We audited our own AI product a year early. Failures included.

The awkward part of compliance is that you have to pass it yourself.

Heify, our own AI product, scores sales and support calls so a team can review every call instead of a sample. Under the EU AI Act, AI used to evaluate how people perform at work is listed as high-risk, in Annex III, point 4 — and those obligations apply from 2 December 2027. We started auditing in August 2026, more than a year early, and wrote every decision down.

This is what we found. We have kept the failures in.

Seventeen inconsistencies in six documents

We started with the paperwork, because that is where a customer’s lawyer starts.

We cross-checked six of our own documents and found seventeen inconsistencies. Two of them, to give you the idea.

The first was about people. Nowhere did our texts say that a person had to stay in the loop — if anything, they suggested one would not be needed. That is the opposite of what the AI Act will require of a high-risk system from December 2027: that it is built so that it «can be effectively overseen by natural persons during the period in which they are in use» (Article 14(1)).

The second was more basic. There was no compliance folder at all.

Together, the seventeen were the kind of thing that turns a procurement review from a week into a month, because every inconsistency is a question someone has to answer in writing. We ranked all seventeen by importance and worked through them with an action plan. All seventeen are fixed today, and there is now a process so that future changes are reviewed and folded in as they happen — not found in the next audit.

We trained the team. We had no policy.

The team had been through AI training: ninety minutes on real cases and real failures, on record and minuted. What we did not have was a written rule about which AI tools could be used, and with what data.

Training answers whether people know how to use AI well. It does not answer the question customers actually ask: can anyone at Heify put our call transcripts into a public AI tool — and if not, what stops them?

We tell clients they need exactly this. Our own team did not have one. It does now: a written policy setting which tools are approved, which customer data may never go into anything else, and who approves a new tool.

Words only, never the voice

The AI Act’s prohibited practices have applied since 2 February 2025. One of them is aimed squarely at products like ours: the use of AI systems «to infer emotions of a natural person in the areas of workplace and education institutions» (Article 5(1)(f)).

The Commission’s guidelines on prohibited practices read that ban as covering emotions inferred from biometric data, and place inference from written text outside it. A voice can be biometric data; a transcript is not. So Heify works on words only: it reads what was said and never listens for how it sounded. It does not even keep the audio — recordings are deleted as soon as they have been processed.

That is a product decision with a regulation behind it. It keeps Heify clear of a prohibited practice instead of trying to manage one.

We accepted high-risk. No loopholes.

The tempting move is to argue your product out of Annex III. Point 4(b) covers AI systems used, among other things, «to monitor and evaluate the performance and behaviour of persons» in work-related relationships. Heify scores how agents handled their calls. We could have spent months explaining why quality assurance is something else. We decided it isn’t, and planned for it instead.

Accepting the classification early is what turned it into a schedule rather than a surprise: a first quarterly review this October, the full compliance project from the first quarter of 2027, and the aim of reaching 2 December 2027 finished, not starting.

No candidate screening. No exceptions.

Recruitment and selection have their own entry in Annex III — point 4(a), which covers AI systems intended «to be used for the recruitment or selection of natural persons». The same scoring, pointed at job candidates instead of employees, would be a different intended purpose altogether — and nobody would use a coaching tool for hiring is not a control.

So it is excluded in writing: clauses 3.6 to 3.10 of the master agreement and 4.4 to 4.6 of the acceptable use policy. Not a preference mentioned in a sales call. A line the customer signs.

The AI doesn’t decide

This is the fix for the first of those seventeen inconsistencies. The AI flags a moment. A supervisor reviews it. A person decides.

A Heify score is never the sole basis to fire, sanction or reward anyone. That rule now lives in three places — the contract, the product and the team’s own words — because a rule that lives in only one of them does not survive the first busy week.

What failed

This is the part most case studies leave out. Three real incidents from this summer, from the logs we keep:

• An answering machine was scored as if it were an agent. Exactly the error a supervisor spots in seconds — which is why there is a supervisor.

• Accented characters came out broken in a transcript. The system caught it and regenerated the text.

• An audio file of about two hours got stuck. A delay, but no scoring error.

And what is still open, on the record: accent bias has not been measured yet. We plan to measure it in 2027, and until then the honest answer is that we don’t know. The usual language-model errors still happen too.

We publish this because a compliance story without failures is not a compliance story. It is a brochure.

The method, in ten lines

1. Classify by what it does. Accept high-risk. No loopholes.

2. Split the duties. Who answers for what, written in before signing.

3. Close the doors. No candidate screening. No exceptions.

4. Keep a person in charge. A person can always overrule it.

5. Follow the data. Only write what can be proven.

6. Audit the contracts. Six documents cross-checked, seventeen inconsistencies found.

7. Train the team, on record. Ninety minutes on real cases and failures, minuted.

8. Face what failed. Write it all down, in three living logs.

9. Watch the law. Every quarter, on four fronts.

10. List what’s left. Reach 2 December 2027 done, not starting.

None of this was a crisis. That is the point.

Every finding here was cheaper to deal with in August 2026 than it will be in a procurement review, in front of a customer, with a contract waiting on the answer — or in December 2027, alongside everyone else.

If you build or use AI in something you sell in Europe, you will go through a version of this list. You can do it now, calmly, or later, with someone watching.