Jobylon
Jobylon is a Stockholm-based applicant tracking system and talent CRM for enterprise employers whose optional AI features score each applicant's CV against the job description, suggest existing candidates for other open roles, draft job ads and screening questions, and run candidate screening and interview scheduling over WhatsApp, SMS and email.
HireAIScore rates Jobylon 48 out of 100 (grade F, Substantial gaps) under rubric v1.0, last reviewed September 25, 2026. Jobylon ranks 33 of 77 vendors rated in ATS-integrated AI, against a category average of 47. That score is drawn from 33 evidence items across 7 rubric criteria for Jobylon — 28 with a cited source, 5 recording that nothing was located.
§ 01 - Company facts
- Legal name
- Jobylon AB
- Founded
- 2011
- Headquarters
- Sweden · SE
- Pricing tier
- Mid
- Market side
- Employer-side (AEDT)
- Categories
- ATS-integratedScreeningSourcingScheduling
- Website
- jobylon.com
These are company details, not findings. They are editable by a verified representative and carry no weight in the score, which is built only from the cited evidence below.
§ 02 - Score breakdown
§ Score breakdown
Category scoring
Weighted contribution shown to the right of each bar.
- 01
Article 11 Technical Documentation
Weight 20%55
+11.0 · category avg 51
- 02
Bias Audit Transparency
Weight 18%28
+5.0 · category avg 41
- 03
FRIA Support
Weight 15%36
+5.4 · category avg 32
- 04
Data Governance Disclosure
Weight 15%58
+8.7 · category avg 54
- 05
Human Oversight Design
Weight 12%60
+7.2 · category avg 57
- 06
Post-Market Monitoring
Weight 12%45
+5.4 · category avg 42
- 07
Customer Documentation
Weight 8%60
+4.8 · category avg 59
Category avg is the mean raw score on that criterion across the 77 ATS-integrated AI vendors in scope of this rubric, this one included.
§ 03 - Strongest · weakest
Strongest category
Customer Documentation
Raw score 60 · contributes 4.8 to total.
60 against a 59 category average
Weakest category
Bias Audit Transparency
Raw score 28 · contributes 5.0 to total.
28 against a 41 category average
§ 04 - Cited evidence
Download diligence record→§ Evidence
Cited per category
Every score is backed by at least one cited piece of evidence.
Evidence ledger
- Items
- 33
- Documentation
- 24
- Audit report
- 1
- Public statement
- 3
- Absence
- 5
- With a source URL
- 28 of 33
- Source hostnames
- 4
- Fewest items
- 4
- Article 11 Technical Documentation
These figures measure how thoroughly Jobylon was reviewed, not how Jobylon performed — an absence row, recording that nothing was located, is counted like any other item.
Article 11 Technical Documentation
4 items55
- DocumentationCaptured Sep 25, 2026
A help-centre article dated 25 August 2026 describes the AI Matcher. It uses a pre-trained open-source embedding model that is static, is not retrained on customer data and was fine-tuned on synthetic and curated job-ad and candidate data. It compares CV and job-description text to produce a 0-100 similarity score. System architecture, data-flow and AI Act risk assessment documents are offered only on request.
https://support.jobylon.com/en/articles/802972-jobylon-ai-matcher-how-it-works
- DocumentationCaptured Sep 25, 2026
The Vanta trust center lists Jobylon AI Matching, Jobylon Copilot and a Copilot Evaluation Report under AI and Responsible Use, all behind Request access; none is publicly downloadable.
- Public statementCaptured Sep 25, 2026
The AI recruiting page sets out responsible-AI principles: vendor selection, no model training on customer data, legal compliance, editable outputs and a risk analysis before each feature. Its FAQ says Jobylon has started evaluating its features against Annex III but gives no classification.
- AbsenceCaptured Sep 25, 2026
No public model card naming the embedding model or LLM version, no accuracy or validation metrics, no instructions for use and no ISO/IEC 42001 certification were found on jobylon.com (sitemap reviewed), support.jobylon.com or trust.jobylon.com. /ai-policy, /responsible-ai and /ai-transparency on jobylon.com return 404.
