1. The Inventory
Sixteen entries are supportable from documents 1 and 2. The CTO's paper says four.
If you found eleven or more with sources, you did well. If you found fewer than eight, the most likely reason is that you worked from the IT asset register and stopped. The register is one source of four, and on its own it is the least complete of them.
# | System | Entity | Owner named in the sources | Supplier as recorded | Human decision | Live | Where it shows up |
|---|---|---|---|---|---|---|---|
1 | Arbiter | Meridian Financial | B. Ellis | Corvid Analytics / Corvid Data Services Limited | Fully automatic below the score threshold | Since 2019 | Register, spend, procurement log, CTO paper, RoPA R-014 |
2 | Hazel | Meridian Financial | J. Prentice | Brightpath Digital Ltd | Advisory, except goodwill credits under £50, which post with nobody looking | Since 6 April 2026 | Register, DIGI wiki, RoPA R-015 |
3 | Echo | Meridian Financial (Marketing) | Not stated | Same platform account and key as Hazel | Fully automatic | Since May 2026 | DIGI wiki only, plus an unnamed reference in the RoPA analyst note |
4 | Pricewise | Meridian Protect | T. Bielecki | In-house | Advisory. Output is a price | Since 2021 | Register, CTO paper, RoPA R-021 |
5 | Pricewise Life | Meridian Protect | T. Bielecki | In-house, built with Milliman LLP | Not concluded | Disputed. See below | Register (non-production), RoPA R-022 (live processing) |
6 | Claimsight | Meridian Protect | S. Nkemelu | Veritas Vision Systems Ltd | Advisory. Routing and a severity band | Since 2023 | Register, spend, procurement log, CTO paper, RoPA R-027 |
# | System | Entity | Owner named in the sources | Supplier as recorded | Human decision | Live | Where it shows up |
|---|---|---|---|---|---|---|---|
7 | Sentinel | Meridian Protect | S. Nkemelu | Aurelius Risk Ltd | Human review by a fraud investigator | Since 2020 | Register, spend, CTO paper, RoPA R-028 |
8 | Talentflow Screen | Talentflow Ltd | Aoife Brennan owns the page, D. Okonjo the product. Register owner unassigned | Built by Talentflow | The customer's recruiters. Talentflow does not see the decisions | Live, 41 customers | TFML wiki, RoPA R-033, register |
9 | Talentflow Interview | Talentflow Ltd | As above | Built by Talentflow | Customer recruiters. Scores shown before the video by default | Live, 12 customers | TFML wiki, RoPA R-034 |
10 | Wellcheck | Meridian Health Solutions | J. Okafor | In-house, clinical content licensed | Advisory to the individual | Since 2024 | Group book, spend, RoPA R-041 |
11 | Attend, Dubai | Meridian Gulf FZ-LLC | N. Al-Amiri | Sekura ID FZ-LLC | Fully automatic at the turnstile | Since 2024 | Register, spend, procurement log, RoPA R-046 |
# | System | Entity | Owner named in the sources | Supplier as recorded | Human decision | Live | Where it shows up |
|---|---|---|---|---|---|---|---|
12 | Attend, Leeds | Meridian Group Services, contracted through Gulf | N. Al-Amiri on the variation, A. Balogun on site | Sekura ID FZ-LLC | Fully automatic | Since June 2026, and there is no RoPA record for it | Spend line, VAR-26-0177, and the absence in R-046 |
13 | Sortline | Meridian Group Services | A. Balogun for the line, D. Kaur for the controller | Kessler Handling GmbH | Human correction on the HMI, used heavily | Register says production. Wiki says pilot | Register, LSS wiki, RoPA R-052 |
14 | Proctor360 | Meridian Group plc | Register owner blank. F. Hargreaves approves the spend | Invigilate Group Ltd | Human review of flags by the assessment team | Since 2024 | Register, spend, procurement log, RoPA R-058 |
15 | Workforce analytics tool, name not stated | Charged to Group Services, contract owner Group HR | F. Hargreaves requested it, R. Merrick requested year two | Northstar People Analytics Limited | Unknown | Live. Two years of charges | PO-25-0533, PO-26-0184, spend CC 7400, RoPA analyst note. No register entry, no RoPA record |
16 | Generative AI use by the Kraków support team | Meridian Gulf cost centre | No approver on file | OpenAI, on a corporate card | Unknown | Live | Spend CC 8821 and the Finance query beneath it. Nothing else |
One Entry to Record, Not to Drop.
