HiBob
HiBob's Bob is an all-in-one HR platform whose Bob Hiring applicant tracking module uses AI to give each application an explainable match score against recruiter-defined criteria (AI CV Matching) and to draft job descriptions, interview scorecards and candidate emails.
HireAIScore rates HiBob 46 out of 100 (grade F, Substantial gaps) under rubric v1.0, last reviewed September 25, 2026. HiBob ranks 36 of 77 vendors rated in ATS-integrated AI, against a category average of 47. That score is drawn from 36 evidence items across 7 rubric criteria for HiBob — 29 with a cited source, 7 recording that nothing was located.
§ 01 - Company facts
- Legal name
- Hi Bob Ltd.
- Founded
- 2015
- Headquarters
- United Kingdom · GB
- Pricing tier
- Mid
- Market side
- Employer-side (AEDT)
- Categories
- ATS-integratedScreening
- Website
- hibob.com
These are company details, not findings. They are editable by a verified representative and carry no weight in the score, which is built only from the cited evidence below.
§ 02 - Score breakdown
§ Score breakdown
Category scoring
Weighted contribution shown to the right of each bar.
- 01
Article 11 Technical Documentation
Weight 20%55
+11.0 · category avg 51
- 02
Bias Audit Transparency
Weight 18%20
+3.6 · category avg 41
- 03
FRIA Support
Weight 15%35
+5.3 · category avg 32
- 04
Data Governance Disclosure
Weight 15%57
+8.5 · category avg 54
- 05
Human Oversight Design
Weight 12%63
+7.6 · category avg 57
- 06
Post-Market Monitoring
Weight 12%47
+5.6 · category avg 42
- 07
Customer Documentation
Weight 8%61
+4.9 · category avg 59
Category avg is the mean raw score on that criterion across the 77 ATS-integrated AI vendors in scope of this rubric, this one included.
§ 03 - Strongest · weakest
Strongest category
Human Oversight Design
Raw score 63 · contributes 7.6 to total.
63 against a 57 category average
Weakest category
Bias Audit Transparency
Raw score 20 · contributes 3.6 to total.
20 against a 41 category average
§ 04 - Cited evidence
Download diligence record→§ Evidence
Cited per category
Every score is backed by at least one cited piece of evidence.
Evidence ledger
- Items
- 36
- Documentation
- 25
- Public statement
- 4
- Absence
- 7
- With a source URL
- 29 of 36
- Source hostnames
- 5
- Fewest items
- 4
- Bias Audit Transparency
These figures measure how thoroughly HiBob was reviewed, not how HiBob performed — an absence row, recording that nothing was located, is counted like any other item.
Article 11 Technical Documentation
6 items55
- DocumentationCaptured Sep 25, 2026
HiBob's AI Trust Center (published November 2025) sets out six AI principles (zero retention, data isolation, opt-out via an AI Settings page, encryption, role-based access and AI-vendor due diligence) and says HiBob follows best practices including ISO 42001, but it offers no system-level technical documentation.
- DocumentationCaptured Sep 25, 2026
HiBob's August 2026 AI data-security guide says Bob is 'certified and audited' against ISO 27001, ISO 27018 and ISO 42001 and describes rationale guardrails and AI audit trails, but no ISO 42001 certificate, certification body or scope is published anywhere.
- Public statementCaptured Sep 25, 2026
A March 2026 post by CEO Ronni Zehavi lists 'ISO 42001 certification' among the measures that let organizations oversee AI use, a claim HiBob has not backed with a published certificate.
- DocumentationCaptured Sep 25, 2026
HiBob's 6 August 2026 API changelog, its most technical public description of the hiring AI, says AI CV Matching replaced AI CV Summary with an explainable, configurable match score based on recruiter-defined structured criteria, exposed with calculation details in an aiMatchingScore field.
https://apidocs.hibob.com/changelog/hiring-api-ai-cv-matching-score-in-applications
- Public statementCaptured Sep 25, 2026
An independent May 2026 EU AI Act analysis of HiBob notes that the company publishes AI positioning and privacy statements but no model cards, and advises deployers to secure written confirmations from the vendor.
https://www.praxikon.com/en/posts/ai-act-hibob-classification
- AbsenceCaptured Sep 25, 2026
No model or system card, Annex IV-style technical file, instructions for use or scoring-methodology statement for AI CV Matching was found on hibob.com's privacy and trust pages, product pages, guides or API docs, and HiBob's help center redirects to a customer login.
