← Industries/HR Tech & Recruiting
Promethean for HR Tech & Recruiting
AI Act Annex III §4 makes most HR-AI high-risk: recruitment, candidate filtering, performance evaluation, promotion + termination decisions, task allocation. Article 12 demands per-decision logs traceable to the model and the inputs. Add GDPR Art. 22 + EEOC adverse-impact pressure (in the US) and the audit ask is constant. Promethean's evidence layer is what makes 'we have a real audit log of every hiring decision the AI touched' structurally true.
Who this is for
Compliance + product teams in HR tech SMBs (recruiting platforms · talent matching · performance review · interview AI). Typically:
- Seed–Series B HR tech with 10–80 engineers; AI used in 1–3 production features.
- Customer base spans EU + US — both AI Act Annex III §4 and EEOC adverse-impact scrutiny apply.
- Decision volume: 1k–500k candidate-screening or evaluation decisions per month per customer.
- Multi-tenant by design — one platform, many employer customers, each with their own data + audit needs.
- Customer procurement increasingly demands SOC 2 + an AI-specific audit trail.
The regulatory pressure
AI Act Annex III §4 — employment + workers management
AI for recruitment, candidate filtering, evaluation, promotion/termination, task allocation, behaviour monitoring is high-risk. Articles 9-15 apply: risk management, data governance, technical documentation, record-keeping, transparency, human oversight, accuracy.
Deep-dive →GDPR Art. 22 — solely-automated decisions with legal effects
Hiring decisions clearly produce legal effects. Solely-automated decisions are prohibited unless an exception applies, and even then 'meaningful human intervention' is required. Post-Schufa, even 'a human approves the AI shortlist' may not qualify if override rates are near zero.
Deep-dive →EEOC technical assistance on AI in hiring (2023+)
US Equal Employment Opportunity Commission has issued guidance + enforcement actions on AI-driven hiring tools that produce adverse impact. Employers (your customers) need to prove the tool was validated; you need to provide per-decision evidence.
NYC Local Law 144 + EU pay-transparency directive
New York's AEDT law requires annual bias audits for AI hiring tools used on NYC candidates. EU pay-transparency directive (2023/970) requires explanation of pay-determination factors when challenged. Per-decision evidence underpins both.
Where LLMs typically run in HR Tech & Recruiting
Resume screening + candidate ranking
Classifier producing fit-score + recommendation (advance / hold / reject) per applicant. Closed-enum output; reviewer gate on low-confidence + always-human on reject decisions (per AI Act human-oversight expectation).
Interview transcript scoring
Extractor / classifier scoring competency-evidence in interview transcripts. Schema-bound rubric output; the rubric (spec) is hash-committed into every entry so retroactive rubric changes are visible.
Job-description generation
Drafter producing job descriptions from role briefs. Schema constraint on protected-class language; reviewer-gate on schema violations.
Performance-review summary
Summariser consolidating 360-feedback inputs. Reviewer-gate always-human (manager signs each summary); reviewer-verdict logged.
How the substrate maps to your audit
| Your LLM feature | What the regulator asks | Promethean evidence |
|---|---|---|
| Resume screening | Adverse-impact analysis: which decisions, what inputs, what verdicts? | L12 chain provides per-decision inputHash + verdict; statistical bias audits run against the chain export. |
| Interview scoring | Was the rubric the same across candidates? Did it change? | specHash binds the rubric to every entry; rubric changes are hash-detectable. |
| Reject decisions | Did a human actually review and override authority? (Art. 22 GDPR) | Always-human reviewer gate + reviewer verdict per entry; override rate computable from chain. |
| Pay determination input | EU pay-transparency: explain factors used. | specHash + inputHash; spec definition retrievable for transparency disclosure. |
| NYC AEDT annual audit | Provide all decisions in the bias-audit period. | Time-bounded chain export with per-decision metadata. |
Which Promethean tier fits
Recommended for typical SMBs in HR Tech & Recruiting
Production€499 / month flat
Up to 25 specs · 1M entries / month · hourly OTS anchoring · multi-tenant · federation read-only.
