Sova Assessment

Company overview

Sova Assessment Limited was incorporated on 15 May 2015 (Companies House no. 09593533) and operates from London with a registered office in Canterbury, Kent, plus international offices reported in Dubai and Melbourne. The platform unifies image-based personality questionnaires, cognitive and ability tests (verbal, numerical, logical, checking and accuracy, learnability), situational judgement tests, one-way and live video interviews, and virtual assessment centres, with results consolidated into a 0-100 Sova Score. In 2026 the company launched Immerse, a coordinated multi-agent generative-AI role simulation that places candidates in job-realistic scenarios with AI characters and scores them automatically against psychologist-defined competencies. Leadership includes CEO Luke Fisher and Chief IO Psychologist Nicola Tatham; the company reports 10M+ candidates assessed across 50+ countries for enterprise clients including Unilever, Vodafone, John Lewis, Nationwide and Sky, and raised a $9m growth round from Octopus Ventures. Pricing is published openly, from GBP 800-2,000 per month on Core tiers (billed annually, unlimited candidates under fair use) plus one-off onboarding fees of GBP 2,000-4,600, with custom Advanced tiers.

Regulatory exposure

Assessment tools that evaluate, rank and filter job candidates fall squarely within Annex III high-risk classification under the EU AI Act, and Sova's own Responsible AI FAQ names 2 August 2026 as the date when human oversight, bias testing, documentation and candidate transparency requirements become enforceable. Exposure is heightened by Immerse, a generative multi-agent system that automatically scores candidate behaviour, and by Sova's own principal IO psychologist publicly conceding that generative-AI evaluation processes remain largely opaque and that large language models can embed unvalidated assumptions about professional communication. Sova states it does not use emotion recognition or biometric inference, which avoids the Article 5 prohibited-practice trap that catches several video-interview competitors. On the US side, NYC Local Law 144 requires an annual independent bias audit with a publicly posted summary for any AEDT used on NYC candidates, and Illinois HB 3773 (effective January 2026) plus Colorado SB 24-205 add further duties; no Sova bias audit, published or gated, could be located from any source. The company's compliance posture rests almost entirely on information-security and data-protection instruments (ISO 27001:2017, Cyber Essentials Plus, GDPR/UK GDPR, DPA 2018, CCPA, Australian Privacy Act, ICO registration ZA225400, an outsourced DPO) rather than AI-specific governance: there is no ISO/IEC 42001, no Article 11 technical documentation pack, no model or system card for Immerse, no published training-data provenance or exclusion statement, and no FRIA support. Sova's public writing shows genuine and unusually candid regulatory literacy, but that literacy has not yet been converted into the artefacts a deployer would need at an audit.

Path to a higher score

The single highest-value move is to commission and publicly post an independent bias audit in LL 144 format — selection and scoring rates by sex and race/ethnicity including intersectional categories, with the auditor's name, date and sample size — as a downloadable PDF rather than a customer-only report; Sova already runs adverse impact studies internally, so this is largely a publication decision. Second, publish an Immerse system card and instructions-for-use covering model selection, training-data provenance, scoring methodology, inter-rater reliability against trained human assessors, known limitations and demographic differential-performance results, answering the exact vendor checklist Sova's own blog tells buyers to demand. Third, pursue ISO/IEC 42001 alongside ISO 27001, and state explicitly whether candidate responses are used to train or fine-tune models, with a public subprocessor list and DPA. Fourth, add operational transparency infrastructure: a public status page, a named security contact and vulnerability disclosure policy, and an AI/model-change changelog distinct from the marketing-led product updates page. Finally, convert the Responsible AI FAQ into genuine deployer documentation — an Article 26 deployer-obligations guide, an Article 27 FRIA template, and an LL 144 notice-and-audit pack — which would move three rubric categories at once.