📘
How to use this checklist
This is the practical companion to EU AI Act: Instructions for Use (version 3.0). That document explains the obligations; this one turns them into steps. Work through Section 1 before you put AI features into use, run Section 2 as a routine, and keep Section 3 next to your candidate-facing inbox. Items marked "if you use AI agents" apply only when your company has agents in Studio.
This checklist is informational and does not constitute legal advice.

Checklist version: 3.0 (October 2026). Replaces version 2.0, which did not cover the AI agents and said the platform had no regional setting and no bias-audit export.

1. Before go-live

Governance

Appoint an oversight owner. Name the person or team responsible for setting up and reviewing agents, deciding the requests agents and the assistant send for approval, reviewing automation configuration, and acting on anomalies. They need the authority to overrule the system, pause an agent or stop a feature.
Train the reviewers. Everyone who approves agent or assistant requests, sets up agents or automations, or interprets match scores has read Instructions for Use Sections 3.1 (what agents do on their own), 4 (limitations) and 6 (oversight), and understands that an approval is a decision they own.
Confirm the intended purpose. Recruitment and selection of adults, nothing else.

Legal and privacy

Sign the DPA. Including the sub-processor list, which names the AI model providers and the LLM telemetry provider. If you switch on the bias comparison by sex and age group (below), check that it covers that instruction too (Instructions for Use Section 8).
Decide whether to switch on the bias comparison by sex and age group (if you use AI agents). The switch is under Settings > Security > Scoring audit and is off until you switch it on. Switching it on is your instruction to Jaicob, as your processor, to work out each candidate's sex and age group from the gender and date of birth you already hold, only to measure bias. Decide it as controller, record the decision, and cover it in your DPIA. While it is off, the bias report has no comparison by group.
Run your DPIA. For AI-assisted recruitment a data protection impact assessment is typically required (Article 35 GDPR). If you use AI agents, include what they do without a person (Instructions for Use Section 3.1).
Update privacy notices and job postings. Candidates are told, before AI is used on them, that AI supports your process, that only a person can decide to reject them, and how to request an explanation or a human alternative. If you use AI agents, also tell them that an AI assistant may contact them, answer their questions and move their application forward. Sample text in Instructions for Use Section 7.
Decide how sourced people are informed. As controller, informing the people you source is your duty (GDPR Article 14). Turn on the candidate notice in Settings > Company > Privacy and set your privacy link, or inform them another way. The notice is off until you turn it on. While it is on but cannot be completed (for example, its text uses the privacy link and none is set), first messages to sourced people are not sent. Messages your agents send to business prospects carry the prospect notice, on by default in the same settings; as the sender, keeping an opt-out on every such message (Telecommunicatiewet article 11.7) is your duty.
Cover sourced candidates in your own process too. With the notice on, the default wording in the first message is written to satisfy Article 14 at first contact; if you use your own text, keep it covering the same points. A workflow that only sends connection invites and never messages does not notify anyone. Follow accepted invites with a message, or notify within one month yourself.
Inform workers and their representatives before first use (Article 26(7); WOR Article 27 may apply in the Netherlands).
Public body? Complete a FRIA (Article 27) before first use.
Non-EU hiring locations. Have counsel check local rules. If you use AI agents and switched on the bias comparison, the scoring audit page exports the scoring records with sex and age band where known; coverage is low, so check with your auditor whether it is enough for New York City Local Law 144 or a similar duty.

Platform configuration

Review every automation before starting it. Automations act when they run, without a per-action approval. Check the recipients, the templates and the stage changes each one makes.
Review each agent card's autonomy (if you use AI agents). Before you activate an agent, open every card on its canvas and check what it does on its own. Messages, replies, screening, qualification and stage moves happen without a person by default (Instructions for Use Section 3.1).
Choose which cards need approval (if you use AI agents). Set a card to Asks you where you want to approve each step first, for example Answer clients or Book intake. On message cards, choose who writes the messages; choose I write everything to write every message yourself. Rejections, disqualifications, offers and client submissions always wait for a person, whatever you choose.
Check your region (if you use AI agents). Under Settings > Company > Data retention, keep EU rules for people in the EU. US rules switch off automatic expiry of contact data; they do not change what agents do.
Understand the visibility gate. People found by AI Sourcing whom the AI pre-selection rejects are never shown to you, whether a workflow or an agent found them. Workflow-sourced people whose match score is below 55 are hidden too (Instructions for Use Section 6.3). Manually saved, imported and assistant-saved people are never gated.
Consent-dependent channels. AI screening conversations only start for candidates who opted in through the application form wording that names the AI conversation and its channels. Verify your forms capture it.
Test the disclosures yourself. Run a test SMS or WhatsApp screening to your own phone; confirm the first message tells you that you are talking to an AI assistant and that STOP ends it. If you use AI agents, let an agent write to a test contact of your own and check that its first message carries the AI line.