Bias Audit Transparency
4 items20
- AbsenceCaptured Sep 25, 2026
No NYC Local Law 144 bias-audit summary, independent algorithmic audit, or demographic selection-rate or impact-ratio data for AI CV Matching was found on HiBob's AI Trust Center, security page, Bob Hiring page, AI guides or API docs, and Warden AI's public trust directory has no HiBob page.
- DocumentationCaptured Sep 25, 2026
HiBob's AI Terms (November 2025) warn that AI output may reflect bias or lack of fairness and disclaim liability for biases in the underlying algorithms or data, leaving non-discrimination to the customer.
- DocumentationCaptured Sep 25, 2026
HiBob's own July 2026 responsible-AI guide tells HR teams to audit AI hiring outputs across demographic groups before deployment and to ask whether vendors have 'conducted independent bias audits or published model cards', a bar HiBob does not publicly clear for its own matching score.
https://www.hibob.com/hr-tools/how-to-implement-ai-responsibly-in-hr/
- Public statementCaptured Sep 25, 2026
A Brandon Hall Group brief (3 August 2026) says Bob Hiring's 'Glass Box' approach gives legal and compliance teams 'audit-ready proof of fairness' but cites no audit, auditor, methodology or results.
FRIA Support
4 items35
- AbsenceCaptured Sep 25, 2026
No EU AI Act Article 27 FRIA template, Article 26 deployer guidance, intended-purpose statement or instructions for use for Bob Hiring was found on HiBob's AI Trust Center, security page, AI Terms, Bob Hiring module terms, product pages, guides or API docs.
- DocumentationCaptured Sep 25, 2026
A July 2026 HiBob guide offers generic deployer-style material (use-case risk tiers, human-versus-AI decision boundaries, vendor questions and a running log of AI recommendations and overrides) but nothing specific to Bob Hiring, and it still says the EU AI Act's employment obligations become enforceable on 2 August 2026.
https://www.hibob.com/hr-tools/how-to-implement-ai-responsibly-in-hr/
- DocumentationCaptured Sep 25, 2026
HiBob's trust package (ISO 27001 and ISO 27018 certificates on request, plus a SOC 2 Type II report and penetration-test summary under NDA) gives deployers partial inputs for their own risk assessments.
- DocumentationCaptured Sep 25, 2026
The AI Terms require customers to give appropriate notice, obtain required consents and maintain adequate human review of AI output, but frame these as general contractual duties rather than EU AI Act deployer guidance.
Data Governance Disclosure
5 items57
- DocumentationCaptured Sep 25, 2026
HiBob's security page states it is ISO 27001:2022, ISO 27018:2019 and SOC 2 Type 2 certified (SOC 2 report under NDA) and that Bob data is hosted in AWS data centers in Ireland, with backup in Germany.
- DocumentationCaptured Sep 25, 2026
The AI Trust Center commits to a zero-retention policy for AI processing, states that no customer data is used to train AI models, and describes per-customer data isolation and security assessments of every AI vendor.
- DocumentationCaptured Sep 25, 2026
The sub-processor list (updated November 2025) names OpenAI ('LLM processing & generative AI') and AWS-hosted AI models, both with EU processing, as providers of optional platform AI features, plus Azure OpenAI for one Bob Finance feature.
https://www.hibob.com/privacy/hibob-subsidiaries-and-sub-processors/
- DocumentationCaptured Sep 25, 2026
The AI Terms contractually state that customer data processed by AI features is not used to train AI models and that HiBob's AI service providers may not train their models on it.
- AbsenceCaptured Sep 25, 2026
No disclosure was found of which CV fields AI CV Matching uses or excludes (for example names, photos, age or other protected characteristics), how the matching was validated, or how it performs across demographic subgroups.
Human Oversight Design
7 items63
- DocumentationCaptured Sep 25, 2026
HiBob documents AI CV Matching as 'an explainable, configurable match score based on structured criteria defined by the recruiter', returned with full calculation details according to each job opening's AI matching configuration.
https://apidocs.hibob.com/changelog/hiring-api-ai-cv-matching-score-in-applications
- DocumentationCaptured Sep 25, 2026
The Bob Hiring page promises 'evidence behind every score', and its FAQ states that AI does not make hiring decisions and that recruiters and hiring managers review the information and decide.
