OVI is an AI-native applicant tracking system (ATS) at ovi-me.com. You chat with AI agents Sora and Milo to source candidates, screen CVs, and run AI voice interviews in one workflow.

How do I sign in to OVI?

Sign in to OVI at https://ovi-me.com/auth with your work email or Google account. New teams can start a free trial from the homepage.

OVI AI refers to OVI's hiring agents — Milo for CV screening and Sora for sourcing — built into the AI-native ATS so recruiting teams chat to hire instead of clicking through traditional ATS screens.

OVI is the AI-native ATS where you chat to hire. Two AI agents — Sora for sourcing and Milo for screening — find candidates, score every CV, and run AI interviews, all controlled from a single chat.

What does "chat to hire" mean?

Chat to hire is OVI's AI-native hiring workflow: instead of clicking through a traditional ATS, you describe what you need in chat and OVI's AI agents source candidates, screen applicants, run AI interviews, and send outreach for you.

What is an AI-native ATS?

An AI-native ATS is an applicant tracking system built around AI agents rather than forms and pipelines. OVI's AI chat ATS lets recruiters source, screen, interview, and follow up through conversation — the agents do the work and surface only the candidates worth meeting.

Who are Sora and Milo?

Sora is OVI's AI sourcing agent — she scans LinkedIn, the open web, and your ATS history to find best-fit candidates and reach out in your name. Milo is OVI's AI screening agent — he scores every applicant against your rubric and surfaces a ranked shortlist.

How do OVI's AI interviews work?

OVI runs async AI interviews for every shortlisted candidate and returns scores, transcripts, and recordings — so your team only meets the people worth meeting.

UAE Workers Can Now Demand Human Review of AI Hiring Decisions — and Most Employers Have No Process to Comply

By Chris Weinmann, Founder, OVI

Published 2026-09-29

When the UAE's Personal Data Protection Law (PDPL) went through its enforcement ramp-up, most HR teams focused on data-storage obligations — consent forms, retention policies, cross-border transfer rules. Few paid close attention to Article 18. That is about to become expensive.

Article 18 gives every data subject — including job applicants and employees — the right to object to decisions made through automated processing when those decisions "produce legal effects" or "significantly affect" the individual (AskAjay.ai). A rejected application, a filtered-out CV, a ranking that determines who advances to interview: each qualifies.

What makes Article 18 stricter than the GDPR equivalent is scope. GDPR Article 22 limits its protection to decisions based "solely" on automated processing. The UAE's PDPL carries no such qualifier. Article 1 defines automated processing to include systems operating "with limited human supervision and intervention" (AskAjay.ai; Modulos AI). A recruiter who glances at an AI-generated shortlist before clicking "approve" does not insulate the employer. If the AI drove the substantive decision, Article 18 applies.

DIFC Regulation 10: A Second Enforcement Layer

Employers operating in the Dubai International Financial Centre face a distinct regime. DIFC Regulation 10, fully enforceable since January 2026, requires deployers of AI systems to conduct impact assessments, document decision logic, and ensure transparency before using AI in hiring. High-risk AI deployments — and hiring decisions explicitly qualify under the Tier 3/4 classification — must maintain a mandatory human-in-the-loop and obtain certification (Mayer Brown; Vanta).

DIFC Regulation 10 is not a restatement of the mainland PDPL. It layers additional obligations: mandatory data protection impact assessments (DPIAs) before deployment, ongoing monitoring of AI outputs for bias, and a requirement to disclose to candidates that AI is being used in the evaluation process (ValueMentor).

The Multi-Regime Overlap

UAE employers with entities across jurisdictions face compounding requirements. Mainland companies fall under the PDPL. DIFC entities answer to DIFC Regulation 10. Abu Dhabi Global Market (ADGM) has its own data protection framework. An employer with offices in mainland Dubai, DIFC, and ADGM could be subject to all three — each with distinct documentation, assessment, and disclosure standards (WCR Legal).

