A questionnaire about your process. A risk score you can defend. A report that stays current.
No personal data about the people your tool decides on ever enters the system — only questions about how it actually works. Below, we walk through it using CV screening as the example, since recruitment is where the product is live first, but the same three steps apply to any automated decision tool. That's a deliberate design choice: it keeps your own compliance obligations lighter, and it's what makes the assessment possible without becoming another system you have to secure. Most customers start this the same way: a client's supplier or tender questionnaire has just asked how they use AI in decisions, and they need a real answer within days, not months.
Tell us about your process
The questionnaire branches based on your answers, in the style of a guided tax return rather than a static form. It asks the questions that actually determine your legal position — not just "is a human involved?", but whether that human can change the outcome before it takes effect, whether they review every case or just a sample, and whether they have the time, training, and access to the underlying inputs to genuinely challenge what the tool produced. That distinction is now written into the statute itself, not just ICO guidance, so getting it right matters more than it used to.
| Yes — every case, before the decision is applied |
| Yes, but only on request or complaint |
| No — review happens after the outcome is already applied |
| Not sure |
| Finding | Status |
|---|---|
| Meaningful human involvement not evidenced | Enacted — Art 22A |
| Article 22C contestation route missing | Enacted — Art 22C |
| Decision-specific transparency notice | Draft guidance |
| DPIA not yet completed | Enacted — Art 35 |
Get a risk-scored assessment across two exposures
Findings are always labelled — enacted law, ICO draft guidance, or good-practice recommendation — so you always know exactly how settled a given point is. Draft guidance drives the score at full weight, because we take a conservative view of what's coming, but it's never described in the report as a breach of law. Discrimination exposure under the Equality Act 2010 is scored entirely separately, with its own escalation triggers, because it runs through the employment tribunal with uncapped compensation — a different forum, a different risk, never averaged into one number.
Download a defensible report — and stay current automatically
Every report is generated against a specific, dated version of the underlying legal schema. That version is never edited after the fact: if the ICO's final guidance changes something, you get a new assessment against the new rules, and the old report still stands as accurate for the date it was issued. On the annual plan, we tell you the moment a material change affects a finding in your existing report, and reassessment is included.
| Overdue — contestation route, assigned to DPO | Due 14 days ago |
| Law change — ICO ADM guidance finalised | Review |
| Re-assessment due — last run 13 months ago | Snooze |
| Training refresher — 2 modules | Review |
Then keep it current, because a report on its own goes stale
A finding you never fixed is worth nothing at an inspection, so every recommendation becomes a tracked item you can assign to a named person with a due date — and one that's still open past its date escalates to the account owner rather than sitting quietly. Alongside it: automated monitoring of the legislation this product cites, a plain-English feed of UK regulator activity on automated decisions, staff training with certificates and refreshers, and a compliance trend so you can show the direction of travel rather than a single snapshot. This is the part a one-off PDF can't do, and the reason most customers end up on a subscription.