Bias Audit Transparency
4 items28
- AbsenceCaptured Sep 25, 2026
No NYC LL 144 bias-audit summary, independent fairness audit or adverse-impact statistics for the AI Matcher, talent suggestions or AI Hiring Assistant were found on jobylon.com (sitemap reviewed), in all nine support.jobylon.com collections or on trust.jobylon.com. trust.warden-ai.com/jobylon returns 404.
- Public statementCaptured Sep 25, 2026
The bias FAQ answers by pointing to Anthropic's own model evaluations and to user control over prompts. That does not cover the separate open-source embedding model that produces the match scores.
- DocumentationCaptured Sep 25, 2026
Mitigation is design-level only: the matcher does not take age, gender or ethnicity as inputs, but no testing for proxy effects in CV text is reported.
https://support.jobylon.com/en/articles/802972-jobylon-ai-matcher-how-it-works
- DocumentationCaptured Sep 25, 2026
A configurable anonymous-recruitment feature can hide fields such as name and email until a chosen pipeline stage; this is a process control, not an audit.
https://support.jobylon.com/en/articles/105666-anonymous-recruitment
FRIA Support
4 items36
- DocumentationCaptured Sep 25, 2026
A February 2024 explainer lists generic deployer duties for HR and TA teams: use the system as the provider instructs, keep human oversight, meet transparency duties, monitor operation, and manage risks and report incidents. It never mentions Art. 27 or fundamental rights impact assessments and does not apply these duties to Jobylon's features.
https://www.jobylon.com/blog/eu-ai-act-what-hr-teams-need-to-know
- DocumentationCaptured Sep 25, 2026
A request-only trust package offers a DPA with three annexes, an SLA, terms of service and 13 sub-processor Transfer Risk & Impact Assessments. The TRIAs are GDPR transfer assessments, not FRIAs.
- DocumentationCaptured Sep 25, 2026
A form-gated AI Buyer's Guide written with Hubert and updated 21 November 2025 gives buyers questions to ask vendors about EU AI Act compliance. It is procurement guidance, not a FRIA template.
https://www.jobylon.com/guides-reports/ai-buyers-guide-for-recruitment-software
- AbsenceCaptured Sep 25, 2026
No FRIA template, Art. 26/27 deployer checklist or instructions for use were found on jobylon.com, support.jobylon.com or trust.jobylon.com. The AI Act risk assessment mentioned in the matcher article is available only on request.
Data Governance Disclosure
5 items58
- DocumentationCaptured Sep 25, 2026
The matcher reads only CV and job-description text and excludes demographic attributes (age, gender, ethnicity). It is not trained on customer applicant data and was fine-tuned on synthetic and manually curated data.
https://support.jobylon.com/en/articles/802972-jobylon-ai-matcher-how-it-works
- Public statementCaptured Sep 25, 2026
Jobylon states that its LLM neither stores nor trains on customer inputs or outputs, and that no data is retained for model training.
- Audit reportCaptured Sep 25, 2026
A publicly viewable ISO/IEC 27001:2022 certificate for Jobylon AB was issued by Prescient Security LLC (IAS-accredited), certificate no. 122514. First issued 10 June 2024 and valid until 9 June 2027, it covers the platform for job ads and candidate-data management hosted on AWS and Heroku. The Statement of Applicability is gated.
- DocumentationCaptured Sep 25, 2026
The security policy page, last revised September 2022, documents EU-only AWS data residency, AES-256 encryption at rest, TLS 1.2+ in transit, annual third-party penetration tests and platform audit and activity logs.
- DocumentationCaptured Sep 25, 2026
The public sub-processor list gives server locations (mostly EU; optional Twilio SMS in the US) and 30 days' advance notice of changes. It names no AI model or LLM provider, although Jobylon says it uses Anthropic models.