The UAE AI Act, whose six-month mandatory self-assessment window closed in September 2026, adds a federal overlay with enforcement fines now active at up to AED 10 million (Digital Dubai; SilentGuard). This is not a future risk. Enforcement is live.

What Workers Can Do

A candidate or employee who believes an AI system influenced a hiring decision can invoke Article 18 by submitting a formal objection to the employer. The law does not prescribe a specific format — a written request to the company's data protection officer or HR department is sufficient.

Upon receiving the objection, the employer must demonstrate that the decision involved meaningful human review — not a rubber stamp on an algorithm's output. If the employer cannot show a documented process for human override, the decision is legally vulnerable (Kayrouz & Associates; Modulos AI).

What happens if the employer has no process? The candidate can escalate to the UAE Data Office. With fines up to AED 10 million now enforceable under the UAE AI Act, the financial exposure is material. No enforcement fine cases have been publicly documented as of September 29, 2026, but the regulatory infrastructure is in place and active (Digital Dubai).

It is worth noting that the UAE government itself uses AI in hiring-adjacent decisions: MOHRE launched AI-powered work permit screening on May 1, 2026, developed jointly with the Federal Authority for Identity and Citizenship (AskAjay.ai). The regulatory expectation is clear — use AI, but build the guardrails.

Employer Action Checklist: Close the Gap Before January 1, 2027

Audit every AI tool touching candidate data. Map which systems use automated processing in screening, ranking, or shortlisting — including partial-automation tools where a human only reviews the AI's recommendation.
Document AI decision logic. For each tool, record what data inputs drive the model, how scores or rankings are generated, and what weight each factor carries. DIFC-regulated entities must complete this as part of their Tier 3/4 certification (Vanta).
Conduct a DPIA. Both mainland PDPL and DIFC Regulation 10 expect documented impact assessments for AI processing of personal data in hiring contexts (ValueMentor).
Designate a qualified human reviewer. Identify the person (by role, not just title) who will review challenged AI decisions. Ensure they have the authority, training, and access to override the system's output.
Publish a candidate-facing mechanism. Make it clear in job postings, application portals, or candidate communications how applicants can invoke their Article 18 rights. An unpublished right is an unenforceable right — for the employer.
Build an audit trail. Every AI-assisted hiring decision should be logged with sufficient detail to reconstruct the reasoning if challenged. Maintain records for the PDPL's prescribed retention period.
Check cross-jurisdiction exposure. If your company operates across mainland UAE, DIFC, and ADGM, map which entities are subject to which regime and confirm compliance with each (WCR Legal).

Platforms that generate structured, documented scoring criteria — where every screening outcome traces back to a defined rubric — align naturally with Article 18's explainability requirement. OVI's AI screening agent, Milo, evaluates candidates through an audio chat and produces documented scoring against role-specific criteria. Because analysis is transcript-content only — no biometric data, no voice-characteristic profiling — and every final hiring decision remains with the recruiter through a human-in-the-loop architecture, the system aligns with PDPL's expectations for meaningful human oversight (ovi-me.com/standards).

What is PDPL Article 18, and does it apply to job applicants?

Yes. PDPL Article 18 gives any data subject — including job applicants and employees — the right to object to automated decisions that produce legal effects or significantly affect them. A rejected job application or a filtered-out CV qualifies as a significant effect.

How is PDPL Article 18 different from GDPR Article 22?

GDPR Article 22 applies only to decisions based "solely" on automated processing. The UAE's PDPL has no such qualifier — Article 1 defines automated processing to include partial automation with limited human supervision. This means AI tools where a recruiter merely reviews the output are still covered.

What should a DIFC-based employer do differently?

DIFC Regulation 10 adds distinct requirements beyond mainland PDPL: mandatory DPIAs, Tier 3/4 AI system certification for high-risk decisions like hiring, and a transparency obligation to disclose AI use to candidates. Full enforcement has been active since January 2026.

What is the deadline for full PDPL compliance?

January 1, 2027. Employers have approximately three months from late September 2026 to close any gaps in their AI hiring compliance processes.