← Client-Ready Consultant
Simulated engagement · internal readiness case

Northstar HR Technologies Ltd

Client-ready capstone simulation

Northstar is a 220-person UK SaaS company selling recruitment technology into Germany, France and the Netherlands. Leadership wants an AI Act Ready assessment before a major enterprise procurement cycle. You are the consultant.

Business
Recruitment SaaS

Enterprise clients, EU expansion and investor due diligence.

Current governance
Fragmented

Security and GDPR processes exist; no central AI inventory or AIMS.

Your constraint
Two-week assessment

You must prioritise material risk and evidence rather than boil the ocean.

Discovered AI portfolio

TalentRank EU

Use: Ranks job applicants and recommends who should progress to interview.
Vendor / build: Built internally using a third-party GPAI API plus proprietary ranking logic.
Geography: Used for hiring in the UK, Germany, France and the Netherlands.
Evidence available: Product brief, prompt/ranking specification, sample outputs, HR process map. No formal role/classification memo yet.

InterviewSense

Use: Analyses recorded candidate interviews and produces engagement and communication scores.
Vendor / build: US SaaS vendor.
Geography: Enabled for some EU recruitment campaigns.
Evidence available: Vendor marketing page and contract only. HR says the feature is 'just analytics'.

Support Copilot

Use: Drafts customer-support replies for staff; staff review before sending.
Vendor / build: Commercial GPAI service via API.
Geography: Global.
Evidence available: Security review, basic acceptable-use guidance and API contract. No AI-specific monitoring metrics.

Sales Prospect Score

Use: Scores B2B sales prospects for likelihood to buy.
Vendor / build: Feature inside an existing CRM platform.
Geography: UK and EU sales teams.
Evidence available: No separate procurement. Feature appeared after a platform update six months ago.

Shadow AI tools

Use: Employees expense or use free generative-AI tools for presentations, code, research and document drafting.
Vendor / build: Multiple unknown services.
Geography: Company-wide.
Evidence available: Finance identified 14 AI-related card transactions; IT inventory lists only four approved AI tools.
Your assignment

Work the case as if this were a real client.

  1. 1.Define the engagement scope, assumptions and immediate red flags.
  2. 2.Build an AI inventory and identify missing fields/evidence for each system.
  3. 3.Map likely provider/deployer/importer/distributor/GPAI relationships without over-claiming certainty.
  4. 4.Triage prohibited-practice, high-risk, transparency and other applicable pathways.
  5. 5.Identify what requires legal, privacy, security or technical escalation.
  6. 6.Create an evidence request list and rate each current evidence set as strong, partial or missing.
  7. 7.Produce a prioritised 30/60/90-day remediation plan with owners and definitions of done.
  8. 8.Prepare a five-slide executive readout: what we found, why it matters, top decisions, actions and residual unknowns.
Assessment standard

You are not assessed on producing the most confident answer. You are assessed on correct role and risk reasoning, evidence discipline, prioritisation, clear client communication, and knowing which unresolved points must be escalated rather than guessed.

Fictional training case. It is deliberately incomplete so that asking for evidence and recording uncertainty are part of the exercise.