SelectWiser — AI Governance and CMA positioning

1. Purpose and scope

This document describes how SelectWiser uses AI within the application process, what role AI does and does not have, and which safeguards are built in to comply with the GDPR and the EU AI Act.

The document is intended for customers, supervisory authorities and auditors.

Background

This document shows that SelectWiser thought about responsible AI use in advance, and did not react to regulation after the fact but built safeguards in proactively.

2. What SelectWiser does and does not do with AI

What SelectWiser does

• Analyses textual documents (CV, cover letter, vacancy text)
• Generates:
  • A technical match score
  • Contextual Match Analysis (CMA)
• Provides signals and points of attention to support human assessment

What SelectWiser does not do

• Takes no automated decisions
• Does not reject candidates on its own
• Measures no personality, intelligence, emotions or mental characteristics
• Makes no predictions about behaviour, performance or character
• Uses no data for model training

Core principle: SelectWiser is a decision-support system, not a decision-making system.

3. Definition of CMA (legally precise)

Definition:

Contextual Match Analysis (CMA) is a textual analysis of the candidate's cover letter and writing (structure, specificity, relevance and fit with the role's requirements) in relation to the context of the role, based on the CV, cover letter and vacancy text.

CMA makes no statements about personality traits or mental characteristics.

Explicit limitations:

• CMA is not a psychological test
• CMA is not a personality measurement
• CMA is contextual and indicative
• CMA is based solely on textual content and explicit role requirements

Why this matters

This positioning makes clear that SelectWiser performs no psychometric or personality measurement, and limits the use of AI to textual, contextual support within the application process.

4. Roles and responsibilities

Roles under the GDPR

In most customer relationships the customer acts as controller for applicant data. SelectWiser processes that data as a processor on the customer's behalf and solely on documented instructions (Article 28 GDPR).

For limited data (such as account management, invoicing and security logs) SelectWiser may be an independent controller. Those processing activities are described in our privacy statement.

The organisation's responsibilities

The organisation using SelectWiser is responsible for:

• The final assessment of candidates
• Taking decisions (inviting, rejecting, hiring)
• Giving candidates reasons for rejections
• Compliance with employment law and the GDPR
• Careful and non-discriminatory application of the analysis
• Providing "meaningful information" about the logic involved and the expected consequences where automated processing plays a part

SelectWiser facilitates this process technically but takes no decisions. SelectWiser is a SaaS platform providing technical support; legal responsibility for the recruitment process rests with the organisation using the platform.

5. Human intervention (demonstrable)

SelectWiser ensures that decisions about candidates always require human action:

• Substantive rejections require demonstrable human review of the candidate's documents (CV, cover letter) or of the analysis before a rejection can be recorded
• Rejections are always recorded with a human reason (rejectionReasonCode and rejectionReasonNote)
• The system records moments of review (cvViewedAt, motivationViewedAt, analysisViewedAt) before substantive rejections
• An audit trail records who took a decision, when, and on the basis of what information

Principle:

SelectWiser ensures that substantive rejections take place only after demonstrable human review of the candidate's documents or of the analysis.

This prevents fully automated decision-making and provides defensible human intervention in line with Article 22 GDPR and the EU AI Act.

On the basis of the analysis, organisations can give candidates a substantive explanation on request.

6. Profiling and human assessment

SelectWiser can generate scores, signals and summaries on the basis of textual application documents. This may qualify as profiling. SelectWiser is designed to prevent candidates being subjected to a solely automated decision that significantly affects them (Article 22 GDPR).

For that reason SelectWiser requires demonstrable human assessment before a substantive rejection (review of the documents and/or the analysis), and records the grounds on which the decision was taken.

The customer remains responsible for providing "meaningful information" about the logic involved and the expected consequences where automated processing plays a part.

7. Special categories of personal data and data minimisation

Application documents may contain special categories of personal data, including unintentionally (for example health, religion, ethnicity). Processing such data is prohibited in principle unless a statutory exemption applies (Article 9 GDPR).