HR tech is multi-tenant by design (you serve many employer customers), so Production tier's R4 tenantId + federation read primitives fits naturally. 1M entries/month covers most mid-size HR-tech SMBs. When growing past 25 active specs (e.g. specialised rubrics per employer or per role family), upgrade to Scale (€1,199/mo) for 50-spec ceiling; federation full + HSM custody are on the roadmap (some enterprise employer customers will demand customer-controlled keys).
Larger HR Tech & Recruiting operators with multi-tenant or framework-template needs upgrade to Scale (€1,199 / month flat).
What this looks like in practice
Hypothetical: a 30-person recruiting AI SMB hit with an Art. 22 complaint
A candidate files a GDPR Art. 22 complaint against an HR-tech platform's resume-screening product. The DPA asks: 'Was the decision solely automated? What human review actually occurred? What was the override rate across all candidates with this profile?' Without Promethean: weeks of log-archeology, no clean way to demonstrate the override rate, defensive lawyer engagement. With Promethean: a chain-export query shows the override rate across 50,000 similar decisions was 18% — material human intervention. Reviewer verdicts per decision are signed + chained — the DPA can independently verify with verify.mjs. The complaint is resolved on the merits in two weeks, not six months.
Frequently asked
Is candidate data ever stored on Promethean infrastructure?
No. The substrate's design stores SHA-256 hashes of inputs (inputHash) and outputs (outputCanonicalHash) only — raw CV content, names, contact details never enter the L12 chain. GDPR data-minimisation requirements (Art. 5(1)(c)) are satisfied by construction; HR-tech operators retain the source data per their own retention policy.
How does Promethean help with NYC Local Law 144 bias audits?
The annual bias audit requires demonstrating who was decisioned, what verdict they got, and computing 4/5ths-rule statistics across protected-class groups. The L12 chain provides per-decision metadata (specId, modelIdentity, schemaValid, reviewerVerdict, recordedAtIso). Pair with your own demographic-data table (held separately to satisfy proportionality) and the bias-audit firm can compute the disparate-impact statistics against verifiable data rather than reconstructed logs.
Multi-tenant: can each employer customer see only their own audit trail?
Yes — that's R4 multi-tenancy. Each L12 entry can carry a tenantId field; the verifier supports scoping verification to a specific tenant. You ship a per-employer audit bundle filtered to their tenantId; they verify with verify.mjs without seeing other customers' data. Available on Production tier and above.
We have a human reviewer in the loop. Why do we still need the audit trail?
Because 'a human is in the loop' is only as good as the intervention is meaningful. EDPB Guidelines WP251 (rev.01) + GDPR Recital 71 establish that human involvement must be more than a 'token gesture'; the Schufa CJEU ruling (C-634/21, 2023) reinforced this by holding that an automated score is itself an Art. 22 decision when the downstream actor draws strongly on it. If your reviewer rubber-stamps the AI's recommendation in 95%+ of cases, regulators are increasingly likely to treat the AI as the de facto decision-maker. The L12 chain's per-entry reviewer-verdict (approved / rejected / amended) lets you empirically demonstrate the override rate. A non-trivial override rate is the evidence that the human intervention is meaningful.
What does this cost relative to a SOC 2 audit?
Production tier (€499/mo = €5,988/year) is roughly 5-10% of what a full SOC 2 Type II audit costs annually. The L12 chain doesn't replace SOC 2 (SOC 2 covers operational controls; Promethean covers per-AI-decision audit), but it materially reduces the AI-specific audit-evidence burden during SOC 2 prep. Most HR-tech SMBs run both.
Drill into a specific use case
Each HR Tech & Recruiting use case has its own page with the regulation-specific evidence mapping + hypothetical scenario:
Definitions used on this page
The substrate primitives referenced above (L12 receipt chain, spec hash, reviewer gate, fallback behaviour, OpenTimestamps anchor, tenant ID) all have canonical definitions in the glossary: