Instructions for Use of the AI System (Deployer)

CONSOO S.R.L.S. — hice

Edition: English master (international)

Last updated: 3 July 2026

---

1. Purpose, addressees and legal framework

1.1 What these instructions are

This document contains the instructions for use of the artificial intelligence system for candidate ↔ opportunity matching integrated into the hice Service. They are provided by CONSOO S.R.L.S. («hice», the Provider) in its capacity as provider of the system, pursuant to Article 13 of Regulation (EU) 2024/1689 on artificial intelligence (hereinafter the «AI Act»), which requires the provider of a high-risk AI system to accompany it with clear, complete and comprehensible instructions for use for the deployer.

Candidate matching, being an AI system intended to be used for personnel selection and for decisions relating to the employment relationship, is classified as a «high-risk» AI system (Annex III to the AI Act, area of employment/personnel selection). For details on the classification and on the allocation of roles, reference is made to the AI Notice (§1.4 and §7).

1.2 Addressees — the Customer as «deployer»

These instructions are addressed to the Customer who uses candidate matching in the course of its own business to select personnel. In that capacity the Customer acts as:

• deployer of the high-risk AI system within the meaning of the AI Act;
• Data Controller of candidate data under the GDPR (Reg. EU 2016/679); and
• employer / decision-maker with respect to the selection process.

The Customer is required to read, understand and comply with these instructions and to make them available to the Users who actually operate the function.

1.3 Relationship with other documents

These instructions are complementary to, and must be read together with:

• the Notice on the Use of Artificial Intelligence and Algorithmic Transparency (informativa-ai-trasparenza.md), which describes in detail all the AI Features of the Service, how matching works and the allocation of provider/deployer roles;
• the General Terms of Service (condizioni-generali-servizio.md);
• the Privacy Notice (informativa-privacy.md), for the data of which hice is the Data Controller;
• the Data Processing Agreement — DPA (dpa-trattamento-dati.md), for the Customer Data of which hice is the Data Processor;
• the Customer Notice Templates (modelli-informative-cliente.md), which the Customer provides to its own data subjects (primarily candidates);
• the Acceptable Use Policy (politica-uso-accettabile.md).

Capitalised terms have the meaning defined in the General Terms of Service and in the shared glossary (Service, Customer, User, Tenant, Customer Data, AI Features, Data Controller, Data Processor, Data Subject).

---

2. Purpose and limits of the system

2.1 What candidate matching does

Candidate ↔ opportunity matching produces a ranked list of candidates or consultants potentially relevant to an opportunity or position, or to a textual search. It is a supporting tool that helps the recruiter identify, within the data of its own Tenant, the profiles to consider and assess.

The ranking is produced by a deterministic comparison engine operating on normalised profiles: the score is calculated according to predefined criteria (for example, correspondence between skills, role, seniority level, area of availability) against the requirements of the opportunity. Upstream, on a basis that is not synchronous with the search, the profiles may be normalised/enriched (for example to standardise the names of skills and roles) also with the support of artificial intelligence models; this stage takes place only once per profile, in the background, and does not in itself determine any selection outcome. For the technical detail, reference is made to the AI Notice (§3.2).

2.2 What candidate matching does NOT do

The system is an aid to human decision-making. In particular, matching:

• does not make decisions about the candidate and does not replace the assessment of the person in charge of selection;
• does not automatically select, discard or exclude any candidate;
• does not express a definitive judgment of suitability or unsuitability: the order and the score are merely an indication of relevance to the criteria set;
• does not detect the reliability, honesty or personal characteristics of the candidate that cannot be inferred from structured profile data.

The decision on interviews, advancements in the process, exclusions or hirings always remains entirely with a person (the Customer's User).

---

3. Human oversight obligation

3.1 Effective human oversight

The Customer, as deployer, must assign oversight of the system to competent natural persons, vested with the authority, training and information necessary to understand how it works and its limits. Oversight must be effective and substantial, not merely formal: the person in charge must be able to interpret the output correctly, not to rely uncritically on it and to disregard, override or reverse the proposed ranking where professional judgment so requires.

In practice, before adopting any decision affecting a candidate, a person must examine the profiles on the merits (curriculum, experience, interview notes and any other relevant information) and not merely accept the order returned by the system.

3.2 Prohibition of automated selection decisions

It is prohibited to use candidate matching to make selection decisions based solely on automated processing, lacking meaningful human intervention, which produce legal effects or similarly significantly affect candidates (Art. 22(1) GDPR). Such prohibition includes, by way of example, the automatic discarding of profiles below a certain score threshold, the automatic advancement of profiles at the top of the ranking, or any other form of filtering or selection that does not involve a case-by-case human assessment.

The system is designed as a non-decisional aid; the Customer must not configure or operate its own process in such a way as to turn it, in fact, into an automated decision. The right of the Data Subject remains unaffected, where a processing operation nonetheless amounts to an automated decision within the meaning of Art. 22 GDPR, to obtain human intervention, to express their point of view and to contest the decision, to be exercised vis-à-vis the Data Controller (the Customer); see the AI Notice (§6) and §7 of these instructions.

---

4. Obligation to inform candidates

The Customer, as Data Controller and employer/decision-maker, is required to inform candidates and, where relevant, workers of the use of automated tools in the selection and assessment process, transparently and before the processing begins. The notice must indicate, in particular, the existence of the automated aid, its purposes, the logic involved in general terms and the fact that the final decision rests with a person.

