How Ready complies, one regulation at a time.

New York City Local Law 144, also known as the Automated Employment Decision Tools law, governs any tool that uses statistical methods to assist or replace discretionary decision-making in hiring decisions affecting NYC-resident candidates. It has been in effect since July 2023 and is the most active hiring AI rule in the United States.

Ready is designed to support the law's three core requirements. For each customer using the tool on NYC candidates, an independent third-party bias audit will be commissioned before the first NYC candidate is screened, and refreshed annually thereafter. The audit summary is posted at the deployer's careers site for the period the law requires. Candidates are notified in advance of the assessment; an opt-out or alternative is arranged with the employer on request, and no negative inference is applied to anyone who declines.

• Audit commitment. An independent third-party bias audit will be commissioned per customer before the first NYC candidate is screened, and refreshed annually.
• Public posting. Audit summary made available at the deployer's careers site for the legally required period from the date of completion.
• Candidate notice. Surfaced in advance of the assessment, in the form the law requires. The candidate sees who is reviewing them and how the result will be used.
• Opt-out. Arranged with the employer on request for any NYC candidate, with no negative inference applied to candidates who decline the AI assessment. A built-in in-product opt-out is on the roadmap.

The EU AI Act classifies AI systems used to analyse, filter, score, or otherwise evaluate job applications as high-risk under Annex III. As the provider of the tool, Ready takes on the provider obligations. The deployer (the employer) meets the deployer obligations, with documentation and support from Ready.

Human oversight, transparency to the candidate, and record-keeping and logging are live in the product today. Record-keeping, data governance procedures, the formal risk management file, accuracy and cybersecurity testing, post-market monitoring, conformity assessment, EU database registration, and CE marking are being completed per deployment ahead of the August 2026 enforcement date for high-risk systems. Documentation is made available to the deployer and to supervisory authorities when called for.

• Human oversight (live). Every score is advisory to a human reviewer, not a final decision. Article 14 oversight is reflected in the reviewer console: a person reads the evidence and decides.
• Transparency and logging (live). The candidate is told an AI scores the session and a human decides. Consent, attempts, and deletions are written to an audit log.
• Technical documentation (in progress). Data sources, methodology, and validation results compiled for the deployer ahead of conformity assessment.
• Risk management and monitoring (in progress). The formal risk file and post-market drift and impact-ratio monitoring are established per deployment, not yet running automatically in-product.

The General Data Protection Regulation governs how personal data of EU candidates is processed. Voice recordings, transcripts, and rubric scores are personal data. Ready's lawful basis is the candidate's explicit consent, paired with a documented data protection impact assessment that reflects the high-risk nature of recruitment AI.

Every candidate sees a consent screen before the simulation begins. The screen identifies the recording, the employer, the purpose, and the retention window. Consent is logged with the version of the notice the candidate accepted. The candidate chooses one of two retention options at the consent screen and can revoke the choice at any time. Article 22 obligations against solely automated decisions are met by the human-reviewer model that operates throughout the platform.

• Pre-session, versioned consent. Consent is logged with the version of the notice, the timestamp, and the IP. No silent recording. No retroactive changes.
• Candidate-chosen retention. Six months for this role only, or twelve months where the candidate chooses which partner companies may review them. Only the selected companies can see them, no other company can discover them, and the candidate can stop sharing at any time. The candidate picks and can revoke.
• Article 22 respected. No solely automated decision with legal or similarly significant effect on the candidate. A human reviewer is always in the loop.
• Access and erasure (self-service). Candidates download or delete their own data from the data and rights page. Deletion removes the record from the live store immediately; no separate backup copy is kept.

The UK GDPR governs how Ready handles candidate personal data inside the United Kingdom. The framework is substantially aligned with the EU GDPR, and Ready operates UK deployments to the same standard. The Information Commissioner's Office is the supervisory authority and has issued specific guidance on AI in employment.

ICO guidance is reflected in the deployment review. The same consent flow, the same retention options, and the same erasure rights that EU candidates receive are extended to UK candidates without modification. There is no regulatory arbitrage between markets, and there is no second-class UK product.

• Same standard as EU GDPR. UK candidate data is handled to the EU standard. No downgrade and no exception.
• ICO guidance reflected. Information Commissioner's Office guidance on AI in employment is built into the deployment review.
• Candidate-chosen retention. Six months for this role, or twelve months where the candidate chooses which partner companies may review them. Same terms as EU candidates.
• Access and erasure (self-service). The same self-service download and immediate deletion EU candidates get, with no separate backup copy kept.

The California Consumer Privacy Act applies to candidates who reside in California. Voice recordings, transcripts, and rubric scores are personal information under the law. Ready provides the required disclosures at the point of collection and honors the right to know, the right to delete, and the right to opt out of sale or sharing.

Candidate data is not sold. It is not shared for cross-context behavioral advertising. It is not used to train external models. The notice at collection identifies the categories of personal information, the purposes, and the retention period. The disclosures remain accessible in the candidate dashboard for the life of the record.

• Right to know. Categories of personal information, purposes, and retention disclosed at the point of collection.
• Right to delete. Self-service deletion from the data and rights page, removed from the live store immediately. No separate backup copy is kept.
• No sale, no sharing. Candidate data is not sold or shared for cross-context behavioral advertising.
• No external model training. Candidate audio and transcripts are not used to train external or third-party models.

The California Privacy Rights Act builds on the CCPA and adds specific provisions for automated decision-making, sensitive personal information, and the right to correct. The California Privacy Protection Agency finalised its automated decision-making regulations in March 2025; Ready's product behavior is aligned with them.

Ready surfaces the disclosures CPRA requires for automated decision-making, including a meaningful description of the logic involved and the significance of the outcome. The right to correct is honored alongside the right to delete. Sensitive personal information is limited to the disclosed purpose and is not put to any secondary use without separate, explicit consent.

• Automated decision-making disclosures. Surfaced at the consent screen, with a meaningful description of the logic involved and the significance of the outcome.
• Right to correct. Honored alongside the right to know and the right to delete. Candidates submit a correction request from the data and rights page, which a person reviews and responds to within thirty days.
• Sensitive information limited to purpose. No secondary use without separate, explicit consent.
• Aligned with the 2025 CPPA rules. The California Privacy Protection Agency's automated decision-making regulations are reflected in the product.