the time. Recruiters can export this record as a signed JSON bundle for audit or for response to a data-subject request.

Consent must be informed. The notice presented to the candidate should explain, at a minimum: that AI will conduct the interview, that the call will be recorded and transcribed, that a scored report will be generated and shared with the recruiter, what general types of characteristics the AI uses to evaluate the applicant (an AIVIA requirement), how long the data will be retained, and how the candidate can request deletion. Our default consent template covers each of these elements; recruiters can customise the wording but cannot remove the required elements without breaching our Terms.

New York City's Local Law 144 of 2021 (codified at NYC Administrative Code §§ 20-870 to 20-874, with implementing rules at 6 RCNY § 5-300) regulates Automated Employment Decision Tools (AEDTs) for candidates who reside in NYC or for jobs based in NYC. Where an AEDT is used to substantially assist or replace a discretionary hiring or promotion decision, the employer or employment agency — not the vendor — must meet the following obligations before the tool is used on a given candidate:

• Commission an independent bias audit by an auditor with no employment or financial relationship to the employer or to the AEDT vendor, conducted within the previous year, calculating selection rates and impact ratios across sex categories, race and ethnicity categories, and their intersections.
• Publish a summary of the bias-audit results and the distribution date of the tool on the employer's public website, and keep it posted for at least six months after the latest use of the tool.
• Provide each candidate with at least 10 business days' written notice before the AEDT is used, including the job qualifications and characteristics the tool will assess and (on request) information about the data collected, its source, and the employer's retention policy.
• Provide a process to request an alternative selection process or a reasonable accommodation.

Civil penalties under § 20-872 run from $500 for a first violation up to $1,500 for each subsequent violation, and each day of continued non-compliance and each affected candidate can be treated as a separate violation. We therefore do not publish a single "AI Interviewer bias audit" that customers can point to: under LL144 the audit attaches to the employer's specific configuration, rubric, candidate population, and selection rates, and a generic vendor audit would not satisfy the statute for a customer using a different rubric.

What we do provide: per-candidate score data, rubric versions, demographic fields where the candidate volunteered them, and selection-rate exports formatted to match the DCWP audit guidance in 6 RCNY § 5-301. Customers pass this to the independent auditor of their choice; our support team can introduce you to auditors we have worked with before.

Under the EU AI Act (Regulation (EU) 2024/1689), AI systems intended for the recruitment or selection of natural persons — in particular to place targeted job advertisements, analyse and filter applications, and evaluate candidates — are classified as high-risk under Article 6(2) read with Annex III, point 4(a). The obligations fall on both the provider (Nexprove, as the entity placing the system on the market) and the deployer (the recruiter using the product). We build AI Recruiter to support the provider-side obligations in Chapter III, Section 2:

• Risk management system (Art. 9). A documented, iterative process covering the identification, estimation, and mitigation of foreseeable risks to health, safety, and fundamental rights, refreshed on each material model or rubric-engine change and on substantive customer feedback.
• Data and data governance (Art. 10). We do not finetune on customer interview data. Evaluation sets used to validate the rubric-scoring layer are reviewed for relevance, representativeness, and known biases, and we document the gaps we have not been able to close.
• Technical documentation (Art. 11) and instructions for use (Art. 13). We maintain the technical file required by Annex IV and provide deployers with instructions describing the system's intended purpose, capabilities, known limitations, and the human-oversight measures that must be kept in place.
• Record-keeping (Art. 12). Each interview is logged with timestamps, model version, rubric version, the transcript that produced the score, and the recruiter actions that followed; logs are retained for at least the period required by Article 19.
• Human oversight (Art. 14). A recruiter reviews every score and is the sole decision-maker; the product is configured so that there is no auto-reject pathway and so that the recruiter can disregard, override, or reverse the output.
• Accuracy, robustness and cybersecurity (Art. 15). We monitor transcription word error rate and score consistency on a held-out evaluation set, publish material changes in release notes, and document the accuracy levels and metrics declared to deployers.