2. Ongoing operation

Work the approval requests properly. Each assistant action is approved individually; refusals include a reason, and the assistant uses it. Agent requests wait under Waiting on you on the agent's page: read each one, including the email of a rejection, before you approve it, and do not approve a list of requests at once without reading them. Approve all sends each message as your own, without the line saying AI helped write it. The platform still checks those messages for links, addresses and numbers that are not yours, and the list shows a request's text only when you open it. Approve all never includes a rejection or a disqualification: you open and decide each one on its own. Watch your own approval pattern: a 100% approval rate at high speed is a warning sign of automation bias.
Review scheduled assistant tasks. They run without you present and park outward actions for your approval. Review what they proposed and what ran.
Check what your agents did (if you use AI agents). Look through each agent's activity regularly: the messages it sent, the candidates it qualified or moved, and the processes it closed. Correct what is wrong; a stage move or a qualification can be undone.
Read the reasons, not only the score. Every match shows six dimension scores with a written reason each. Decide on the reasons.
Watch outcomes for skew. If you use AI agents and switched on the bias comparison, read the bias report under Settings > Security > Scoring audit, keeping in mind that it covers few candidates. Beyond that, periodically review screening and rejection outcomes across candidate groups yourself. If you see a suspicious pattern, pause the affected feature and contact us.
Keep inputs clean. Vacancy requirements, agent must-haves and screening questions are current, job-relevant and free of criteria that proxy for protected characteristics.
Respect the log floor. AI logs are kept for six months by the platform, and an agent's work history for one year; export the audit log if your own policies require longer retention.
Honour opt-outs immediately. A candidate's STOP, an objection through the Article 14 link, or a request to speak to a human is executed, not queued. When an agent asks you to confirm that someone asked not to be contacted, decide it the same day.
Keep your notices current when you start using a new AI feature.

Incidents

Know what counts. A suspected discriminatory output pattern, an action executed without its required approval, an agent acting outside its settings, an AI conversation without disclosure, or unauthorised access to candidate data.
Know the drill. Suspend the affected use, preserve the logs, and email [email protected] with subject "AI incident" without undue delay (Article 26(5)). We handle provider-side reporting (Article 73).

3. Handling candidate requests

"Was AI used on my application?"

Answer honestly and specifically: which features were involved (matching, AI pre-selection, screening conversation, an AI agent) and what a person decided. If an agent worked on the application, say which steps it took on its own (for example messages, screening, moving the application) and that a person approved any rejection. The match detail, the agent's activity and the audit log show what happened for this candidate.

"Explain the decision about me." (AI Act Article 86, GDPR Article 22(3))

Open the candidate's match detail: six dimension scores, the written reason for each, the overall reason, and the version history.
If an agent scored the candidate, the match explanation contains a plain-language statement for the candidate, in English: what was assessed, how, and who made the decision. Check it, translate it where needed, and share it. Otherwise, write the explanation yourself from those reasons and from the human decision (who decided, what they decided, why).
If the person was a sourced lead the AI pre-selection rejected, ask us for the recorded rejection reason (kept six months; not every rejection has one, see Instructions for Use Section 6.3).
Respond within a reasonable time; if the request is also a GDPR access request, the one-month deadline of Article 12(3) applies.

"I want a human, not an AI."

Offer a human alternative for screening conversations and for conversations with an agent. Declining AI may affect scheduling but must not, by itself, disadvantage the application. Record the preference.

"Delete my data." (GDPR Article 17)

Use the platform's delete. It removes the record, its match scores, interview transcripts, and the stored CV and attachments, and writes an erasure entry to the audit log. Delivery logs and the AI pre-selection's records (the profiles it rejected, and the ones it accepted with name, headline and profile link) survive for the six-month floor, with delivery-log content redacted where that is switched on; say so if asked.

"I want to complain."

Point candidates to your own complaints channel and to their right to complain to the data protection authority (in the Netherlands: Autoriteit Persoonsgegevens) and, for AI-specific complaints, the national market surveillance authority. Never present a complaint as inadmissible because "the AI decided": you are responsible for what your agents do, and every rejection was made or approved by a person in your team.

4. Frequently asked questions

Can the platform reject a candidate on its own?
No. An agent can propose a rejection or a disqualification; it waits until a person in your team approves it, in every region and whatever the agent's settings say. That person sees the email the candidate will receive and can change it first. No score or filter rejects anyone.

Does an agent ask before it acts?
Not by default. Most steps happen on their own (Instructions for Use Section 3.1). You can set cards whose work reaches outside your agency to Asks you; rejections, disqualifications, offers and client submissions always wait for a person.

Can I switch off the approval on assistant actions?
No. Outward assistant actions (messages, email, deletions, multi-step plans) always ask you first, and approvals are signed so they cannot be fabricated.

Do automations ask for approval?
No. They run what you configured. Review the configuration before starting one; that is where your oversight sits.

Does the region setting change what agents do?
No. It changes only how long data is kept. Agents work the same under EU and US rules.

Does the AI see a candidate's age, gender or nationality?
No. Those attributes are withheld from the scoring prompts, from the assistant's candidate view and search, and from CV extraction. The AI pre-selection of sourced people does not see the candidate's name either. If you switch on the bias comparison, the platform works out sex and age band from your candidate records to compare groups; no AI model receives them.

Do I need a bias audit?
Under the EU AI Act, no periodic external bias audit is prescribed for deployers, but you must monitor operation (Section 2). If you hire into New York City, Local Law 144 requires an annual independent bias audit. If you use AI agents and switched on the bias comparison, the scoring audit page exports the scoring records with sex and age band where known; coverage is low, so check with your auditor whether it is enough.

We have a works council. Do we need their sign-off?
You must inform workers and their representatives before use (Article 26(7)). Whether formal consent is required depends on your jurisdiction; check with counsel before rollout.

What if we suspect the AI is behaving in a biased way?
Treat it as an incident: pause the affected feature, preserve logs, and report it to us without undue delay.

Questions this checklist does not answer: [email protected].