What Firmli is building
Firmli is a recruitment and admissions platform founded in Oslo by Harinder Singh Aulakh, serving education institutions and recruitment agencies across more than 25 countries. Its existing product already spans recruitment, admissions, communications, partner management, and finance, which means it sits in the middle of most of the systems a university's international office or a study-abroad agency touches on a given day, long before any AI feature gets layered on top of the workflow those teams already depend on.
The planned addition, an AI Student Co-pilot due in November 2026, goes considerably further than a typical status dashboard. It is designed to pull together a student's profile, their uploaded application documents, and the full record of communications about them, including email threads, WhatsApp messages, and summaries of phone calls, into a single view that estimates how likely that student is to actually enroll, flags issues that need attention, and lets staff ask questions about an individual student in plain language.
Why recruitment data was fragmented in the first place
International student recruitment generates an unusually scattered data trail. A single applicant might email an agency counselor, message a different staff member on WhatsApp about a deadline, upload a passport scan to a portal, and discuss financing on a call that gets logged as a one-line summary. None of those systems were built to talk to each other, so counselors are left reconstructing a student's status from memory and scattered notes.
Aulakh's framing leans on that pain point directly: most education businesses already hold a significant amount of information about each student, he says, they just cannot act on it coherently. That is a reasonable diagnosis of the industry's operational problem. It is also, by design, a pitch for centralizing exactly the kind of sensitive, cross-channel personal data that privacy regulators have spent the last several years telling institutions to handle more carefully, not less.
The governance risk of merging channels into one score
Collapsing emails, WhatsApp messages, financial documents, and visa status into one AI-generated readiness score creates a single point of failure that did not exist when the data lived in separate, unconnected systems. A model that misreads a financial document or over-weights a terse, poorly translated message could quietly downgrade a real applicant's standing, with no obvious way for the student, or even the counselor relying on the score to prioritize their day, to catch the error before it meaningfully affects an actual enrollment decision.
It also concentrates risk considerably for the institutions and agencies actually deploying it. Communications data that includes financial detail and immigration status is exactly the category that triggers the strictest obligations under GDPR and similar regimes elsewhere, and an AI layer that ingests WhatsApp conversations alongside visa-readiness indicators represents a meaningfully larger data-processing footprint than the admissions systems most compliance teams have already reviewed and signed off on, which means the review has to happen again, from scratch, before launch.
The vendor's answer: permissions and visible sources
Firmli's public answer to that concern is structural rather than aspirational. Aulakh says access to the co-pilot would follow each organization's existing permission settings, so a staff member who cannot already see a student's financial documents would not gain that visibility through the AI interface. Recommendations are also meant to show their underlying sources, so a counselor can trace a readiness score back to the specific email, document, or call summary that produced it.
That source-transparency design is the right instinct, and it is worth more than most vendors offer by default. Aulakh frames it explicitly: AI should not create another dashboard for staff to monitor, and the goal is to keep the human team in control rather than hand decisions to the model. Whether the shipped product actually enforces that discipline, rather than just describing it, is the question every prospective buyer still has to answer for themselves.
What's still unverified
Every specific claim about the co-pilot, the permission inheritance, the source citations, the conversion-probability estimates, currently comes from the company itself, ahead of a launch that has not happened yet. There is no published accuracy benchmark, no named pilot institution describing results, and no independent review of how the model handles edge cases like a WhatsApp message written in a language the underlying system was never specifically tuned for, or a call summary that drops important context.
Pre-launch announcements commonly work this way across the industry, so the gap is not unusual on its own. It does mean the tool deserves evaluation as a roadmap rather than a proven product for at least the next two quarters. Existing Firmli clients get first access, with no public date yet for a broader rollout, so the real test of whether the governance claims hold up in daily practice will play out quietly inside institutions that are not yet willing to name themselves publicly.
The buy-side checklist for similar AI layers
Any institution or agency considering Firmli's co-pilot, or a comparable tool from a competing platform, should ask for specifics before onboarding rather than after signing: which communication channels actually feed the model, whether WhatsApp data is retained and for exactly how long, whether the readiness score can be audited after the fact when a decision is challenged, and whether permission inheritance has actually been tested against the organization's real access rules rather than assumed to work from a generic default configuration.
The broader pattern is worth watching well beyond Firmli specifically. As more edtech vendors pitch AI layers that unify previously siloed communications data into a single score or dashboard, the compliance burden shifts earlier into the sales cycle rather than staying with IT after the contract is signed. CIOs and data protection officers at universities and agencies should treat any pitch that promises to merge WhatsApp, email, and financial records into one score as a data-processing decision first, and only a productivity feature second.