Deployers carry their own obligations under Article 26 (use in accordance with instructions, human oversight, input data relevance, log retention, monitoring), Article 27 (fundamental rights impact assessment for bodies governed by public law and certain other deployers), Article 50 (informing natural persons that they are interacting with an AI system), and Article 86 (the right of affected persons to obtain an explanation of decisions made on the basis of high-risk system output). We support each of these with export endpoints, the audit log, and the per-criterion justifications described below.

The Illinois Artificial Intelligence Video Interview Act (820 ILCS 42/) applies when an employer asks an applicant to record a video interview and uses AI analysis on that video for positions based in Illinois. AI Recruiter is voice- and transcript-based rather than video, but recruiters and Illinois counsel routinely treat AIVIA as the compliance floor for any AI-mediated interview in the state, and so do we.

Before the interview, under 820 ILCS 42/5, the recruiter must:

• Notify the applicant in writing before the interview that AI may be used to analyse the interview and consider the applicant's fitness for the position.
• Provide the applicant with information explaining how the AI works and the general types of characteristics it uses to evaluate applicants.
• Obtain, before the interview is conducted, the applicant's written consent to be evaluated by the AI program.

AIVIA also restricts sharing (820 ILCS 42/10): interview recordings and transcripts may be shared only with persons whose expertise or technology is necessary in order to evaluate the applicant's fitness for a position. We do not share interview data outside the recruiter's account, the sub-processors listed in our data handling page, and the candidate themselves on request. We do not sell interview data and we do not permit secondary use.

On deletion (820 ILCS 42/15): on receipt of an applicant's request, the employer must, within 30 days, delete the applicant's interview (including all electronically generated backup copies) and instruct any other persons who received copies to do the same. We surface a one-click deletion flow that propagates to primary storage, replicas, and encrypted backups within that 30-day window and emits a signed deletion receipt the recruiter can hand the applicant. Where the recruiter relied solely on AI analysis to decide which applicants to advance to an in-person interview, 820 ILCS 42/20 also requires the recruiter to report annual race and ethnicity data to the Illinois Department of Commerce and Economic Opportunity; we expose the underlying counts but the report is the recruiter's to file.

Bias in AI hiring tools is usually the result of three things: training data that encodes historical patterns, a rubric that rewards traits correlated with protected characteristics, and downstream selection that compounds small per-step disparities. We address each of these directly, and we are explicit about where the responsibility sits with the recruiter rather than with us.

• We do not finetune on candidate data. Customer interview transcripts are never used to train or finetune the underlying models. This eliminates one pathway for historical hiring patterns to leak into future scores and is consistent with the data-governance expectation in EU AI Act Article 10.
• Rubrics are recruiter-defined. The model scores against the criteria the recruiter wrote — it does not invent its own. We require recruiters to keep rubrics job-related and consistent with business necessity, and we recommend avoiding criteria correlated with protected characteristics such as accent, gendered communication style, or culturally specific references. The bias-audit feeds described under LL144 use these recruiter-defined rubrics as the unit of analysis.
• Standardised prompting. Every candidate for a given role is asked the same core questions in the same order against the same rubric version. Follow-up probing is allowed but bounded by configuration, and each follow-up is logged so an auditor can see that probing patterns are consistent across demographic groups.
• No inference of protected characteristics. The system does not attempt to infer race, age, gender, disability, sexual orientation, or other protected characteristics from voice or content, and is configured to refuse if a rubric tries to ask it to. Emotion-recognition use in the workplace and educational settings is prohibited under Article 5(1)(f) of the EU AI Act; we treat that prohibition as a global product setting rather than a regional one.

Every score in the report is auditable. For each rubric dimension, the report includes (1) the numerical score, (2) a written justification from the model, and (3) direct citations to the transcript passages that supported the justification. A recruiter can click through from any score to the exact moment in the interview where the candidate said the relevant thing. This structure is designed to support EU AI Act Article 86, which gives an affected person the right to obtain a clear and meaningful explanation of decisions taken on the basis of a high-risk system's output.

We deliberately avoid black-box outputs. The report does not produce an overall "hire" or "no-hire" verdict. It produces a structured set of per-criterion scores plus the evidence behind each one, and leaves synthesis to the recruiter. The intent is that the recruiter can answer the question "why did this candidate score the way they did on this criterion?" without speculation and without contacting us.

