AI Transparency Notice

How Skeeled uses Artificial Intelligence in its recruitment platform
Last update: August 2026

Skeeled provides a recruitment platform. Some features of the platform use Artificial Intelligence (AI) to help recruiters work more efficiently. This notice explains, in clear and general terms, how AI is used within the platform, the principles that govern that use, and the safeguards in place. It is published as a public, standalone document and is referenced from Skeeled's Privacy Policy. Detailed descriptions of each AI feature are set out in the annexes and updated as features evolve.

AI Transparency Framework

1. Purpose and scope

This notice describes how Skeeled uses AI across its platform. It is written at the level of our approach and the technology we rely on, rather than as a list of every product feature.

• It is intended for Skeeled's clients and their recruiters (administrator users).
• It is published publicly as a standalone document and is linked from the Privacy Policy.
• It is structured as a general framework completed by annexes. Each annex describes a specific AI feature, its purpose, the data it uses, and the safeguards that apply.
• New AI features are documented in new annexes, each subject to its own assessment.

This notice supports Skeeled's transparency obligations under Article 50 of the AI Act (Regulation (EU) 2024/1689) and Articles 12 to 14 of the GDPR (Regulation (EU) 2016/679).

2. Our approach to AI

• Human oversight: hiring decisions remain fully human driven. AI features assist recruiters, they do not decide.
• Augmentation, not automation of decisions: AI supports organisation and efficiency, it does not replace recruiter judgement.
• Data minimisation: AI features use only data already present in the platform. No additional datasets are collected for these features.
• Transparency: outputs generated by AI are clearly identified to users.
• Client control: clients can enable or disable AI features at organisation level and adjust their configuration.
• Fairness: AI features are designed as organisational aids and are not used to automatically exclude candidates.
• European processing: processing is carried out within the European Union and data is not used to train providers' models (see Section 7, provisional pending review).

3. How AI is used in the platform

Some platform features rely on generative AI (large language models) to assist recruiters with organisational tasks, such as structuring and describing information already contained in candidate files.

These features are designed to make recruiters more efficient. They do not make, automate, or replace hiring decisions. The features currently in scope, and any planned features, are described in the annexes.

4. Categories of data processed

• Candidate profile details already present in the platform.
• CV content provided by the candidate.

No additional personal data is collected for the purpose of these AI features. The data flows, processing locations, retention periods and applicable safeguards have been assessed as part of a Data Protection Impact Assessment (DPIA) and are implemented in accordance with the identified technical and organisational measures.

5. Human control and safeguards

• Visual distinction: outputs generated by AI are visually distinguished from information entered by humans.
• Reviewability and removability: users can review, modify, or remove AI generated outputs.
• Activity logging: AI activity is logged to support traceability and oversight.
• Organisation level control: clients can enable or disable AI features for their whole organisation.
• Accountability: recruiters retain full responsibility for all recruitment decisions.

6. Limits of the system

• Skeeled's AI features do not make automated hiring decisions.
• They do not autonomously select, reject, shortlist, or move candidates between recruitment stages.
• AI-generated outputs may occasionally contain inaccuracies. Users are expected to review AI-generated results before relying on them.
• The functionality performs a preparatory organisational task and does not replace or materially influence the outcome of recruitment decisions.
• They do not produce solely automated decisions that produce legal effects concerning candidates, or similarly significantly affect them, within the meaning of Article 22 of the GDPR.

Any feature that would go beyond these limits, for example scoring or ranking, is treated as a separate feature subject to its own assessment before release (see Annex B).

7. AI providers and data processing (provisional)

AI features are powered by large language models from the Google Gemini family, accessed through Skeeled's AI provider (Requesty.ai). Based on the completed Data Protection Impact Assessment (DPIA) and the review of the AI provider, the following safeguards apply:

• processing takes place within the European Union;
• no candidate or client data is retained by the AI provider after processing;
• no candidate or client data is used to train the AI provider's models.

These safeguards are supported by the technical and organisational measures implemented by the provider and are subject to ongoing review as part of Skeeled's governance and compliance processes.

8. Legal framework

• AI Act (Regulation (EU) 2024/1689): Skeeled designs its AI features in line with the transparency expectations of the AI Act, in particular Article 50.
• GDPR (Regulation (EU) 2016/679): personal data is processed in accordance with the GDPR, including the information duties under Articles 12 to 14.
• Article 22 of the GDPR: Skeeled's AI features in scope do not constitute solely automated decision making producing legal or similarly significant effects on candidates.

In Luxembourg, the competent supervisory authority for data protection is the Commission nationale pour la protection des données (CNPD). The controller for candidate data is generally Skeeled's client (the employer); this allocation of roles is to be confirmed.

9. Technical overview

Skeeled's AI features are built around the requirements set out in Section 7, which guided the choice of architecture and provider from the outset: European processing, no data retention by providers, and no use of data for model training, combined with full human control (Section 5).