- DocumentationCaptured Sep 25, 2026
HiBob's AI data-security guide says Bob's AI features include human-in-the-loop review and rationale guardrails that show how and why an output was produced and what data it used, and that Bob logs AI actions to create an audit trail for compliance reviews.
- DocumentationCaptured Sep 25, 2026
Admins can switch individual AI features on or off from an AI Settings page, and access to AI settings and usage is controlled by user role.
- DocumentationCaptured Sep 25, 2026
The Bob AI FAQ states that Bob AI 'always requires a human in the loop to approve actions that affect company data', with write actions requiring explicit user confirmation.
- Public statementCaptured Sep 25, 2026
A 3 August 2026 Brandon Hall Group brief on the Bob Hiring platform and roadmap describes a 'Glass Box' design with full prompt visibility, configurable criteria weighting and audit logs for every AI action. HiBob is a Brandon Hall 'Eminence Level Preferred Provider', and its own public pages do not document these controls in that detail.
- AbsenceCaptured Sep 25, 2026
No per-jurisdiction controls (such as turning off matching for New York City or EU roles) and no public description of what the audit logs contain or how long they are kept were found, and product help articles sit behind HiBob's customer login.
Post-Market Monitoring
4 items47
- DocumentationCaptured Sep 25, 2026
HiBob runs a public Atlassian Statuspage, unlinked from the marketing pages checked, with 29 components in 13 groups including a dedicated Hiring group, email/SMS/Slack alerts and an incident feed whose latest 50 entries run from July 2025 to September 2026 (including a major Hiring-module incident on 15 June 2026), with occasional root-cause notes but no postmortems.
- DocumentationCaptured Sep 25, 2026
The public API changelog announced the switch from AI CV Summary to AI CV Matching on 6 August 2026 with a deprecation window for the old output field (removal by February 2027), giving integrators advance notice of a change to the hiring AI's output.
https://apidocs.hibob.com/changelog/hiring-api-ai-cv-matching-score-in-applications
- DocumentationCaptured Sep 25, 2026
The security page describes a Bugcrowd bug bounty program, 24/7 security operations coverage, continuous vulnerability scanning and annual third-party penetration tests, but gives no public security contact address.
- AbsenceCaptured Sep 25, 2026
No AI-specific monitoring of performance, drift or fairness, no AI incident-reporting channel and no model-update log beyond the API changelog was found, and hibob.com's security.txt could not be retrieved because Cloudflare blocks the path.
Customer Documentation
6 items61
- DocumentationCaptured Sep 25, 2026
The public Bob Hiring page documents the AI features (CV matching with evidence behind every score, AI scorecards, evaluation summaries, job descriptions and an email composer) and states in its FAQ that humans make the hiring decision.
- DocumentationCaptured Sep 25, 2026
Public AI Terms (November 2025) define AI features, inputs and outputs, rule out training on customer data, warn about inaccurate or biased output and set out customer duties for compliance, notice, non-discrimination and human review.
- DocumentationCaptured Sep 25, 2026
A Data Processing Addendum (last updated August 2025) can be signed through DocuSign from HiBob's public privacy hub, which also hosts the sub-processor list, security page and AI Trust Center.
- DocumentationCaptured Sep 25, 2026
HiBob publishes general HR guidance on AI regulation, including an AI regulations playbook (updated September 2026) and a July 2026 responsible-AI guide covering the EU AI Act, NYC LL 144, Illinois HB 3773 and California's rules, though neither is tailored to Bob Hiring deployers.
- DocumentationCaptured Sep 25, 2026
The Bob Hiring applicant privacy notice (effective January 2024) explains HiBob's role as processor and the employer-set retention periods but does not mention AI CV Matching or any automated assessment of applications.
https://www.hibob.com/privacy/bob-hiring-privacy-notice-for-applicants/
- AbsenceCaptured Sep 25, 2026
No compliance guidance specific to Bob Hiring (support for Local Law 144 audits, candidate AI-notice templates or EU AI Act instructions for use) was found, and HiBob's help center redirected to the customer login when opened in a real browser.
