Ishavi
Legal2026
EU AI Act roadmap

High-risk in the right way.

Ishavi is a High-Risk AI System under EU AI Act Annex III(4) (employment). We treat that classification as the starting point of a compliance plan, not as something to litigate. The Deployer Pack below is the working set of templates we hand a Customer at signing so the deployment clears the works council and the supervisory authority on day one.

EU Deployer Pack

Four templates we deliver at signing.

The Pack is held in our private repository and customised for the Customer's jurisdiction, job families, and works-council set-up. The summaries below describe each template's scope and the statute it tracks.

  1. 01 -- Fundamental Rights Impact Assessment (FRIA)

    EU AI Act Art. 27

    The deployer-side template the Customer fills in (with Ishavi's support) before bringing the Services online in the EU. Surfaces affected fundamental rights, mitigations, and the annual review cycle.

  2. 02 -- Annex IV Technical Documentation

    EU AI Act Annex IV

    Provider-side technical documentation Ishavi maintains for the High-Risk AI System: pipeline architecture, training/validation/testing data posture, risk management system, QA, cybersecurity. Furnished to the deployer + supervisory authority on demand.

  3. 03 -- Art. 26(6) Recruiter Training

    EU AI Act Art. 26(6)

    Mandatory training program for every recruiter / hiring manager / Compliance Officer who reviews scorecards in the EU deployment. Curriculum + assessment + annual refresher cadence.

  4. 04 -- BetrVG / CSE Works-Council Notice

    BetrVG §87(1)6, §90; Code du travail L. 2312-37

    Cover letter + seven annexes the Customer sends to the German Betriebsrat or the French Comite Social et Economique before deploying Ishavi to a workforce in scope. Triggers the consultation window required by national co-determination law.

Art. 5(1)(f)

What we turn off in the EU.

EU AI Act Art. 5(1)(f) prohibits emotion inference and biometric categorisation in workplace contexts. The platform enforces this at code-time, not at policy-time: the relevant detectors are forcibly disabled when the tenant region is EU / UK or when the Candidate's jurisdiction is EU.

  • Face presence + multi-face detection -- disabled.
  • Identity-embedding drift -- disabled.
  • Virtual-camera detection (uses face landmarks) -- disabled.
  • Iris / gaze tracking -- never enabled in any region.
  • Voice-emotion analysis -- never enabled in any region.

The behavioural detectors (tab focus, paste, lag-loop timing, dev-tools heuristic, multi-display) remain enabled in the EU because they are not emotion or biometric signals.