Candidates can request a copy of their own transcript, the rubric they were evaluated against, and the per-criterion justifications by emailing the recruiter, or by emailing hello@nexprove.com if the recruiter cannot be reached within a reasonable period. We honour these requests regardless of whether the candidate's jurisdiction explicitly grants the right, subject to verifying the candidate's identity.

Voice transcription is not perfect. Word error rates rise with strong accents, low audio quality, code-switching, technical jargon, overlapping speech, and non-native fluency. A misheard word can change the meaning of an answer and therefore a score. Recruiters should treat scores as advisory and read the underlying transcript and per-criterion justifications before making any decision that turns on a borderline result. This is the human-oversight posture EU AI Act Article 14(4) describes: the deployer must be able to correctly interpret the output, decide not to use it, and override or reverse it.

Known limitations we ask recruiters to keep in mind:

• Scores are model outputs and will vary between runs even on identical inputs. We disclose the expected variance to deployers under Article 15.
• The system can be misled by candidates who rehearse rubric-friendly phrasing without substantive understanding. Follow-up questions in a human round are the right mitigation; this is one of the reasons we ship the product as a screening aid rather than a decision system.
• The system is not a lie detector, a personality test, or an emotion-recognition tool. We will not configure it as one, and Article 5(1)(f) of the EU AI Act prohibits the last category in employment contexts in any case.
• Accessibility: candidates with speech disabilities, hearing impairments, or non-native fluency may be disadvantaged by a voice-only format. Recruiters must offer an equivalent alternative on request, consistent with the ADA, the EU Web Accessibility Directive where it applies, and the alternative-process obligation in LL144.

Every interview generates an auditable record designed to satisfy EU AI Act Article 12 record-keeping and Article 19 log-retention requirements, and to be exportable in the format the DCWP rules contemplate for an LL144 bias audit. We store the interview audio, the verbatim transcript, the rubric the candidate was evaluated against (versioned), the model and prompt-engine version used, the per-criterion score and justification, and the timestamp of each event in the lifecycle (invitation sent, notice delivered, consent captured, prejoin acknowledged, interview started, interview completed, report generated, report viewed, decision recorded by the recruiter).

Transcripts are immutable once written. They cannot be edited after the interview ends. Corrections, if needed, are recorded as separate annotations against the original transcript so that the original remains intact for audit. This is an intentionally conservative choice: an auditable record that can be silently rewritten is not auditable.

Rubrics are versioned. If a recruiter changes a rubric mid-search, candidates already interviewed are not re-scored against the new rubric without a fresh, logged action that identifies the user who triggered the rescore and the prior version. This protects against retroactive rubric changes that would otherwise make a bias audit meaningless and is the kind of post-market monitoring control Article 72 contemplates.

Retention defaults, sub-processor lists, and data-subject rights are described in our privacy policy and data handling pages, and are reconciled with the deletion timelines in 820 ILCS 42/15 and applicable GDPR Article 17 rights.

If you are a candidate and you believe an interview was conducted unfairly, that you were not given proper disclosure or the option to decline, that your data was used outside the scope you consented to, or that a score does not reflect what you actually said in the transcript, please contact us at hello@nexprove.com. We treat reports from candidates as a primary source of post-market monitoring signal under EU AI Act Article 72.

We will:

• Acknowledge the report within two business days.
• Investigate by pulling the transcript, the per-criterion score justifications, the audit log, and (where the candidate consents) the recruiter's downstream actions.
• Share the outcome with you in writing. Where the recruiter is at fault, we raise it with the customer and require remediation; where the fault is ours, we record it as a serious incident and, where the thresholds in EU AI Act Article 73 are met, report it to the relevant market surveillance authority within the statutory window.
• Where a recruiter has materially breached our Terms or applicable law, restrict or terminate their access to AI Recruiter.

You can also raise concerns directly with the regulator in your jurisdiction — for example, the NYC Department of Consumer and Worker Protection for LL144, the Illinois Department of Labor or Department of Commerce and Economic Opportunity for AIVIA, your national market surveillance authority under the EU AI Act, or your supervisory authority under the GDPR. Reporting to us does not waive your right to do so, and our Terms forbid retaliation by recruiters against candidates who exercise that right.