A hiring model built on someone else's foundation model
Aster Screening sells a candidate-ranking model to 12 enterprise employers in the EU. Its stack combines a third-party foundation-model API for embeddings and scoring, a fine-tune trained on 2.3 million historical CVs (60% supplied by customers under contract, 40% scraped from a job board in 2021), and an internal rules layer that produces the final ranking. The company holds SOC 2 Type II for its platform and publishes a STAR Level 1 CAIQ. Its ML lead completed the AI-CAIQ internally, answering 'Yes' throughout, on the basis that 'the model provider handles AI risk'. Model documentation exists for 2 of 7 models; there has been no drift monitoring and no bias testing since 2023; and no human reviews rankings before recruiters see them. Sales wants to advertise 'STAR for AI Level 2' to close a deal with a bank that treats the use case as high-risk.
1. What assurance can Aster legitimately claim today, and what is missing for STAR for AI Level 2?
Read the worked answer
Today Aster can claim: a published STAR Level 1 CAIQ for the platform (a CCM-based self-assessment, unverified), and a SOC 2 Type II report from its CPA firm. Neither says anything AI-specific.
The AI-CAIQ answers are not assurance. AI-CAIQ is the questionnaire form of the self-assessment; answering 'Yes' throughout without evidence, and on the argument that the model provider carries the risk, fails for the same reason a perfect CAIQ fails: it is unverified and visibly implausible. A model vendor supplies a component, not Aster's obligations around purpose, data, oversight and outcomes.
For STAR for AI Level 2 Aster needs an independent third-party assessment against the AICM, with the report published - the AI counterpart of the core STAR Level 2 structure, rather than a self-filled questionnaire. The AICM assessment sits on top of the CCM-based controls, so the existing SOC 2 and CAIQ work is useful groundwork, not a substitute: the AI-specific controls have no equivalent in the platform audit.
Bluntly: Aster holds zero independent assurance over the thing it sells. The ranking model, its training data and its monitoring are outside every assessment it has completed.
2. Which AICM areas are the largest gaps given the supply chain and data provenance facts? Justify each with the fact that drives it.
Read the worked answer
Four areas dominate, and each maps to a specific fact in the setup.
- Supply chain and third-party model risk (STA domain of the CCM extended into the AI context). The scoring component is an external API. Aster needs contractual notice of model changes and deprecations, version pinning, disclosure of the provider's own assurance, and a documented decision on what happens if the model is retired mid-contract. Without this, a silent provider update changes hiring outcomes for 12 employers.
- Data provenance and privacy (DSP and the AICM data controls). 40% of training data was scraped in 2021 with no recorded lawful basis, no consent trail and no retention rationale. This is a GDPR exposure before it is an AI-controls exposure, and it may force retraining. Customer-supplied CVs need purpose limitation - using them to improve a shared model is a different purpose from ranking.
- Model performance, bias and drift monitoring. Bias testing last performed in 2023 on a model set that has since changed, with no drift monitoring, means nobody can state current performance. For employment screening this is the single most likely source of harm.
- Human oversight and explainability. No human reviews rankings before recruiters act on them, and documentation covers 2 of 7 models. High-risk hiring decisions with no meaningful human intervention and no model documentation will not survive either the AICM assessment or EU AI Act scrutiny.
3. Sequence the next six months, including what sales may and may not say.
Read the worked answer
Months 1-2 - establish the truth. Freeze the marketing claim. Run an AICM gap assessment covering the ranking pipeline, the foundation-model dependency and the training-data lineage. In parallel, get a legal opinion on the scraped 2021 data; the likely answer is that the affected models are retrained on clean data, which changes the timeline.
Months 2-4 - remediate the four gaps. Provider contract amendments with change notice and version pinning; model cards for all 7 models; drift and bias monitoring with defined thresholds and an escalation path; a human-review step before rankings reach recruiters, with reviewers able to override and with the override logged; documented retention and purpose limitation for customer CVs.
Month 3 - publish accurately. Replace the all-Yes AI-CAIQ with a self-assessment that states the gaps and the remediation dates. This is the Level 1 position and it is defensible.
Months 4-6 - independent assessment. Engage an assessor for an AICM-based Level 2 assessment once remediation evidence exists; assessors want to see controls operating, not just designed.
What sales may say now: 'self-assessed against the AI-CAIQ, with an AICM-based independent assessment targeted for [quarter]'. What sales may not say: 'STAR for AI Level 2', or any 'Valid-AI-ted' claim, unless and until that separate evaluation has actually been completed - and no claim at all that AICM work constitutes EU AI Act conformity, which is a separate legal process.