The five-minute AI hiring inventory: name what you cannot yet govern

Edition 01. A reading time of about 5 minutes.

The hook

Last edition ended with four steps, and the first was to make an inventory of where AI touches your hiring. This edition is that step, done properly, in about five minutes.

It comes first for a plain reason: you cannot govern, document, or defend a system you have not named. Every other obligation under the AI Act, human oversight, record-keeping, vendor due diligence, assumes you already know which tools are in scope. And in hiring, that is exactly the part most teams get wrong, because the AI is usually not a product you bought called "AI." It is a feature sitting inside software you think of as ordinary HR tooling.

What this means

Two facts make the inventory the load-bearing first move.

You are the one on the hook, as the deployer. When your company uses a hiring AI tool, the AI Act calls you the deployer, and deployers carry their own set of obligations, separate from the provider that built the tool (AI Act, Article 26). The vendor's compliance does not absorb yours. That is why a list of vendors is not optional housekeeping; it is the boundary of your own responsibility.

The AI is often invisible inside tools you already run. Resume parsing, candidate ranking, "best match" scores, and shortlisting features are frequently built into an applicant tracking system you pay for as recruiting software, not as an AI system. Yet AI used "for the recruitment or selection of natural persons, in particular to... analyse and filter job applications, and to evaluate candidates" is high-risk by name under Annex III, point 4 of the Act (AI Act, Annex III). You can be deploying a high-risk system without any procurement decision ever having used the word.

Put together: the obligation is yours, and the thing you are responsible for is easy to miss. The inventory closes that gap. It is not bureaucracy; it is the precondition for everything else, and it is the cheapest control you will ever build.

What to do with this

Open a single sheet. Walk your hiring funnel stage by stage and write one row for anything that screens, ranks, scores, matches, or monitors a person. You are not assessing risk yet; you are only naming what exists. Five columns are enough.

1. Tool. The product or feature name.
2. Stage. Where in the funnel it acts: sourcing and job ads, application screening, ranking or matching, assessments and tests, interview scheduling or analysis, or post-hire monitoring.
3. AI feature. What it actually does to a candidate (parses, ranks, scores, recommends, filters).
4. Provider. Who supplies it, including the vendor of the larger platform it lives inside.
5. Human review. Whether a person currently reviews or can override its output, yes or no.

Two things make this fast and honest. First, look hardest at the tools you would not instinctively call AI: your ATS's built-in ranking, anything labelled "smart" or "match," video interview platforms, and online assessment tools are the usual hiding places. Second, do not chase a perfect list. A first pass that names eight tools and flags three "not sure" beats a blank page you meant to fill later. The "not sure" rows are not a failure; they are your vendor questions for next edition, already written.

When the sheet is done, you will have, in five minutes, the one artefact every later obligation depends on, and a clear-eyed sense of how much AI is already making decisions in your hiring. For most teams, that number is higher than they expected, which is the entire reason to look.

This is educational material and a starting point, not legal advice. The EU AI Act is still being amended, and the high-risk timeline rests on an agreement that is not yet final law. For how these rules apply to your specific tools and contracts, consult a qualified lawyer. Signato is not a law firm and does not certify compliance.

AI that drafts at scale can also send the wrong thing at scale. See the Signato chamber block a forbidden send before it happens: run the free local trial, no card, nothing leaves your machine.