Rippling

Company overview

Rippling (legal entity People Center, Inc.), founded in 2016 and headquartered in San Francisco, is an all-in-one workforce management platform spanning HR, IT, and finance. Its Recruiting module is a native applicant tracking system that layers AI on top of a unified employee system of record: AI-powered Application Review screens resumes against recruiter-defined criteria, an LLM synthesizes interviewers' feedback into candidate pros/cons summaries, an Interview Assistant records and transcribes video interviews, applications receive a fraud-risk score, and Smart Scheduling automates interview booking. Sourcing and technical assessment are handled through Gem and HackerRank integrations. Rippling is one of the relatively few HR platforms holding an ISO/IEC 42001 AI management system certification.

Regulatory exposure

Rippling Recruiting's AI is used in employment decision-making, placing it squarely within scope of NYC Local Law 144, the EU AI Act (Annex III high-risk employment/recruitment use), and emerging US state AI-hiring laws in Illinois and Colorado. Notably, Rippling itself acknowledges this exposure in its public 'Use of AI at Rippling' document: it states that under the EU AI Act it acts as a 'provider' while customers are 'deployers,' and that features 'used in employment-related contexts—such as Recruiting—may fall within categories that are subject to additional regulatory requirements.' Rippling has commissioned a 'Rippling Recruiting Bias Audit,' but that document sits behind a Whistic registration wall in its Trust Center, so the auditor, date, and adverse-impact results are not publicly verifiable, and no public bias-audit results summary is posted.

Path to a higher score

The single highest-impact move is to publish the Rippling Recruiting Bias Audit ungated, with a public results summary (auditor, date, selection-rate and impact-ratio tables) and a commitment to annual re-audits — this alone would lift bias-audit transparency from the low-40s toward 75+. Rippling could further raise Article 11 and FRIA scores by publishing an ungated per-system model/instructions-for-use card and a concrete Fundamental Rights Impact Assessment (Art. 27) deployer template rather than narrative role guidance, and could strengthen post-market monitoring by exposing a public AI model-update changelog or a continuous bias-monitoring surface. Ungating the SOC 2 and ISO 42001 certificates would also convert already-strong governance claims into directly verifiable evidence.