§ 05 - Editorial notes
Company overview
Ronni Zehavi and Israel David founded HiBob in Tel Aviv in 2015. The company sells Bob, a cloud HR platform covering core HR, payroll, finance and talent for mid-sized and enterprise employers. It opened a London office in 2016 and a US headquarters in New York in 2018, and its Israeli entity, Hi Bob Ltd., is based in Tel Aviv. Forbes and Wikipedia list London as its headquarters. Bob Hiring is the platform's applicant tracking system. HiBob's API changelog (6 August 2026) records that AI CV Matching replaced the older AI CV Summary with "an explainable, configurable match score based on structured criteria defined by the recruiter". Bob Hiring also uses AI to generate interview scorecards, evaluation summaries, job descriptions and candidate emails. HiBob's sub-processor list names OpenAI and AWS-hosted models as the providers behind these optional AI features.
Regulatory exposure
AI CV Matching scores every application, so Bob Hiring counts as high-risk recruitment AI under Annex III point 4 of the EU AI Act, with HiBob as its provider. The Digital AI Omnibus pushed those obligations back to 2 December 2027 but did not change them. HiBob publishes nothing on its own duties as provider, and its July 2026 guidance to customers still dates the employment obligations to August 2026. In New York City, an employer that lets the score substantially assist hiring or promotion decisions needs an annual independent bias audit, a published summary and candidate notice under Local Law 144. HiBob publishes no audit, and DCWP has promised tougher enforcement after the State Comptroller's December 2025 audit. HiBob's AI Terms leave notice, consent, non-discrimination and human review to the customer and disclaim liability for bias. Its applicant privacy notice (effective January 2024) does not mention AI at all. Employers therefore have to supply their own notices and records under several regimes. Illinois' amended Human Rights Act has applied since 1 January 2026. California's rules on automated-decision systems under its Fair Employment and Housing Act (FEHA) have required four-year record retention since 1 October 2025. On 1 January 2027 two more regimes start: the California Privacy Protection Agency's (CPPA) rules on automated decision-making technology (ADMT) and Colorado's SB 26-189 disclosure rules.
Path to a higher score
HiBob's biggest gaps are bias evidence and technical documentation, the two most heavily weighted categories. Its own July 2026 guide tells buyers to ask whether a vendor has "conducted independent bias audits or published model cards", and HiBob does neither. It should commission an independent bias audit of AI CV Matching in the Local Law 144 style, with impact ratios by sex, race and ethnicity, including intersectional groups, then publish the summary and repeat the audit every year. It should publish a system card and instructions for use that name the models behind the score and explain how recruiter criteria and weights combine. These documents should also list which CV fields are excluded and give known limitations and validation results. HiBob should publish its ISO/IEC 42001 certificate with issuer, scope and date, and bring its security page into line, since that page lists only ISO 27001 and 27018. Further gains would come from:
- a Bob Hiring pack for deployers covering intended purpose, oversight instructions, audit-log fields and retention, and inputs for a Fundamental Rights Impact Assessment (FRIA);
- correcting the EU AI Act date in its guide to 2 December 2027;
- AI disclosure and candidate-notice templates in its applicant privacy notice;
- public documentation of the 'Glass Box' controls, which now sit behind a customer login;
- notes on AI model updates and postmortems on its status page.
§ Regulatory frame
What applies to ats-integrated ai.
Ranking features are inside EU AI Act Annex III §4 (high-risk) and inside NYC Local Law 144 when they affect NYC-based candidates. Customers should treat the AI surface as a distinct deployer-FRIA scope from the rest of the ATS.
§ Compare
Build any comparison→HiBob against its nearest-scoring peers.
In ATS-integrated AI.
§ Others rated in ATS-integrated AI
All ats-integrated vendors→Ranked 36 of 77 by weighted total under rubric v1.0. The ordering is arithmetic on the rubric and carries no view on which tool suits a given hiring process.
- 33Jobylon48F
- 34isolved47F
- 35Teamtailor47F
- 36HiBobThis profile46F
- 37Brainner46F
- 38Factorial46F
Conflicts of interest
No vendor pays for placement, scoring, or removal. Casework - the consulting firm that operates this directory - provides paid services to some vendors. Any active or recent (within 24 months) commercial relationship is disclosed on the affected vendor profile and the review is reassigned to an independent reviewer. See the full policy on About.
Casework has no commercial relationship with this vendor.