Skip to content

Engineering, cloud and support

+44 20 4604 8374
Hexploits

Applied AI

AI governance readiness for recruitment and HR businesses

AI governance readiness is the operating model a recruitment or HR business needs before the laws now arriving can be met: an inventory of every AI use, data that is consolidated and inventoried enough to be governed, policies that say who may use what for which decisions, bias and performance testing on a schedule, human oversight where the law requires it, and a management system, mapped to ISO 42001 where certification is the goal, that keeps all of it current. Hexploits builds the engineering side of that model, starting from the data, because most recruitment businesses cannot govern AI until they know where their candidate data is.

Request a proposalTalk to an engineer

A named engineer replies within one working day. A written scope and an indicative price within two.

Who this is for

  • Agencies, RPOs and HR software vendors facing the EU AI Act’s high-risk obligations for hiring AI by December 2027.
  • Businesses already using bought AI tools for screening, sourcing or performance, with no inventory of them.
  • Boards and compliance functions asked to sign off AI use they cannot currently see.
  • Firms whose clients now ask about AI governance in tenders and due-diligence questionnaires.

What you get

Deliverables, not slogans. Each one appears in the statement of work.

  • An AI inventory covering built systems, bought tools and the AI features inside the CRM, ATS and job boards you already use, each classified and owned.
  • A data foundation: candidate data consolidated and inventoried so that training data, inputs and outputs can be evidenced, with a chain of custody.
  • An AI use policy that says which decisions may involve AI, which need a person, and what candidates and employees are told.
  • Bias, performance and drift testing built into the release process and run on a schedule, with results on file.
  • Logging and oversight points built into the systems, and an incident process for when a model gets it wrong.
  • A management system mapped to ISO 42001, with the evidence produced by the systems rather than assembled for the audit.

Our engineers work across the major languages, frameworks and cloud platforms. We build on the stack you already run, with technology choices explained in writing before work begins.

How it is delivered

The same four stages as every Hexploits engagement, applied to this capability.

  1. Stage 1

    Discovery

    Two to four weeks. We inventory AI uses and candidate data, assess both against the EU AI Act, UK GDPR and ISO 42001, and rank the gaps by deadline and exposure. Output: a dated plan and a fixed figure or capped estimate.

  2. Stage 2

    Foundations

    The data work first: consolidation, inventory and chain of custody, because nothing else can be evidenced without it.

  3. Stage 3

    Controls

    Policy, oversight points, testing and logging built into the systems and the release process, with the first evidence pack produced and reviewed with compliance.

  4. Stage 4

    Operate

    Scheduled testing, inventory upkeep, monitoring and incident handling under deployment and monitoring, and support through certification where ISO 42001 is the goal.

Built by the same team

Governed data and governed models: JobVantage, Gradvisor and swarmd.ai

JobVantage scores every candidate match with written reasoning and confidence, on data whose provenance is recorded field by field. Gradvisor’s platform was rebuilt with its data migrated intact and its release process made routine. swarmd.ai, built by the same team, enforces policy on every AI action and keeps a tamper-evident audit trail. Together they are the three parts of AI governance this page describes: known data, explained decisions, enforced policy.

Read the JobVantage case study

How success is measured

Every engagement agrees its measures and the measurement period in writing before work starts.

  • Every AI use inventoried, classified and owned, including bought tools.
  • Share of candidate data with a complete chain of custody.
  • Bias and performance tests run on schedule, with results on file.
  • Client due-diligence questions on AI answered from evidence, and tenders no longer lost on them.

Proof

Case studies with numbers, and reviews linked to Google where they were left there.

<100 msAPI response time at p95

JobVantage · Recruitment technology · Duration TBC

99.9% availability and sub-100ms responses for a recruitment intelligence platform, at negligible infrastructure cost

99.9%+ availability · <5 s ai processing time for complex media
98%Faster page loads

Gradvisor · Charity · 8 weeks to production, then ongoing

98% faster page loads and a 12% smaller cloud bill for a UK careers charity

12% lower cloud cost · 2 days to ship a change
75%Under the original budget

swarmd.ai · Software vendor · 6 months

Enterprise AI control plane delivered in six months at 75% under budget for a UK software vendor

75% ahead of the original timeline · 6 months from blank page to paying enterprise customers

  • Director, JobVantage

    “Working with Hexploits has genuinely been a pleasure, and I see them as my scaling partner for the foreseeable future as JobVantage grows. If you’re looking for a development team who combine strong AI/engineering capability with honesty, flexibility and a real interest in your business, I’d strongly recommend them.”

    Brandon BowdenDirector, JobVantageRead the review

  • Director, Gradvisor

    “Fantastic company and our development partner for Gradvisor, a social mobility careers platform with national ambitions. Extremely responsive and mission-oriented. Cameron owns any shortfalls humbly - rare for IT providers. Thinks like a client too.”

    Tushar PrabhuDirector, GradvisorRead the review

Questions we get asked

What laws apply to AI in recruitment?
The EU AI Act, which treats hiring and employment AI as high-risk and prohibits emotion recognition at work; UK GDPR and the Data (Use and Access) Act 2025 on automated decision-making and data protection; the Equality Act 2010 on discrimination; and the ICO’s guidance and 2024 audits of AI recruitment tools. ISO 42001 is the management standard clients increasingly ask about.
Why start with data rather than policy?
Because every obligation, from bias testing to technical documentation to subject access, depends on knowing what data exists and where. A policy written over decentralised data cannot be evidenced. Consolidating candidate data is usually the first two months of any credible programme.
Do we need ISO 42001?
Not by law. It is a management system standard for AI, and clients and tenders are starting to ask for it in the way they ask for ISO 27001. We map the governance work to it so that certification, if you want it, is an audit of what already exists rather than a separate project.
Does this cover AI features inside tools we already use?
Yes. The CRM, ATS and job boards most agencies use now ship AI features for screening, ranking and outreach. Under the EU AI Act you are the deployer of those features, so they belong in the inventory with the same oversight and logging.
Is this legal advice?
No. We do the engineering and operational side and work alongside your legal counsel and compliance function, who own the regulatory position.

Related

Sectors where this is most often needed

Reading

More in applied ai

Applied AI overview

Next step

Request a proposal.

Tell us about the system and the sector. A named engineer replies within one working day. A written scope and an indicative price within two working days of a short scoping call.

Request a proposalTalk to an engineer