Risk Classification Memo — EU AI Act

Company	Aurora Hiring GmbH
AI system	Aurora CV Ranking Engine — v2.1
Date	2026-07-09
Prepared with	TrustPacket Doc Pack (self-assessment basis)

1. Conclusion

Based on the self-assessment answers, Aurora CV Ranking Engine appears to fall in the tier: High risk (Annex III).

Your system appears to match one or more Annex III high-risk use cases. Core obligations apply from 2 August 2026 (Annex I product-safety systems: 2 August 2027). This is the heaviest compliance tier short of prohibition — start documentation now. Note: narrow, purely preparatory or procedural uses within these areas may be exempt under Art. 6(3) — but claiming that exemption requires a documented assessment.

2. System description

An AI system that analyzes job applications (CVs, cover letters, work samples) and produces a ranked shortlist for recruiters. The system uses natural language processing and a proprietary scoring model trained on historical hiring outcomes.

3. Intended purpose

To assist recruiters in identifying the most qualified candidates for open positions by automatically ranking applications according to job requirements, reducing time-to-hire and improving hiring quality.

4. Reasoning

• Employment & HR: recruitment, screening, promotion, task allocation, monitoring

Annex III / Annex I areas reported

• Employment & HR: recruitment, screening, promotion, task allocation, monitoring

5. Role and market status

Declared operator role: provider. EU market status: on the EU market / output used in the EU.

6. Applicable obligations (summary)

• Risk management system (Art. 9) — 2 Aug 2026
• Data & data governance (Art. 10) — 2 Aug 2026
• Technical documentation (Annex IV) (Art. 11 + Annex IV) — 2 Aug 2026
• Record-keeping / logging (Art. 12) — 2 Aug 2026
• Transparency & instructions for use (Art. 13) — 2 Aug 2026
• Human oversight (Art. 14) — 2 Aug 2026
• Accuracy, robustness & cybersecurity (Art. 15) — 2 Aug 2026
• Conformity assessment + CE marking + EU registration (Art. 43, 47-49) — 2 Aug 2026
• AI literacy for staff (Art. 4) — In force since 2 Feb 2025

Technical Documentation (Annex IV structure)

Company	Aurora Hiring GmbH
AI system	Aurora CV Ranking Engine — v2.1
Date	2026-07-09
Prepared with	TrustPacket Doc Pack (self-assessment basis)

Structured to the nine Annex IV headings. For SMEs, Article 11(1) permits simplified form — every heading still requires an answer.

1. General description of the AI system

An AI system that analyzes job applications (CVs, cover letters, work samples) and produces a ranked shortlist for recruiters. The system uses natural language processing and a proprietary scoring model trained on historical hiring outcomes.

To assist recruiters in identifying the most qualified candidates for open positions by automatically ranking applications according to job requirements, reducing time-to-hire and improving hiring quality.

Deployment context: SaaS platform hosted in EU (Frankfurt region). Recruiters upload job descriptions and receive candidate rankings via web dashboard. Used by 40+ SME customers across Germany, Austria, and the Netherlands.

2. Elements of the system and development process

2.1 Models

The system integrates third-party models: OpenAI text-embedding-3-large for semantic matching; proprietary ranking model fine-tuned on anonymized hiring data. The company also trains or fine-tunes its own models.

2.2 Data and data governance (Art. 10)

• Personal data (names, emails, profiles)
• Employment / HR data (CVs, performance records)
• Behavioural / usage data (clicks, device signals)

Data sources and provenance: Training: 50,000 anonymized historical job applications (CV text, hiring outcome labels) collected from consenting customers 2020–2024. Inference: customer-uploaded CVs and job descriptions.

2.3 Human oversight measures (Art. 14)

• A human reviews or can override outputs before they take effect
• Low-confidence outputs are flagged for human attention
• Staff operating the system receive training on its limits

3. Monitoring, functioning and control

Capabilities and limitations communicated to users via instructions for use.

[To be completed: known limitations, foreseeable unintended outcomes, input data specifications]

4. Performance metrics

• Pre-release evaluation suite / benchmark testing
• Bias or fairness testing across user groups
• Regression testing when models or prompts change

[To be completed: metric values appropriate to the intended purpose, including performance across relevant user groups]

5. Risk management system (Art. 9)

As a high-risk system, a documented, iterative risk management process is required across the lifecycle: identify risks, estimate and evaluate, adopt mitigation, test effectiveness.