The Nexus Underwriting Rules Engine is tagged AI/ML on the IT asset register and sits alongside Pricewise on RoPA R-021, while the engineering wiki calls it a pile of if statements written in 2011.
Both things can be true. A rule-based system that decides something about a person is still governable, and week two's expert systems lesson is the reason.
The right treatment is a row with the disagreement written in it, not a deletion.
If you dropped Nexus because it is not machine learning, that is a defensible judgement provided you wrote down that you made it.
If you dropped it silently, that is the habit this assessment exists to catch.
2. The Eight Things Worth Noticing
Scoring credit for the inventory sits less in the count than in these.
1. The four is not a lie, it is a definition.
The CTO's own speaker notes say four is what is tagged as production AI on the register, and that he would not open up the long tail in that forum. The gap between four and sixteen is a scoping difference, not a deception, and saying so is what will let you raise it without a fight.
2. Meridian is a provider.
The paper says Meridian is a deployer, not a provider, and that its exposure is low. Talentflow Screen and Talentflow Interview are built by a Meridian subsidiary and sold to 41 and 12 external customers, hosted in Dublin. That single fact does more than anything else on your list, and it is the thing Priya most needs to know.
3. Meridian is also its own customer.
Group HR use Screen on the careers site, on the same production instance as external customers. Meridian is therefore provider and deployer of the same system.
4. Pricewise Life.
The register carries it as non-production. The RoPA carries it as live processing of health data and family medical history from real applicants, with the special category lawful basis recorded and the DPIA still in draft since February. Those cannot both be right, and the question is not which document is wrong, it is who believes which one.
5. Attend in Leeds.
The DPIA covers Dubai. The Leeds rollout went in as a variation to an existing purchase order, with the note "same system, assessment held from 2025", so it was never treated as a new deployment. There is no RoPA record for it. Facial recognition at a UK turnstile arrived in June without anybody deciding it should.
6. Two systems exist only in a finance report.
The workforce analytics tool has two years of purchase orders, no register entry, no RoPA record, and a live contradiction about whether HR or Group Services owns it. The Kraków line is a ChatGPT subscription on a corporate card, in a cost centre opened in November 2025 with no purchase orders against it, where the cardholder is a team leader in a country that appears in no compliance document. Neither was found by looking at technology records. Both were found in the money.
7. Echo was built in two days on an existing key.
The DIGI wiki says so, and says hardly anybody knows. It writes the star rating and the "what customers say" copy shown to the public. There is no procurement record because nothing was procured.
8. The CTO's paper says there is no generative AI in production.
Hazel has been live on the app since April, and Hazel can post money to a customer account.
3. The First Pass
An order a risk committee would recognise. Yours does not have to match this one. It has to be defensible in the same way.
1. Talentflow Interview.
Consequence, scale and reversibility all point the same way. It scores people on speech rate, pauses and pitch variance for access to a job, across twelve customers' entire candidate populations, and a rejected candidate never learns why. Invisible and irreversible.
2. Talentflow Screen.
The same shape at greater scale, 41 customers, and it is used on Meridian's own applicants too. Slightly lower than Interview only because the behavioural scoring in Interview is the harder thing to defend.
3. Arbiter.
A solely automated decline on credit, below a score threshold, at consumer lending scale. It is high consequence and high scale. It ranks below the Talentflow pair because a declined applicant is told, the decline letter states a right to human review, and the correction route exists.
4. The workforce analytics tool.
It scores employees and nobody in governance can name it, source it or say what it does. Unknown is not the same as low, and a system you cannot describe cannot be ruled out.
5. Attend in Leeds.
Biometric processing of every employee entering a UK building, deployed without an assessment and without anyone treating it as a deployment.
6. Pricewise Life.
Health data and family medical history, special category, DPIA in draft since February, and two internal records that disagree about whether it is live.
What did not make the six, and why.
Hazel posts money automatically, which is real, but the amount is capped at £50 and the error is visible and reversible. Claimsight matters and its accuracy is disputed, but a triage output is a routing recommendation with a human path behind it. Proctor360 belongs on any serious list and would be seventh. Sortline is a machine that sorts paper.