This obligation derives both from the GDPR (Articles 13–14 and, where applicable, Article 22) and from the transparency obligations of the AI Act towards the persons affected by the use of the system. To facilitate compliance, hice makes available the Customer Notice Templates (modelli-informative-cliente.md), which the Customer must adapt to its own organisation, supplement with its own Data Controller details and submit to legal review before use. The adoption of such templates does not relieve the Customer of its responsibility to ensure the accuracy and completeness of the information provided.

---

5. Accuracy, limits and interpretation of the score

5.1 Possible errors and bias

Like any automated tool, candidate matching may produce inaccurate or unrepresentative results. In particular:

• the order and the score depend on the quality and completeness of the input data: incomplete, outdated or inconsistently entered profiles may produce a misleading ranking (a good profile may appear of little relevance simply because its data are incomplete);
• the upstream normalisation/enrichment stage (§2.1) may introduce interpretation errors (for example in standardising the names of skills);
• like any system that ranks people on the basis of past data, the risk of disparity or bias cannot be excluded (for example with respect to non-linear career paths, different linguistic formulations or groups underrepresented in the data). The Customer must remain vigilant with respect to potentially discriminatory outcomes and correct them through human assessment.

hice provides the system «as is» and, to the extent permitted by law, does not warrant the accuracy, completeness or fitness of the ranking for a specific purpose (cf. AI Notice §7 and General Terms of Service).

5.2 Recommended input data

To obtain more reliable results and reduce the risk of distorted outcomes, the Customer is invited to:

• keep candidate/consultant profiles complete and up to date (skills, seniority level, years of experience, languages, area of availability, education);
• enter interview notes accurately, as they may feed the profiles used by the engine;
• complete opportunities with a clear and relevant title, description and requirements, avoiding improper criteria or criteria unrelated to the position;
• avoid entering unnecessary data or special categories of data not relevant to the professional assessment (data minimisation principle).

5.3 How to interpret the score

The score and the order express an estimate of relevance to the criteria set, not a ranking of the value of the persons nor a prediction of performance. A high score means only that the profile matches the search criteria; a low score does not amount to a judgment of unsuitability. The ranking is to be used as a starting point to guide the search and reduce screening time, not as the outcome of the selection. Where scores are equal or close, and in any event before any decision, human assessment must prevail.

---

6. Log retention and traceability on the Customer side

6.1 Automatic logging within the Service

The Service automatically records relevant events (audit log) for security, verification and traceability purposes, as described in the AI Notice and in the technical documentation. Such logging contributes to the traceability of the operation of the system.

To be completed. The extent, format and retention period of the automatic logs compliant with the requirements of the AI Act for the high-risk system are being implemented/defined (cf. AI Notice §10.5 and _foundation.md §8). Operational guidance to the Customer on accessing and extracting the logs will be added upon completion.

6.2 Traceability of decisions by the Customer

Irrespective of the system logs, the Customer, as deployer and Data Controller, is required to document its own decision-making process so as to be able to demonstrate the effectiveness of human oversight. In particular, it is recommended to:

• keep evidence that each decision concerning a candidate was made by a person, on the basis of an assessment on the merits and not on the score alone;
• retain for an adequate period the logs and information made available by the system during the period of use, within the limits set by applicable law and consistently with the retention periods for candidate data (cf. the Customer's retention policies and the DPA);
• ensure the confidentiality and integrity of such documentation, processing it in compliance with the GDPR.

The functions for the retention and deletion of candidate data follow the settings of the Service and the Customer's choices; for the rules governing the processing, reference is made to the DPA.

---

7. Responsibilities of the deployer and of the provider

7.1 Responsibilities of the Customer (deployer)

The Customer is responsible, among other things, for:

• using the system in accordance with these instructions and with applicable law, including labour and non-discrimination law;
• ensuring effective human oversight and the prohibition of automated decisions (§3);
• informing candidates of the use of automated tools (§4);
• ensuring the quality and lawfulness of the input data, having the legal basis and the consents necessary for the data of candidates and third parties (cf. _foundation.md §4.5 and the DPA);
• monitoring the operation of the system during use, monitoring its outcomes and reporting to hice (info@hice.ai) any risks, anomalies, malfunctions or serious incidents of which it becomes aware;
• ensuring local compliance: for editions or uses outside the European Union / Italy, compliance with local mandatory rules remains the responsibility of the Customer, who must verify their applicability with a local lawyer (cf. _foundation.md §4.1 and §9);
• ensuring an adequate level of AI literacy of the staff operating the system (Article 4 AI Act), so that they understand how it works and its limits.

7.2 Responsibilities of the Provider (hice, provider)

hice, as provider of the high-risk AI system, is responsible, among other things, for: designing matching as a non-decisional aid with human oversight; establishing and maintaining a risk management system; applying appropriate data governance and quality practices; preparing and updating the technical documentation; ensuring the automatic logging of events; providing transparency and these instructions for use; ensuring adequate levels of accuracy, robustness and cybersecurity. The detail of the provider's obligations is described in the AI Notice (§10.3); the implementation status of the technical obligations is indicated in the AI Notice (§10.5).

7.3 Limitations of liability

The provision of the system and of the AI Features is subject to the warranties, exclusions and limitations of liability set out in the General Terms of Service (condizioni-generali-servizio.md) and referred to in the AI Notice (§7.5), within the mandatory limits of law (the cases of wilful misconduct and gross negligence, personal injury and whatever cannot be excluded by law remain unaffected). The allocation of responsibilities in matters of data protection follows Article 82 GDPR and the DPA. hice is not liable for the consequences arising from a use of the system not in accordance with these instructions, from the absence of human oversight or from the entry of inaccurate, unlawful or irrelevant data by the Customer.

---

8. Contacts

For questions on the use of the system, for reports of malfunctions or risks and for any information relating to these instructions, write to info@hice.ai.