Level 5 · The framing — the employment overlay

§1 — One system, the employment overlay

Level 3 was your first overlay (health/MDR); Level 4 your second (finance/DORA). This is your third — employment — and it teaches a different shape of honesty. The system is high-risk for one reason: it is AI used to recruit, select, and screen job applicants, which is Annex III §4 (employment, workers’ management, access to self-employment). A model that decides who gets shortlisted gates a person’s access to work, which is exactly the harm Annex III §4 names.

The route matters because it is a third distinct trigger. Level 3 was high-risk because the system was a product (Art. 6(1) + Annex I, the medical-device route). Level 4 was high-risk because of the use it was put to (Annex III §5(b), creditworthiness). This one is high-risk for another use: employment screening (Annex III §4). Same Articles 9–15 spine, a different entry door.

What makes this level its own lesson is telling apart a defect that gets fixed from a limit that gets declared, and that all three controls in the program ride one set of tags:

• The defect — feature leakage — closes. The first version of the model is contaminated: it trains on a feature that leaks the answer. It is the program’s ONLY blocking control. A code change removes the feature and the control flips from RED to GREEN. This is a clean, real RED→GREEN by a code change — the ISO 23894 §6.5 treatment is a git diff — and because it is the only blocker, the overall gate closes GREEN.
• The limit — data-sample adequacy and selection fairness — measured, documented, non-blocking. The dataset is too small (n=215) to certify that the selection is fair or that the sample is adequate. No code change fixes that — the only real treatment is to acquire more data. Turning that finding into a blocking gate would manufacture a threshold the sample could never sustain reliably; the engine measures it, keeps it advisory (enforcement: audit), and carries it into the approval as a residual that leadership consciously accepts, with post-market monitoring.

One blocker, two advisory findings — and why they live on one set of tags

A single signed bundle carries the three controls. model-feature-leakage is the only blocker: V1 RED (the model uses salary), V2 GREEN (the pipeline drops it) — and because it is the only blocker, the overall gate closes GREEN at V2. Alongside it, two controls are MEASURED but ADVISORY: data-sample-adequacy (n/500 = 0.43, Campus Recruitment is capped at 215 rows) and selection-rate-disparity-gender (selection-rate parity by sex, citing Ley 15/2022 Art. 23, underpowered at n=215, ~24 women in test). Neither blocks the gate: they are genuinely measured, documented as a finding, and James consciously accepts them at approval, with quarterly post-market monitoring (Art.72). So across the beats the bundle goes from all-red (V1: leakage plus the already-measured findings) to GREEN with an advisory residual (V2) — the engine certifies what it can measure reliably and honestly documents what it cannot, without manufacturing either a permanent red or a certification the sample cannot support. That is the level.

§2 — Which laws apply (and what each one governs)

Be precise about scope — honesty cuts both ways. Note especially where the live obligation actually sits: not on the deferred AI Act high-risk gate date, but on national labour law + RGPD.

• EU AI Act — high-risk, via Annex III §4. Nerea declares tier: high via the classify-system portal mission, with the basis spelled out in froga.yaml: “EU AI Act Annex III §4 (employment / workers’ management / access to employment)”. That pulls the Articles 9–15 spine into scope. This is the employment route — neither Level 3’s Art. 6(1) product route nor Level 4’s §5(b) credit route.
• RGPD (GDPR) Art. 22 — automated decision about a person. Screening that effectively decides a candidate’s access to a job is a significant automated decision, which triggers the data subject’s right to human intervention / review (the basis for the human-oversight risk below). Be honest about scope: RGPD Art. 22 is declared by the system, not litigated — there is no clause-by-clause DPIA in the bundle, and the SCC/DPA are pending (a GAP).
• National law (Spain), and why it carries NO presumption. Two national instruments are declared: ET Art. 64.4.d (Estatuto de los Trabajadores — the employer must inform the works council of the algorithm’s parameters, rules, and instructions) and Ley 15/2022 (equal treatment / non-discrimination, whose Art. 23 cites the selection-parity control below). Here is the key concept: national legislation is a NationalLegislation authority, rank 0 — it confers no presumption of conformity (unlike a harmonised standard, which does). And here is the fine print: ET 64.4.d does have a clause catalog wired into the engine (et.64-4-d-transparencia-algoritmica), and its verdict can be Covered — the signed bundle satisfies it, because the bundle IS the accessible, reconstructible record of the algorithm’s parameters, rules, and instructions that Art. 64.4.d requires. What rank 0 denies it is not the verdict but the presumption: a Covered on ET 64.4.d is a national obligation met, never a presumption of AI Act conformity. The point: the live anchor of this overlay is national law + RGPD, not the (deferred) AI Act high-risk gate date.

