Worked example
Northwind Logistics buys a CV-screening tool.
One fictional organization and one AI system, taken through all eight lifecycle stages, with the artifact produced at each step.
For reference purposes only. Not legal advice.
Fictional example Names, data and results are invented to show how the tools work.
Try it in the tools
Fictional example. Names, data and results are invented to show how the tools work. Loaded records are marked "Example".
Load the Northwind Logistics example into your workspace to open the register, controls, reports center and board report with real-looking data. You can remove the example data again at any time.
Add keeps what you have and adds the example. Replace overwrites your workspace; export a backup from the workspace page first if you might need it.
The setting
Northwind Logistics (fictional) has 2,000 staff and hires in Germany, Illinois, New York City and India. Recruiters are overwhelmed, so the head of talent, Priya, wants to buy TalentSift (fictional vendor tool) that ranks CVs and recommends who gets an interview. Nothing governs AI use at Northwind yet. The planner would send them to stage 1, with "decisions about people" as the top concern.
1. Set up governance
The COO becomes executive sponsor and names Marcus, a risk manager, as AI governance lead (the one accountable person). They write a two-page AI use policy, form a four-person governance group (HR, legal, security, data) that meets monthly, and agree a small RACI. Each row has exactly one Accountable.
| Activity | Exec sponsor | Governance lead | Product owner (HR) | Legal |
|---|---|---|---|---|
| Approve new AI use | I | A | R | C |
| Classify risk | I | A | R | C |
| Approve go-live (high-risk) | A | C | R | C |
| Incident response | I | A | R | C |
Artifacts: AI use policy, charter, RACI, "Everyone" training scheduled. Stage 1 page
2. Inventory and intake
Marcus asks every team what AI they use. HR also admits some recruiters paste CVs into a public chatbot (shadow AI), which becomes its own register entry and a reminder in the acceptable use policy. Priya submits TalentSift through intake.
- Use case
- Rank applicants for interview.
- Build or buy
- Buy (vendor: TalentSift).
- Decision impact
- Shapes decisions about people (recommends who is interviewed).
- Data
- Personal data (CVs). Regions: Germany, Illinois, New York City, India.
- Triage route
- Full review: decisions about people.
Artifacts: register entry (owner Priya, status Idea), intake record. Stage 2 page
3. Assess risk and impact
Marcus runs the EU screening check for TalentSift. The answers below are what the tool in this site computes:
| Question | Answer |
|---|---|
| Does it use manipulative techniques that cause harm, score people on their social behavior, infer emotions at work or school, or could it be used to generate intimate images of real people without consent or child sexual abuse material? | No |
| Does it make or shape decisions about people's jobs, credit, education, access to essential services, law enforcement, migration or justice? | Yes |
| Is it a safety component of a regulated product, such as a medical device, vehicle or machine? | No |
| Does it identify or categorize people using biometric data, or help run critical infrastructure? | No |
| Does it interact directly with people, or generate text, images, audio or video that people will see? | Yes |
Result: Possibly high-risk This may carry the heaviest duties. For stand-alone Annex III uses they apply from 2 December 2027, and for AI in regulated products from 2 August 2028. Start preparing now.
Next, the applicability rules for Northwind's regions (the planner and the phase 2 applicability checker use the same rules):
- EU EU AI Act: likely applies. You said the system is offered or its outputs are used in the EU.
- EU GDPR: likely applies. It processes personal data of people in the EU.
- US New York City Local Law 144: likely applies. It is used in hiring or promotion decisions in New York City.
- US Illinois HB 3773: likely applies. It is used in employment decisions about people in Illinois.
- US Existing federal laws (anti-discrimination, consumer protection, credit, health privacy): likely applies. Existing federal laws apply to AI just as to other tools.
- IN DPDP Act and Rules: likely applies. It processes digital personal data in India; duties phase in to 2027.
- IN India AI Governance Guidelines: may apply. National guidance for AI in India. Voluntary.
- Global NIST AI RMF and ISO/IEC 42001: voluntary. Optional frameworks to structure your program.
Confirm with counselNorthwind's lawyer reads this list against the primary sources. Several items (EU dates, the Colorado-style 2027 laws, India's phased dates) are not settled.
Because hiring is high-risk territory, the team also writes an impact assessment:
| Risk | Likelihood | Severity | Mitigation | Residual |
|---|---|---|---|---|
| Unequal selection across groups | Medium | High | Pre-launch bias test; monthly monitoring; human review of every rejection | Medium |
| Candidates not told AI is used | High | Medium | Notice in job ads and application form | Low |
| Recruiters rubber-stamp rankings | High | Medium | Reviewers see the CV, not just the score; override is one click | Low |
Artifacts: screening result, applicability record, impact assessment. Stage 3 page
4. Design controls and document
Controls are chosen for a high-risk, vendor-supplied system: named owner, impact assessment, bias and security testing, human oversight, transparency notice, logging, monitoring, incident plan, vendor due diligence and contract terms. Procurement sends a vendor questionnaire. Three answers worry Marcus:
- "Do you train on our data?" Answer: "to improve the service". Follow-up: get it in writing, and ask to opt out.