4. The Note to Priya
A model at 218 words. Yours will read differently. Look at what this one does rather than how it is worded.
Priya,
I have been through the asset register, the subscription spend, the procurement log, the engineering wikis, the September committee paper and your RoPA extract. I can evidence sixteen AI systems. Gavin's paper says four, and his speaker notes say four is what is tagged on the register, so this is a scoping difference rather than a disagreement about facts. I would put it to him that way.
Three things I did not expect.
Talentflow build and sell two systems to 53 external customers. That makes Meridian a provider, not only a deployer, and the paper's exposure assessment rests on the opposite.
Attend went into Leeds in June as a variation to the Dubai contract. Facial recognition on a UK turnstile, no DPIA, no RoPA record, because nobody treated it as a new deployment.
Two systems appear only in the finance data. A workforce analytics platform on two years of purchase orders that exists in no technology record, and a ChatGPT subscription on a Gulf corporate card held by the Kraków team leader.
I am not asking anyone to stop anything. I would like fifteen minutes with you to agree which three I look at properly first, and whether the provider point goes to Marcus now or with the rest.
The list is attached. Every row says where it came from.
What that note does.
It leads with method, not conclusion. It gives Gavin a way to be right and still move. It states the provider point in one sentence without adjectives. It asks for fifteen minutes rather than a mandate. And it closes on sourcing, which is the sentence that makes the rest of it usable.
What a weaker note does.
It says the organisation has high risk AI. It says the CTO misled the Committee. It asks for a budget and a committee in week four. All three are understandable and all three cost you the next twelve months.
5. The Rubric
Score yourself on each criterion. Be strict. Nobody is watching, which is exactly why it counts.
Criterion one: Coverage and honest sourcing
Score | Description |
|---|---|
Yes | Eleven or more systems, every row carries its source, at least one entry is a lead rather than a named system, and unknowns are written as unknowns |
Nearly | Eight or more systems with sources on most rows, but the finance-only systems were missed, or blank cells were left where the answer was not available |
Not yet | Fewer than eight, or a list drawn from the asset register alone, or no source column at all |
The tell for "not yet" is a tidy list. A tidy list at week four means you found the systems that were already written down somewhere.
Criterion two: Role, effect and the human
Score | Description |
|---|---|
Yes | The provider position is identified and stated plainly. Affected people go beyond users to decision subjects and to people who are not customers at all, including job applicants of other companies' vacancies. The human decision column distinguishes the three states and is sceptical where the sources invite it |
Nearly | Deployer and provider are used correctly in most rows but the Talentflow provider position is recorded without its weight, or affected people stops at users and customers |
Not yet | Every row says deployer, or the human decision column repeats what the source claims without testing it |
The two places that test this hardest: Hazel, where "advisory" is true right up until the £50 goodwill credit, and Talentflow, where the people affected do not work for Meridian, are not Meridian's customers, and will never know Meridian exists.
Criterion three: Judgement under incompleteness
Score | Description |
|---|---|
Yes | The priority order has a sentence of reasoning per system that engages with consequence, scale and reversibility. Contradictions are surfaced rather than resolved by picking a favourite. The note tells Priya something she can act on, respects that she has to work with the CTO afterwards, and asks for something proportionate to four weeks of tenure |
Nearly | The order is sound but the reasoning is thin, or contradictions are noted in the inventory and then dropped from the note, or the note asks for more authority than the situation supports |
Not yet | No reasoning beside the scores, or a note that delivers a verdict, or a submission that waited for certainty and so recorded nothing provisional |
The hardest thing in this assessment is not finding sixteen systems. It is writing a note that is true, useful and survivable, from a post with no authority, in week four, about a paper the Committee has already noted.
Where this goes
Keep this inventory. It is not an exercise that ends here.
Week eleven
risk classifies it.
Week thirteen
assesses the suppliers on it.
Week fifteen
decides which entries are high risk under the EU AI Act, and the Talentflow position you identified today is what makes that week land.
Week nineteen
turns it into the board paper that goes to Dr Ostrowski.
This is the thread. Everything else attaches to it.
Part One Assessment: Model Answer and Rubric
Read this against what you submitted. Be honest with yourself. The point is not the score, it is the gap.