Why national law confers no presumption — rank 0 vs a harmonised standard

The engine sorts the things it cites by a typed authority with a rank. A harmonised standard (or a governed standard like prEN 18228 / ISO 23894) can carry a presumption of conformity: prove its clauses and you get a verdict that means something legally. A NationalLegislation authority sits at rank 0: it is a real legal obligation, and — for ET 64.4.d — the engine does have a clause catalog (et.64-4-d-transparencia-algoritmica) to project against, so its verdict can be Covered, satisfied by the signed bundle (the accessible record of the algorithm’s parameters, rules, and instructions). What rank 0 denies is not the verdict but the presumption. So when you read this manifest, do not mistake “ET 64.4.d Covered” for “the AI Act is presumed met”: national law is named, projected, and can earn a verdict against its catalog, but it grants no presumption of AI Act conformity. That honesty is the whole reason the live obligation is anchored on what national law + RGPD actually require now, not on a deferred AI-Act gate date.

The scope frontier — what is and is not in scope here:

• IN scope, blocking (the engine governs with a real RED/GREEN verdict): model-feature-leakage — the certifiable safety defect.
• IN scope, measured but ADVISORY (the engine governs with a finding, not a block): data-sample-adequacy and the measured non-discrimination gate selection-rate-disparity-gender (selection-rate parity by sex, citing Ley 15/2022 Art. 23). They project from the signed bundle against the governed standards (prEN 18228, ISO 23894) and national law; they are genuinely measured, but with n=215 the finding is underpowered — the sample certifies neither adequacy nor fairness, so it gets documented and consciously accepted at approval, without blocking.
• Declared (audit-only), not runtime-gated: insufficient human oversight (Art. 14 / RGPD Art. 22 — HITL) and insufficient transparency (Art. 13 / RGPD) — declared risks tracked for the audit trail, not measured gates. Works-council information (ET Art. 64.4.d) is also a declared measure, but its clause et.64-4-d-transparencia-algoritmica is Covered by the signed bundle (rank 0 → no presumption). The standards declared are seven: eu/pren-18228@2026, iso/23894@2023, eu/ai-act@2024, eu/pren-18283@2026, eu/pren-18282@2026, plus national legislation es/et-rdleg-2-2015@2015 + es/ley-15-2022@2022 (rank 0, no presumption) — no DORA, no MDR.

What is a risk?The RED / AMBER / GREEN vocabulary behind every level, plus gate vs. audit — the difference between a control that blocks the verdict and one that gets measured and documented without blocking, the axis that organizes this level.

---

§3 — Run it yourself

This level runs on a CPU — no GPU, no downloads, no credentials

The pipeline trains a GradientBoosting classifier on Campus Recruitment (CC0, n=215) — the real CSV ships bundled in the repo (data/Placement_Data_Full_Class.csv, loaded via Croissant), so no external download or data cache is needed. On a laptop CPU the full pipeline (train + measure + sign) runs in under a minute. You can clone any tag and re-derive the verdict yourself (§3 of the practice).

Use the V1 milestone chip above to clone the repo and check out the starting point; then reproduce the evidence:

Terminal — reproduce V1's state (untreated)

uv sync   # install pyproject.toml + uv.lock deps (reproducible)
froga compile
froga run
# → .froga/bundle.json → control_results:
#      model-feature-leakage           : leaky_feature_flag = 1.0, threshold < 1.0 → FAILS (the model uses `salary`) — BLOCKING
#      data-sample-adequacy            : sample_adequacy_ratio = 0.43 (215/500), threshold ≥ 1.0 → advisory, non-blocking
#      selection-rate-disparity-gender : demographic_parity_diff measured, underpowered at n=215  → advisory, non-blocking
# → gate RED (the only blocker fails)

git checkout talent-v2.0.0-green     # leak treated (salary dropped) → the only blocker PASSES → gate GREEN
git checkout talent-v2.0.0-approved  # James approves with the advisory residual consciously accepted

You will not find a talent-v1.0.0-approved tag: the approval lands after the treatment, once the safety defect is already fixed. The honest end state of this manifest is GREEN, approved, with the data/fairness residual on record — not a fairness certification the sample cannot support.