- "Can we see bias test results?" Answer: a summary only. Follow-up: ask for results by group, and plan Northwind's own test.
- "What logs do we get?" Answer: 30 days. Follow-up: ask for longer retention, or export logs.
The contract adds incident notice, change notice (model updates), audit rights, data return on exit and no training on Northwind data. A short system card records intended use ("rank for interview, never reject"), out-of-scope uses and known limits.
Artifacts: control plan, vendor file, contract clauses, system card. Stage 4 page
5. Test and validate
Before launch Northwind runs TalentSift on 700 past applicants (invented data below) and compares selection rates by group.
| Group | Applicants | Recommended | Selection rate | Impact ratio |
|---|---|---|---|---|
| Group A | 400 | 120 | 30.0% | 1.00 |
| Group B | 300 | 63 | 21.0% | 0.70 (below 0.8) |
Selection rate = recommended ÷ applicants. Impact ratio = a group's rate ÷ the highest group's rate.
Group B's ratio is below 0.8, a rule of thumb used in some US employment contexts, not a legal test everywhere, and statistical indicators alone do not prove or disprove discrimination. Northwind treats it as a red flag: it asks the vendor to investigate, finds the tool over-weights a feature that tracks career gaps, and the vendor fixes it. A re-test shows a ratio near 0.9. A security test also checks the tool cannot be tricked by hidden text in a CV (prompt injection).
Artifacts: test plan, bias report with limits stated, security test record. Stage 5 page
6. Approve and deploy
Because the system is full-review, the executive sponsor approves, on evidence. The record:
- Decision
- Approve with conditions.
- Conditions
- TalentSift recommends but never rejects; a recruiter reviews every rejection. Candidates are told in the job ad. Monthly bias check. Review in 6 months.
- Approver
- COO (executive sponsor). Prepared by Marcus.
HR publishes a plain notice ("we use software to help rank applications; a person makes the decision; contact us to ask for a review"). Recruiters are trained on what the score means and how to override it. The register status moves to Live. Region notes in the stage page (EU, Illinois, NYC notice and audit duties) become checklist items that counsel confirms.
Artifacts: approval record, candidate notice, oversight procedure, training record. Stage 6 page
7. Monitor and respond
The monitoring plan: selection rate by group each month (threshold: ratio under 0.8 triggers review), recruiter override rate, candidate complaints. In month four the ratio drifts to 0.76 after the vendor updates its model without telling Northwind.
- Detect: the monthly check flags it.
- Triage: severity S3 (limited harm, contained) because recruiters review rejections.
- Contain: the team switches off ranking, and CVs go to manual review.
- Assess and notify: Legal checks whether any notification duty might apply (confirm with counsel; none is assumed) and invokes the contract's change-notice clause.
- Fix: the vendor rolls back; Northwind re-tests before turning ranking on.
- Learn: add a clause requiring advance notice of model changes, and add a vendor-version check to monitoring.
Artifacts: monitoring log, incident record, post-incident review with actions. Stage 7 page
8. Review, report and retire
At six months Marcus reports to the board using the four-part pattern from the reporting lesson: a scoring summary with counts, drift findings, consequence-forward risks and a recommendation.
- Summary
- 3 AI systems on the register; 1 high-risk (TalentSift); 1 incident (S3, closed); readiness 60%.
- Drift finding
- Vendor changed the model without notice, moving the impact ratio from 0.90 to 0.76. Fixed after a rollback.
- Risk in plain words
- Without monitoring we would have kept rejecting a group at a higher rate, risking harm to candidates and legal exposure in hiring rules.
- Recommendation
- Continue, with the new change-notice clause and quarterly independent bias check. Decision needed: fund the check.
Two years later TalentSift is replaced. Northwind tells recruiters, exports and deletes candidate data it no longer needs (keeping what law and contract require), switches off access, marks the register entry Retired and holds a short review.
Artifacts: board report, review record, decommissioning record. Stage 8 page
What to take away
- One accountable person and a short policy came first. Everything else hung off them.
- The register and intake caught both the vendor tool and the shadow chatbot use.
- Risk work scaled to the risk: full review for hiring, light touch for low-risk tools.
- Testing before launch found a problem, and monitoring after launch found another. Both were needed.
- Contract terms (change notice, data use, logs) made the fix possible.
- Every step produced a record that could be shown to a board, a customer or a regulator.
For reference purposes only. Not legal advice. Fictional example: names, data and results are invented to show how the tools work. You can load the matching workspace above.
Was this page useful? Tell us what is missing or wrong ↗ · Report a correction