Human Oversight Design
5 items60
- DocumentationCaptured Sep 25, 2026
AI matching is off by default: Jobylon activates it on request, then a permitted user enables it per job. The score carries an in-product notice that it is AI-generated and meant as a guideline. It does not rank, filter or remove candidates on its own, and any match can be disregarded or overridden.
https://support.jobylon.com/en/articles/802972-jobylon-ai-matcher-how-it-works
- DocumentationCaptured Sep 25, 2026
Employers can add an application-form disclaimer that lets candidates opt out of AI matching; applications from candidates who opt out are not scored.
https://support.jobylon.com/en/articles/802972-jobylon-ai-matcher-how-it-works
- DocumentationCaptured Sep 25, 2026
In the AI Hiring Assistant, recruiters configure screening criteria and escalation rules, decide when to step in, and can join or take over any AI-run candidate conversation. Conversation history is kept on the candidate profile.
https://www.jobylon.com/recruiting-software/features/ai-hiring-assistant
- DocumentationCaptured Sep 25, 2026
On the other hand, pipeline actions can automatically move candidates based on third-party assessment scores (e.g., Alva Labs, Hubert, Assessio), and no per-candidate human review is described.
https://support.jobylon.com/en/articles/212428-move-candidates-based-on-scores
- DocumentationCaptured Sep 25, 2026
A self-service audit-log export (March 2026) covers logins, permissions and user management, but not AI events such as scores shown, opt-outs or overrides.
https://support.jobylon.com/en/articles/602156-how-to-export-company-audit-logs
Post-Market Monitoring
5 items45
- DocumentationCaptured Sep 25, 2026
A public Atlassian Statuspage covers seven components (API, App, Feed, Webhooks, Website, Analytics, Custom Dashboards) with email, Slack and RSS/Atom subscriptions. No component covers the AI features.
- DocumentationCaptured Sep 25, 2026
The incident feed lists 24 incidents from April 2019 to 17 July 2026. Several state root causes, such as the July 2026 outage caused by an email-notification component overloading servers, and two 2020 postmortems name preventive actions.
- DocumentationCaptured Sep 25, 2026
The responsible disclosure policy directs reports to security@jobylon.com, promises acknowledgement within five business days and aims to resolve critical issues within one week.
- DocumentationCaptured Sep 25, 2026
The security policy describes an incident routine that escalates to the CTO and Legal, a personal-data-breach routine, and APM and log monitoring with alerting.
- AbsenceCaptured Sep 25, 2026
No AI-specific post-market monitoring was found on jobylon.com, support.jobylon.com, status.jobylon.com or trust.jobylon.com: no model or feature changelog, no AI incident or complaint channel, and no drift or fairness monitoring for the AI Matcher.
Customer Documentation
6 items60
- DocumentationCaptured Sep 25, 2026
A dedicated AI product page sets out responsible-AI principles, describes each AI feature, and has an FAQ covering the EU AI Act, model choice, bias and training data.
- DocumentationCaptured Sep 25, 2026
A customer help article explains how the AI Matcher is switched on, how scores are calculated, how candidate consent and opt-out work, and how human oversight applies.
https://support.jobylon.com/en/articles/802972-jobylon-ai-matcher-how-it-works
- DocumentationCaptured Sep 25, 2026
The Co-Pilot help article walks customers through setting up AI-drafted job ads, job skills and suggested screening questions, all of which can be edited.
https://support.jobylon.com/en/articles/218391-jobylon-co-pilot
- DocumentationCaptured Sep 25, 2026
A 16-article GDPR FAQ collection confirms that an Art. 28 DPA is required and covers sub-processors, retention and privacy by design. The DPA and its annexes are available only on request through the trust center.
- DocumentationCaptured Sep 25, 2026
Guidance on the legal basis (legitimate interest or consent) for considering applicants for roles other than the one they applied to bears directly on the talent-suggestions feature.
- AbsenceCaptured Sep 25, 2026
No customer guidance on NYC LL 144, Illinois HB 3773, or the Colorado or California automated-decision rules was found on jobylon.com or support.jobylon.com. The EU AI Act material is limited to a 2024 explainer and a form-gated 2025 buyer's guide.