SelectWiser takes data minimisation as its starting point (Article 5(1)(c) GDPR) and advises customers not to request such information and not to weigh it. SelectWiser takes measures to prevent special categories of personal data being used or repeated in the output, including (i) explicit instructions to the AI model to ignore such information and not mention it, and (ii) post-processing checks on the generated output.

8. External AI service provider and security

Where AI analysis is used, SelectWiser may process data through an external service provider. For this SelectWiser enters into appropriate contractual arrangements (a data processing agreement and sub-processor terms) under Article 28 GDPR and takes appropriate technical and organisational security measures under Article 32 GDPR (including encryption, access management and periodic effectiveness testing).

SelectWiser also maintains procedures for periodically testing, assessing and evaluating its security measures.

Where processing (or support) results in a transfer outside the EEA, the conditions of Chapter V GDPR apply (including Article 44).

9. DPIA support

Given the context (job applications), a data protection impact assessment may be required, particularly where profiling forms the basis for decisions that materially affect candidates (Article 35(1) and (3)(a) GDPR). On request, SelectWiser provides customers with documentation on data flows, security measures and safeguards to facilitate a DPIA.

10. Legal basis and the choice for AI analysis

The customer determines the legal basis for processing applicant data (Article 6 GDPR) and provides candidates with the required information (Articles 12 and 13/14 GDPR).

AI analysis is optional

SelectWiser supports an optional AI analysis function. The customer can offer candidates a choice, or the ability to object, regarding the use of AI analysis. Declining AI analysis must not disadvantage the ability to apply or the further handling of the application.

Where a customer chooses to base AI analysis on "consent", that consent must be freely given and must not be a condition for processing that is not necessary.

Where the customer bases the use of AI wholly or partly on legitimate interest, the right to object must be communicated to candidates explicitly and clearly (Article 21 GDPR, including paragraph 4).

Technical implementation

• Data is processed through an external AI service provider via a secure enterprise API environment
• Data is not used for model training
• Analysis takes place through encrypted API calls
• Data is not stored permanently at the AI provider
• Organisations pay only for AI analyses the candidate has explicitly opted into

11. Bias and non-discrimination

SelectWiser includes explicit instructions prohibiting the AI model from making assumptions about protected characteristics such as:

• Age
• Sex and gender identity
• Origin and ethnicity
• Health and disability
• Religion and belief
• Sexual orientation
• Political opinion

Guardrails:

• The AI model may not use proxies for the characteristics above (for example language use ≠ intelligence, word choice ≠ level of education)
• The analysis is limited to textual content and explicit role requirements (tasks, skills, experience)
• No conclusions about personality or psychological characteristics
• A focus on clarity, specificity, relevance and textual fit with the context of the role

Responsibility:

The organisation remains responsible for careful and non-discriminatory application of the analysis. SelectWiser can give no guarantees about outcomes and is an aid, not a replacement for professional assessment. Despite these safeguards, SelectWiser cannot guarantee absolutely that analyses are entirely free of bias; human assessment is therefore always decisive.

12. Limitations and responsibilities

SelectWiser's limitations:

• SelectWiser can give no guarantees about the outcomes of analyses
• SelectWiser is an aid, not a replacement for professional assessment
• The organisation remains responsible for compliance with employment law and the GDPR
• SelectWiser is not responsible for individual recruitment decisions taken by organisations on the basis of the analysis

The organisation's responsibilities:

• Careful interpretation of analysis outcomes
• Human assessment of every candidate
• Transparent and non-discriminatory recruitment processes
• Correct application of legal bases for data processing
• Giving candidates reasons for rejections

13. Version and maintenance

Document version: 1.1
Last updated: September 15, 2026
Owner: SelectWiser — Product and Compliance
Contact: compliance@selectwiser.com

Changelog:

• v1.1 (09/15/2026): Legal refinement: section 7 (special categories of personal data) aligned with the implementation (instructions plus post-check), section 8 (Article 32 testing and evaluation), section 10 (Article 21(4) right to object)
• v1.0 (22-12-2025): Initial version, CMA positioning, AI governance framework

This document is reviewed regularly so that it continues to meet current laws and regulations and best practice for responsible AI use.