Compliance process

Your company

• Create a business account and conclude the AVV
• Review the technical and organisational measures and the sub-processors
• Add the processing to your record of processing activities

Mirage

• AVV with Annex 1 (measures) and Annex 2 (sub-processors)
• A signed copy on request
• Notice of any change to sub-processors 30 days in advance

Your company

• Determine the legal basis; for the application process, Art. 6(1)(b) GDPR is usually relevant, and for the AI-assisted step, depending on its design, also point (f) with a documented balancing of interests
• Extend your privacy notice for applicants: purpose of the AI interview, types of data, Mirage as processor, third-country transfers, retention period and the fact that a person decides
• Agree the steps with your data protection officer

Mirage

• A description of the processing and data flows as the basis for your notice
• The list of sub-processors, including AI model providers

Your company

• Check whether an impact assessment is required and carry it out before the first interview
• Document risks and mitigating measures

Mirage

• A description of the AI system: purpose, how it works, human oversight and limitations
• Technical and organisational measures (Annex 1 to the AVV)
• Answers to your questions about the processing

Your company

• Check co-determination rights, in particular § 87(1) no. 6 BetrVG and, for personnel questionnaires and selection guidelines, §§ 94 and 95 BetrVG, including where they are created with AI (§ 95(2a) BetrVG)
• Inform the works council about the planned use of AI (§ 90(1) no. 3 BetrVG); it may call in an expert to assess it (§ 80(3) BetrVG)
• With Mirage Office, co-determination applies in particular to feedback, pulse surveys and performance reviews
• Conclude a works agreement where needed

Mirage

• Information for the works council: how Mirage works, types of data, access rights and analyses
• The assurance that Mirage does not recognise emotions and never moves an application on its own

Your company

• Take measures so that the people who work with Mirage have sufficient AI literacy (Art. 4)
• Use Mirage in line with our instructions and assign human oversight to trained people (Art. 26)
• Inform employee representatives and affected employees before use in the workplace, and inform applicants about the use (Art. 26)

Mirage

• A notice for applicants before every interview: that they are speaking with an AI, what is recorded and how the result is used
• Scores backed by quotes, an override and reports labelled as AI-assisted assessments
• A decision journal that keeps decisions traceable
• Mirage is the provider of the AI system; we are preparing the conformity assessment for high-risk systems, and our compliance page shows the current status

Your company

• Point applicants to the AI interview and your privacy notice in the invitation
• Offer a conversation without AI on request; we expressly recommend this

Mirage

• Invitation, the notice before the start and the structured interview in German or English
• A report with scores from 0 to 10, supporting quotes and a recommendation

Your company

• Review the evidence, override scores where needed and make the decision
• Answer applicants' requests about their data
• Set a retention period and have data deleted after the process ends, taking into account the deadlines for claims under the AGG

Mirage

• Retrieval of report and transcript
• Support with access, rectification and erasure under the AVV
• Deletion on your instruction