Watching Conformly audit Hyrra
Hyrra is a HR startup putting AI into production, sure the EU AI Act doesn't apply to them. Scroll down to see what a two-minute audit actually finds — and what each finding means, without the legal jargon.
Hyrra
AI hiring, faster. · HR & recruiting software (fictional)
“We've got two AI features — a CV helper and a support bot. We're a small startup, the AI Act isn't really about us… right?”
- CV RankerRanks and shortlists job applicantsdeclared
- Support botAnswers customer questions in-appdeclared
- npm:@vibe-vision/emotionFacial-emotion analysis in the video-interview moduleundeclared
- openai:gpt-image-1Generates job-ad images for the careers pageundeclared
- Headcount ForecasterPredicts hiring demand for internal planningundeclared
The founder named 2. A read-only scan of the code found 5. Here is what each one means — in plain words.
Interview Mood Analysis
Reads a candidate's facial expressions and tone in the video interview to score how they 'come across'.
This is not allowed at all. The EU AI Act bans using AI to read people's emotions in the workplace — and a job interview is the workplace. It doesn't matter how accurate it is: the feature has to be switched off.
In plain words: You can't use a computer to judge someone's feelings to decide who gets a job. Full stop.
Art. 5Article 5(1)(f) prohibits AI systems that infer the emotions of a person in the areas of workplace and education (narrow medical/safety exceptions aside). The ban has applied since 2 February 2025.
Turn the feature off. There is no compliant version of it in a hiring context.
Conformly flags it as prohibited the moment it's classified, with the exact article and the reason — so you find it before an auditor does.
An inspector would open with: "Show me every system that processes candidate biometrics or emotion — and the legal basis for each."
CV Ranker
Scores and shortlists applicants so recruiters see the 'best' ones first.
Because this software helps decide who gets a shot at a job, the law treats it as high-stakes. You can keep using it — but you now owe a real list of duties: prove it isn't biased, keep a human in charge, document how it works, and log its decisions.
In plain words: Software that decides who gets hired is treated like a safety-critical machine. It's allowed, but it comes with a rulebook.
Annex IIIAnnex III(4) lists AI for recruitment and evaluation of candidates as high-risk, triggering Articles 9–15: risk management, data governance and bias testing, technical documentation, logging, human oversight and accuracy.
Start the high-risk checklist: bias testing, a named human reviewer, and the Annex IV technical file.
Conformly turns the classification into the exact task list (14 obligations), tracks evidence for each, and generates the Annex IV technical file and the FRIA.
An inspector would open with: "Provide your Annex IV technical documentation and your bias-testing records for the ranking model."
Support Bot
Chats with users in-app and drafts replies for the support team.
The only thing missing here is honesty: people must be told they're talking to a machine, not a human. That's it — a clear line of text.
In plain words: If a robot is talking to your customer, the customer has the right to know it's a robot.
Art. 50Article 50(1) requires that people interacting with an AI system are informed they are dealing with AI, unless it is obvious. It applies from 2 August 2026.
Add a one-line disclosure to the chat, e.g. "You're chatting with Hyrra's AI assistant."
Conformly gives you a hosted public transparency page for the bot and a one-line embed chip you drop into the chat — the disclosure and the proof, done.
Auto Job-Ad Images
Generates images for job postings from a text prompt.
AI-made pictures have to be marked as AI-made, in a way machines can read. Nobody has to squint at a watermark — but the marking has to be there under the hood.
In plain words: If a computer drew the picture, it has to carry an invisible 'made by AI' tag.
Art. 50(2)Article 50(2) requires providers of generative systems to mark synthetic outputs in a machine-readable way, with a transition to 2 December 2026 for systems already on the market.
Enable content credentials (C2PA) or provenance metadata on generated images.
Conformly's free watermark checker lets you confirm whether your output already carries provenance metadata — and the obligation lands on your task list.
Headcount Forecaster
Predicts how many hires you'll need next quarter for internal planning.
Nothing to do here. It doesn't decide anything about a person, so it's minimal risk. Conformly keeps an eye on it in case that ever changes.
In plain words: A forecast that just helps you plan doesn't touch anyone's rights. It's fine.
—Not high-risk and not subject to Article 50 transparency duties — minimal-risk, voluntary good practice only.
No action required. Keep it in your inventory so its status is on record.
Conformly still lists it in your AI inventory, so 'we have nothing else' is a documented fact, not a guess.
The verdict
Hyrra walked in sure they were out of scope. In two minutes they found one feature they had to switch off today, one that needs a real compliance file, and two honesty fixes — plus one that's perfectly fine.
That startup was made up. Your AI isn't.
The same deterministic engine can classify your real systems in two minutes — no sign-up, no sales call. Or drop the read-only scanner into your codebase and see what it finds.
npx conformly-scan --dry-run
An example audit — a realistic walkthrough of how Conformly's deterministic engine classifies this kind of AI product. Not legal advice.