Why we publish what Vekt's AI can't do
Vekt's repo lists four limits of its AI scoring before any feature list. Here is what they are, and why a hiring tool should be easier to question, not harder.
Vekt is an open-source recruitment orchestration engine for privacy-first hiring. It runs on your own servers, structures how candidates are evaluated, and uses AI to rank applications against the job description so a recruiter knows what to read first. It does not decide who gets hired.
Before the feature list, the repo has a compliance folder that names what the AI scoring can’t do. This post explains those four limits and why they come first.
Why lead with limits
In the EU, using AI to screen job applications is classed as a high-risk use under Annex III of the AI Act. Those obligations now apply from 2 December 2027, after the Digital Omnibus moved the original date. GDPR already applies today: candidates have rights over decisions based solely on automated processing, and they have to be told how their data is used.
It is easy to answer that with a “compliant” badge. We think a tool in this space should be easier to question instead, and that starts with saying plainly where it falls short.
Limit 1: no accuracy has been measured
Vekt has never been tested against a labelled set of CVs and hiring outcomes. There is no precision, recall or agreement-with-reviewer figure. Any number we gave you today would be invented.
If a vendor gives you an accuracy figure, ask what it was measured on, and whether it was measured on hiring like yours.
Limit 2: redaction removes names, not every clue
Before any text reaches the model, Vekt removes direct identifiers: name, email, phone, links, date of birth, and lines that state nationality, citizenship, marital status or gender.
It does not remove proxies. University names, languages spoken, military service, career gaps and writing style can all carry signals of origin, age and gender, and a language model can pick them up. Redaction reduces the risk; it does not remove it. That is why a person makes the final call.
Limit 3: scores aren’t comparable across setups
The score comes from a general-purpose language model asked for a number from 0 to 100. Change the model, the provider or the prompt, and the same CV gets a different number. Even the same CV scored twice can drift by a few points.
So scores are only comparable within one configuration, and the threshold you choose sits on a noisy signal. Write down why you picked it.
Limit 4: running it yourself doesn’t make you compliant
Self-hosting answers one important question: where the data is. With a local model, CV text never leaves infrastructure you control. With a hosted provider such as OpenAI or OpenRouter, the redacted text does go to that provider, which becomes a processor and possibly a transfer outside the EU.
What self-hosting does not answer is whether your hiring process is lawful and fair. That depends on your criteria, your human review, what you tell candidates and how you handle their requests. Those stay with the organisation that hires.
What we’re doing about it
The biggest gap is the first one. We’re looking for two or three EU organisations willing to measure Vekt on their own past applications, on their own servers, with their data never leaving them. We’ll help set it up, and with your agreement the method and aggregate results get published, so the next team doesn’t start from zero.
If that’s you, open an issue on GitHub or message us on LinkedIn.