There is a fair question to ask any consultancy that sells AI: do they use it themselves, or do they only sell it. We would rather answer that in the open than be asked it across a table. So here is the work, starting with the part these articles usually skip, which is what makes it difficult.
The plan, in two pictures
Everything below explains the build in words. But the shape of it fits in two pictures, so here they are first. If you only take two things from this page, take these.
Where we are
- Live now Recruitment delivery candidates found, CVs read and tracked
- Live now Market intelligence the published build maps
- Live now This website you are reading it
- In build Finance and accounting invoices, ledgers, reconciliation
- In build Compliance and data protection retention clocks, records, access requests
Where it goes next
- To come Client engagement briefs, shortlists, progress updates
- To come Project controls services cost, schedule and reporting support
- To come Marketing and content campaigns, publishing, outreach
- To come Internal operations the plumbing of the company
- The pattern Whatever comes next same core, same boundary, less effort each time
Live now In build Still to come
Most of the map is pale today, on purpose. We are at the start, and we would rather show that than dress it up. The pattern is the point: each area plugs into the same core when it is ready, and every one is easier than the one before it.
The pale tiles are not the gap in the plan. They are the plan. Every one of them will plug into the same core, and that is exactly why the core has to come first, and why we are building it the hard way, inside the strictest data rules in the world, before anything else.
Hard once. Easy after.
- Every block is a business area from the map above. On its own, not one of them stands.
- The keystone is the AI-first core, cut to fit the strictest data rules in the world. Cutting it is the slow, careful part, and it is where we are now.
- A keystone is set once. After that the arch stands, and each new block simply rests on it. That is why recruitment and accounting go first, and why everything else on the map gets easier from here.
That is the whole bet. The keystone is the hard part, it is cut once and set once, and everything after it rests on a standing arch. The rest of this article is the detail: what the work looks like by hand, what the rules demand, and what we are building inside them.
How this work is normally done
Take accounting first, because everybody recognises it. The post and the inbox produce a steady pile of supplier invoices, receipts, card slips, expense claims and bank statements. Somebody opens each one, reads it, types it into the ledger, codes it to the right account, matches it against the bank line that paid for it and files it where an auditor can find it again. Then the whole thing is reconciled, and every item that does not agree is chased down on its own. It is careful, repetitive work, and at any real volume it takes a team.
Recruitment looks nothing like it and works in exactly the same way. CVs arrive in every format a person has ever invented: a tidy two-page document, a scan of a printout, a portfolio with the relevant project buried near the back. Somebody reads each one, works out what that person has actually done, rewrites it into the house template so that every candidate reaches the client in the same shape, records it, and then chases. The candidate, for the dates that are missing. The referee who has not replied. The client who has been sitting on a shortlist for a week.
None of that is mysterious, and it is the obvious place to point automation. Plenty of people already have.
The hard part is what the paper contains
This is not a set of construction drawings. A CV is a named human being: where they live, where they have worked, how long they have been doing it, and sometimes their health, their family or their right to work in a country if they have chosen to mention it. A ledger is the financial position of a company and of everybody it pays. Europe regulates both harder than almost anywhere on earth, and it has now added a second layer aimed specifically at AI. That is the core of it. Everything else is detail underneath.
What the rules actually require
Not a summary of the law, but the constraints that decide what can and cannot be built.
- Purpose limitation. Information handed over for one reason cannot quietly be used for another. A CV sent in for a role in Dublin is not a training set, and it is not a marketing list.
- Data minimisation. The system may hold the fields it genuinely needs and no more. Might be useful one day is not a lawful reason to keep something.
- Retention limits. Personal data cannot sit there indefinitely. It has to expire on a defined clock, and the deletion has to actually happen, in every copy, backups included.
- The rights of the person. A candidate can ask what is held about them, ask for it corrected, ask for a copy and ask for it erased. A system that cannot answer those questions quickly is a system that cannot lawfully hold the data in the first place.
- Decisions taken by machines. European law gives people the right not to be subject to a decision made purely by automated means where it significantly affects them. Whether somebody makes a shortlist is precisely that sort of decision.
- Where the processing happens. It matters which country the data rests in and which country the computer reading it sits in. Sending a CV to a service that processes it outside those protections is a transfer, with everything that follows from it.
- The EU AI Act. AI used in recruitment is regulated in its own right, as a high-risk use, with duties on transparency, record keeping and human oversight stacked on top of everything the privacy rules already demand. Those obligations arrive on a published timetable, so anything built now has to be built for them.
- Two clocks running in opposite directions. Accounting records have to be kept, provably unaltered, for years. Personal data has to be deleted on time. A system that touches both has to satisfy both, which is a design problem before it is a legal one.
- The tools themselves. A consumer AI assistant on a free tier is not an acceptable place to paste a CV or a bank statement. The terms usually let the provider keep what it is given, the processing location is not yours to choose, and there is no contract making anybody accountable to the person whose information it was.
Put those together and the honest summary is short. The quick version of this automation, the one where documents get pasted into whichever tool is fashionable this month, is not available to us. It would be faster. It would also be unlawful, and it would put other people's information somewhere we could not account for.
What we are building
So the build starts at the boundary and works inwards, rather than building something clever and asking a lawyer about it afterwards. Compliant by design is not a slogan here, it is the order the work is done in.
Candidate data stays in our own database, inside the European Union. It is not passed to third-party enrichment services to be topped up with whatever the internet believes about somebody, it is not sold on, and it is not used to train anybody's model. Retention is time limited, so records expire on a schedule instead of accumulating quietly for years. Accounting data is held to the same standard, because a colleague's payslip and a client's ledger deserve no less care than a candidate's CV.
What the automation does is the reading and the assembling. It takes documents in whatever shape they arrive, structures them, puts the relevant facts beside the question being asked, and presents a finished picture. It does not score people, it does not rank them and it does not reject anybody. It does not post to the ledger on its own authority. A person makes every decision, and the system is built to show its working so that the person can disagree with it.
Most of the effort has gone somewhere less interesting than that: teaching it to say when it is not sure. An automation that is right most of the time and quiet about the rest is worse than none at all, because it moves the work from doing to double-checking. Flagging the doubtful item is worth more than getting one more item right.
If we can achieve this with personal and financial data, the most regulated data there is, then a client's project data is straightforward by comparison.
That is the whole reason for doing it on ourselves first, and none of it is finished. Parts are running, parts are in test, and some of what we built we have already thrown away.
What it means if you are a client
The same rules travel with the work. Your data stays yours. It is processed where we say it is processed, and by whom. It is not fed into somebody else's model to improve somebody else's product. A named person is accountable for every decision the system supports, and the system is built to be inspected rather than trusted.
Regulation of this technology is tightening rather than loosening, and the direction of travel is clear enough to design for now. A tool that works today but cannot show where the data went, who decided what, or why a record still exists, is a problem waiting to be found. We would rather carry the cost of building inside the boundary while it is being built than rebuild it under pressure later.
We will keep publishing what happens next, including the parts that do not work.
Build something similar for your programme
Tell us the process you would automate first and we will tell you whether it is a good candidate, what the data would make difficult, and what it would take.