Already in force
Article 50 transparency duties applied from 2 August 2026 and were not deferred. They apply based on what a system does rather than its risk tier, so disclosure to candidates is a present obligation, not a future one.
EU AI Act
AI CV screening is a high-risk use
Under the EU AI Act, using AI to screen job applications is an Annex III high-risk use, alongside evaluating exams and assessing loan applications. That classification does not depend on how capable the model is or how the vendor describes the product. It depends on what the system decides about people.
An MIT licence does not change this. The free and open-source exemption in Article 2(12) does not apply to systems placed on the market or put into service as high-risk systems, or to systems falling under Article 5 or Article 50.
Vekt is built on the assumption that this applies to it. The engineering consequences — human review before rejection, identity redaction before scoring, and a decision record that names the model — are in the codebase, not in a policy page.
Vekt does not claim to be compliant with the AI Act, and could not. Compliance is a property of an organisation and a specific deployment — its risk management, its documentation, its oversight, its data — not a property of a piece of software that can be shipped to you. What a project can do is make the defensible path the default one, document the gaps, and refuse to overstate the rest.
Timeline
The high-risk deadline moved. Transparency did not.
Regulation (EU) 2026/1744, the Digital Omnibus on AI, entered into force on 27 July 2026 and deferred Annex III high-risk obligations from 2 August 2026 to 2 December 2027. Annex I embedded systems move to 2 August 2028.
Deferred, not repealed
The high-risk requirements — risk management, data governance, record-keeping, human oversight, accuracy — still arrive. Sixteen extra months is time to build them in, not a reason to postpone the design decisions they force.
Limits
What Vekt does not claim
Read this before you rely on any of the above.
The gaps are the point of this list
- No compliance claim. Installing Vekt does not make an organisation compliant with the AI Act, the GDPR, or employment law in any jurisdiction. It cannot; those obligations attach to you, not to the software.
- No accuracy or bias metrics. Vekt has never been measured against labelled hiring outcomes. No precision, recall, or agreement-with-human figure exists, and any number claimed for it today would be invented.
- No conformity assessment, CE marking or EU database registration has been carried out, and no notified body has reviewed it.
- No risk management system under Article 9 ships with the code. That is an organisational process and it belongs to whoever acts as provider.
- Redaction is best-effort. Direct identifiers are stripped; proxies for origin, age and gender survive in free text and the model can still use them.
- The scoring prompt is unconstrained. A deployer can write weighting criteria that encode discrimination, and nothing in the code prevents it.
- No warranty. The software is provided as is. Nothing on this site is legal advice, and it is not a substitute for your own assessment.
Roles
Provider or deployer
Which obligations land on you depends on what you do with the software, not on who wrote it.
Running Vekt for your own hiring makes you the deployer
Deployers use the system according to its instructions, assign competent human oversight, inform candidates, and retain logs. Whoever places a hiring system on the market under their own name is the provider, and carries the heavier obligations in Articles 9 to 15 along with conformity assessment and registration.
Using an open-weights model does not reduce this. The provider of the overall system documents and tests the whole system including the model component, even where the model's publisher never did — which can make an open model harder to comply with than a commercial one, not easier.
Implementation
What the code actually does
Four design decisions follow directly from the obligations. None of them is a compliance guarantee.
Human review before rejection
Candidates scoring below the threshold are marked Needs review and no rejection email is sent until a recruiter decides. Automatic rejection is a deliberate opt-in, recorded per evaluation, because a decision made solely by automated processing that rejects an applicant is what Article 14 and GDPR Article 22 are about.
Identity removed before scoring
Name, email, phone, URLs, date of birth and stated nationality or marital status are stripped from the CV text before it reaches any model. This is a mitigation, not a guarantee: free text still carries proxies for origin, age and gender.
Decisions that can be traced
A stored score is not a record. Each evaluation keeps the provider, the exact model identifier, a hash of the prompt, and the evaluator version, so a decision can still be explained after the model behind it has been retired.
No accuracy claim
Vekt has not been measured against labelled hiring outcomes, so it declares no accuracy figure. The limitations are written down rather than left implied — including that scores are uncalibrated and not comparable across models or prompt versions.
FAQ
Frequently asked questions
Is AI CV screening high-risk under the EU AI Act?
Yes. Annex III, point 4(a) lists AI systems intended to be used for recruitment or selection, in particular to place targeted job advertisements, to analyse and filter job applications, and to evaluate candidates. Software that scores and ranks applicants against a job posting falls within that description.
When do the high-risk obligations apply?
The Digital Omnibus on AI, Regulation (EU) 2026/1744, deferred the Annex III high-risk obligations from 2 August 2026 to 2 December 2027. They were deferred, not repealed: risk management, data governance, record-keeping, human oversight and accuracy requirements still arrive.
Does using Vekt make an organisation compliant with the AI Act?
No. Installing Vekt does not make anyone compliant; the obligations attach to the organisation that provides or deploys the system, not to the code. No conformity assessment, CE marking or EU database registration has been carried out for Vekt, and no risk management system under Article 9 ships with it.
Who carries the obligations: Vekt or the organisation using it?
It depends on what you do with the software, not on who wrote it. An organisation using a high-risk system under its authority is a deployer. Whoever places a system on the market or puts it into service under its own name is the provider, with the heavier obligations in Articles 9 to 15. Work out your role with your own legal advice.
Does Vekt tell candidates that AI is involved?
Yes. The application form and the candidate status page show a disclosure stating that an AI system is involved in the assessment, what it does, that direct identifiers are removed first, and that a person decides, with how to ask for an explanation or human review. Forks should keep it.
Has Vekt’s AI scoring been tested for accuracy or bias?
No. Vekt has never been measured against labelled hiring outcomes, so no accuracy, precision or bias figure exists. Scores come from a general-purpose language model, are uncalibrated, and are not comparable across models or prompt versions. Removing direct identifiers is a mitigation, not a guarantee: free text still carries proxies for origin, age and gender.
What does Vekt record about each AI evaluation?
The AI provider, the exact model identifier, a hash of the prompt and the evaluator version, stored with the score and its reasoning. That lets a decision be explained after the model behind it has been retired.
None of this is legal advice, and no software makes an organisation compliant. What software can do is make the defensible path the default one, and record enough that the decisions it influenced can still be explained a year later.
If you deploy Vekt to screen real applicants, the obligations are yours. You decide the model, the prompt, the threshold, whether automatic rejection is switched on, and whether anyone competent actually reviews the output. The project supplies the mechanism and the documentation of its limits; it cannot supply the judgement, and it accepts no liability for decisions made with it.