Incident handling: an incident response process exists.

6. Lifecycle changes

[To be completed: description of relevant changes made through the lifecycle; substantial modifications restart conformity obligations]

7. Standards applied

• SOC 2
• ISO 27001
• Documented GDPR compliance program

8. EU declaration of conformity

[Placeholder — completed after conformity assessment (Art. 43, 47).]

9. Post-market monitoring plan (Art. 72)

Record-keeping status: The system automatically records events (logs) during operation. Log retention and access controls are managed by the provider.

[To be completed: monitoring plan proportionate to the system — data collected, review cadence, escalation triggers]

Model / System Card

Company	Aurora Hiring GmbH
AI system	Aurora CV Ranking Engine — v2.1
Date	2026-07-09
Prepared with	TrustPacket Doc Pack (self-assessment basis)

Overview

An AI system that analyzes job applications (CVs, cover letters, work samples) and produces a ranked shortlist for recruiters. The system uses natural language processing and a proprietary scoring model trained on historical hiring outcomes.

Intended use

To assist recruiters in identifying the most qualified candidates for open positions by automatically ranking applications according to job requirements, reducing time-to-hire and improving hiring quality.

Out-of-scope uses

[To be completed: uses the system is not designed or validated for — this section protects you under Article 25 repurposing rules]

Models and architecture

Built on third-party models: OpenAI text-embedding-3-large for semantic matching; proprietary ranking model fine-tuned on anonymized hiring data.

Training data overview

• Personal data (names, emails, profiles)
• Employment / HR data (CVs, performance records)
• Behavioural / usage data (clicks, device signals)

Training: 50,000 anonymized historical job applications (CV text, hiring outcome labels) collected from consenting customers 2020–2024. Inference: customer-uploaded CVs and job descriptions.

Evaluation

• Pre-release evaluation suite / benchmark testing
• Bias or fairness testing across user groups
• Regression testing when models or prompts change

Limitations

[To be completed: known failure modes, populations or inputs where performance degrades]

Internal AI Usage Policy

Company	Aurora Hiring GmbH
AI system	Aurora CV Ranking Engine — v2.1
Date	2026-07-09
Prepared with	TrustPacket Doc Pack (self-assessment basis)

Satisfies the Article 4 AI-literacy expectation: staff who operate AI systems must have sufficient understanding of their function and limits.

1. Purpose and scope

This policy governs how staff of Aurora Hiring GmbH use AI systems in their work, including Aurora CV Ranking Engine and third-party AI tools.

2. Approved uses

• Using approved AI systems for their documented intended purpose.
• Using AI assistance for drafting, analysis and internal productivity, with human review of outputs before external use.

3. Prohibited uses

• Entering special-category personal data or customer confidential data into unapproved AI tools.
• Using AI outputs for consequential decisions about people without the documented human oversight process.
• Any use matching Article 5 prohibited practices (manipulation, social scoring, emotion recognition of staff).

4. Human oversight

• A human reviews or can override outputs before they take effect
• Low-confidence outputs are flagged for human attention
• Staff operating the system receive training on its limits

5. Training

Staff operating Aurora CV Ranking Engine receive onboarding on its capabilities, limitations and this policy. Records of training are kept.

6. Incidents

Suspected AI incidents follow the company incident response process.

7. Review

This policy is reviewed at least annually and when the company adopts new AI systems or the regulatory landscape changes.

Compliance Roadmap

Company	Aurora Hiring GmbH
AI system	Aurora CV Ranking Engine — v2.1
Date	2026-07-09
Prepared with	TrustPacket Doc Pack (self-assessment basis)

Deadline-ordered plan

When	What
Already in force (2 Feb 2025)	Article 5 prohibited practices ban; Article 4 AI literacy — adopt the AI usage policy in this pack and run staff onboarding.
Already in force (2 Aug 2025)	GPAI model duties — not applicable based on answers (you do not provide a general-purpose model).
Now → Q1 2026	Close the [To be completed] gaps in the Annex IV technical documentation; stand up risk management (Art. 9) and logging (Art. 12).
Q1–Q2 2026	Accuracy/robustness evidence (Art. 15) including group-level performance; finalise human oversight design (Art. 14); prepare instructions for use (Art. 13).
Before 2 Aug 2026	Conformity assessment (Art. 43), EU declaration of conformity, CE marking, EU database registration (Art. 49). Non-EU providers: appoint an EU authorised representative (Art. 22).
After launch	Post-market monitoring (Art. 72) and serious-incident reporting (Art. 73).

Fundamental Rights Impact Assessment (FRIA) — Draft

Company	Aurora Hiring GmbH
AI system	Aurora CV Ranking Engine — v2.1
Date	2026-07-09
Prepared with	TrustPacket Doc Pack (self-assessment basis)

Article 27 of the EU AI Act requires deployers of high-risk AI systems to conduct a fundamental rights impact assessment before deployment. This is a draft template to guide that assessment — the deployer must complete the [To be completed] sections and consult with relevant stakeholders.

1. Purpose and scope of this assessment

This FRIA evaluates the potential impact of Aurora CV Ranking Engine on the fundamental rights of individuals and groups affected by its use.

1.1 System overview

An AI system that analyzes job applications (CVs, cover letters, work samples) and produces a ranked shortlist for recruiters. The system uses natural language processing and a proprietary scoring model trained on historical hiring outcomes.

To assist recruiters in identifying the most qualified candidates for open positions by automatically ranking applications according to job requirements, reducing time-to-hire and improving hiring quality.

1.2 Deployment context

SaaS platform hosted in EU (Frankfurt region). Recruiters upload job descriptions and receive candidate rankings via web dashboard. Used by 40+ SME customers across Germany, Austria, and the Netherlands.

1.3 Duration, frequency and scope of use

[To be completed: how often the system will be used, how many people will be affected, and the expected duration of deployment]

2. Affected persons and groups

[To be completed: describe the categories of individuals or groups whose fundamental rights may be affected — include vulnerable populations, children, persons with disabilities, or historically marginalized groups if relevant]

3. Fundamental rights potentially affected

The following fundamental rights under the EU Charter may be engaged by this system:

• Human dignity (Art. 1 Charter): [assess whether the system decisions affect dignity]
• Respect for private and family life (Art. 7 Charter): The system processes personal or special-category data.
• Protection of personal data (Art. 8 Charter): Covered by GDPR compliance — cross-reference your DPIA if conducted.
• Equality and non-discrimination (Art. 20-21 Charter): [To be completed: assess whether the system could produce discriminatory outcomes across gender, race, age, disability or other protected characteristics. Reference bias testing results if available.]
• Right to an effective remedy (Art. 47 Charter): [To be completed: describe how affected persons can challenge decisions]

4. Risk assessment

4.1 Potential harms

[To be completed: identify specific harms that could result from system errors, biases, or misuse — examples: wrongful denial of employment, unfair credit decisions, discriminatory law enforcement actions, breaches of privacy]

4.2 Likelihood and severity

[To be completed: for each identified harm, assess likelihood (rare / possible / likely) and severity (minor / moderate / severe). Prioritize risks rated likely + severe.]

4.3 Human oversight in place

• A human reviews or can override outputs before they take effect
• Low-confidence outputs are flagged for human attention
• Staff operating the system receive training on its limits

5. Mitigation measures

Steps taken or planned to reduce identified risks:

• Technical measures: [To be completed: e.g., bias mitigation in training data, confidence thresholds, explainability features]
• Procedural measures: Human review of outputs before consequential decisions.
• Transparency measures: [To be completed: how affected persons are informed about the use of AI, their rights, and how to contest decisions]
• Monitoring and auditing: [To be completed: ongoing monitoring plan]

6. Stakeholder consultation

[To be completed: Article 27(2) encourages consultation with affected persons' representatives, staff representatives, or independent experts. Document any consultations conducted, input received, and how that input influenced design or deployment decisions.]

7. Residual risk and decision

[To be completed: after mitigation, what residual risks remain? Are they acceptable in light of the intended benefits? Document the decision to proceed, modify, or halt deployment.]

8. Review and updates

This FRIA must be reviewed and updated:

• When the system undergoes substantial modification (Art. 43(4))
• If new risks or harms are identified during deployment
• At least annually as part of post-market monitoring (Art. 72)

Date of this assessment: 2026-07-09 (draft — to be finalized by deployer before deployment).