§ 05 - Editorial notes
Company overview
Jobylon AB, founded in 2011 and headquartered in Stockholm, sells an enterprise ATS, a Talent CRM and Trustcruit, a candidate-feedback analytics product it acquired in May 2024 with backing from private equity firm Verdane. It reports more than 60,000 users in over 80 countries, with customers including KPMG and Scandic Hotels. Its AI layer has four parts. The AI Matcher is opt-in and uses a pre-trained open-source embedding model to give each applicant a 0-100 similarity score between CV and job description. Talent suggestions cross-check applicants against other open roles and recommend database candidates for new jobs. Co-Pilot drafts job ads and screening questions; Jobylon says its LLM features use Anthropic models such as Claude. A newer AI Hiring Assistant screens candidates and schedules interviews over WhatsApp, SMS and email. The ATS also integrates third-party AI screeners such as Tengai, Hubert and Alva Labs.
Regulatory exposure
Jobylon's AI FAQ says it has 'begun evaluating how our AI features comply' with Annex III. It publishes no classification, and the FAQ still dates enforcement to 2026, although the Digital AI Omnibus has moved Annex III obligations to 2 December 2027. By Jobylon's own description, the AI Matcher scores every applicant against the job and the AI Hiring Assistant screens candidates against set criteria. That places both under Annex III point 4(a), which covers AI used to analyse and filter applications and to evaluate candidates. Calling the score decision support is unlikely to qualify it for the Art. 6(3) exemption, because that exemption excludes systems that profile people. As provider, Jobylon would owe risk management, technical documentation, logging, human-oversight design and a conformity assessment. Its bias answer points to Anthropic's model testing, which does not cover the separate embedding model that produces the match scores. US exposure is secondary for a business centred on the Nordics and the Netherlands. However, a customer relying on the score to substantially assist New York City hiring would need an LL 144 bias audit, and Jobylon has published none. Illinois HB 3773 notice (from 1 January 2026), Colorado SB 26-189 disclosures (from 1 January 2027) and California's FEHA automated-decision rules (four-year record retention) fall mainly on employers. Jobylon's optional AI disclaimer and candidate opt-out help them comply.
Path to a higher score
Jobylon could gain most quickly by publishing material it already has. It could state its Annex III classification and AI Act risk assessment publicly, and release the gated AI Matching, Copilot and Copilot Evaluation Report documents from its trust center. An independent bias audit of the match score would address its weakest category and cover customers hiring in NYC. Its public summary should give impact ratios by sex and race/ethnicity and test proxies such as language and career gaps. Jobylon should also name the embedding model and LLM provider in its sub-processor list, and publish instructions for use with Art. 26 deployer guidance and an Art. 27 FRIA template. Adding AI events (scores shown, opt-outs, overrides) to the exportable audit log, plus a versioned changelog for AI features, would strengthen oversight and monitoring. It should also update its public AI Act timeline to December 2027.
§ Regulatory frame
What applies to ats-integrated ai.
Ranking features are inside EU AI Act Annex III §4 (high-risk) and inside NYC Local Law 144 when they affect NYC-based candidates. Customers should treat the AI surface as a distinct deployer-FRIA scope from the rest of the ATS.
§ Compare
Build any comparison→Jobylon against its nearest-scoring peers.
In ATS-integrated AI.
§ Others rated in ATS-integrated AI
All ats-integrated vendors→Ranked 33 of 77 by weighted total under rubric v1.0. The ordering is arithmetic on the rubric and carries no view on which tool suits a given hiring process.
- 30Workable48F
- 31Employment Hero48F
- 32VidCruiter48F
- 33JobylonThis profile48F
- 34isolved47F
- 35Teamtailor47F
Conflicts of interest
No vendor pays for placement, scoring, or removal. Casework - the consulting firm that operates this directory - provides paid services to some vendors. Any active or recent (within 24 months) commercial relationship is disclosed on the affected vendor profile and the review is reassigned to an independent reviewer. See the full policy on About.
Casework has no commercial relationship with this vendor.