Architecture

The features rely on three layers, each operating within the European Union:

• The Skeeled platform, where all candidate and client data resides, hosted in the European Union and covered by Skeeled's documented backup and retention procedures.
• An AI gateway (Requesty.ai, see Section 7), hosted in Frankfurt, Germany, acting as a single, contractually governed point of access to the models. The gateway was selected after a comparative evaluation of several providers, based on its data protection guarantees.
• Large language models from the Google Gemini family, served through enterprise model-serving infrastructure located in the European Union.

Request lifecycle

Every AI request follows the same controlled sequence:

• A user explicitly triggers an AI action; no AI processing runs autonomously or in the background.
• The platform assembles only the data needed for that action and the candidate(s) concerned (for example, the candidate profile and the documents in the candidate file). Documents marked as temporary are excluded from AI processing.
• The request is transmitted over an encrypted, authenticated connection to the gateway, then to the model.
• The output is returned to the platform and stored in Skeeled's existing databases, where it is covered by the same safeguards as all other platform data, including encryption, retention limits, and the candidate's right to erasure.
• Under the provider's zero data retention commitment, no data is stored, logged, or cached by the provider after the request is processed.

AI features create no new repository of personal data. Skeeled does not train, fine-tune, or operate its own AI models and maintains no training datasets; the use of candidate or client data for model training by providers is contractually excluded.

Security

In addition to the human control measures described in Section 5, communications with the AI provider are encrypted in transit and authenticated, using industry-standard interfaces, with credentials managed as secrets.

The gateway provider documents the following measures, which form part of Skeeled's vendor review:

• SOC 2 Type II certification, independently audited, with security measures aligned with ISO 27001 principles;
• hosting on European infrastructure with network segregation, firewalls and DDoS protection;
• encryption in transit (TLS 1.3) and at rest (AES-256);
• access controls based on SSO, multi-factor authentication and least privilege roles;
• annual penetration testing and vulnerability assessments, continuous monitoring, and documented incident response procedures;
• a Data Processing Agreement governing the processing, including personal data breach notification obligations consistent with the GDPR.

Continuity of commitments

Skeeled does not tie its commitments to a specific model version. Any change of model or provider remains subject to the requirements set out in Section 7, and any new AI provider is treated as a new sub-processor, subject to the same assessment and to Skeeled's standard client notification process before taking effect.

The provider arrangements described in this section are subject to the ongoing DPIA and provider review (see Section 7).

10. Governance and future features

This notice is reviewed and updated as Skeeled's AI features evolve. Each new AI feature is documented in a dedicated annex and is subject to its own AI Act and data protection assessment before being made available.

Skeeled is planning a matching and ranking feature. Because such a feature would involve scoring and classification, it is expected to require a stricter compliance approach and will be subject to a separate assessment. It is described, for transparency, in Annex B, and is not currently active.

11. Contact

For any question regarding this notice or the use of AI in the platform: dpo@skeeled.com.

---

Annex A: Auto-tagging

A.1 Purpose

Auto-tagging helps recruiters organise and filter applications by applying descriptive tags to candidate files. It is an organisational aid, not an evaluation, scoring or ranking tool.

A.2 How it works

The feature maps candidate information already presents in the platform (profile details and CV content) against a tag list defined by the client.

It operates in two modes: individual mode (a single candidate) and bulk mode (several candidates at once).

It can suggest or apply tags drawn only from the company defined tag list. Examples of client defined tags include “English”, “relevant experience”, and may include tags indicating that a given criterion is not met.

A.3 Data used

Only candidate information already presents in the platform. No additional datasets are collected for this feature. Tags are descriptive and factual and do not express an assessment, recommendation or suitability judgement regarding a candidate.

A.4 What auto-tagging does not do

• It does not score candidates.
• It does not rank or order candidates. No graded ranking is produced.
• It does not recommend, reject, shortlist, or move candidates between recruitment stages.
• Tags are internal metadata used by recruiters and are not communicated to candidates.

A.5 Human oversight

• AI applied tags are visually distinguished from manually entered information.
• Tags can be modified or removed by the recruiter.
• Auto-tagging activity is logged.
• Clients can disable auto-tagging at organisation level.

A.6 Regulatory position

Auto-tagging functions as an organisational and indexing aid rather than a candidate evaluation system. It performs a preparatory and auxiliary task and does not materially influence the outcome of recruitment decisions, which remain fully human driven.

On this basis, Skeeled considers that auto-tagging does not fall within the high risk category of the AI Act, consistent with the exemption set out in Article 6(3) of Regulation (EU) 2024/1689. The tags constitute internal metadata and do not produce automated decisions within the meaning of Article 22 of the GDPR. This assessment is to be confirmed by the appointed DPO and legal counsel and refined in light of the DPIA.

---

Annex B: Matching and Ranking (planned feature)

B.1 Overview

Matching and ranking is a separate, planned feature. It is not currently active. When implemented, it will compare role requirements with candidate profiles and may produce scoring or classification outputs.