AI Compliance in Employment and HR: Bias Audits, Notices, and Liability

Who is liable when an AI hiring tool discriminates?

Both the employer and the vendor can be liable when an AI hiring tool discriminates. Employers often assume the risk moved to the vendor when they bought the tool; it did not.

California’s Civil Rights Council regulations define an employer’s agent to include anyone acting on the employer’s behalf, directly or indirectly, including through an automated-decision system. In Mobley v. Workday, a federal court in California let age discrimination claims proceed against the software vendor and, on May 16, 2025, preliminarily certified a nationwide collective of applicants age 40 and over. That case is still pending.

A vendor contract that says the tool is “bias-free” is not a defense for the employer. What the purchase adds is a second party who shares the duty.

What does NYC Local Law 144 require?

Local Law 144 requires an employer using an automated employment decision tool for New York City hiring or promotion to get an independent bias audit within the year before use, post a summary, and notify candidates. It covers automated employment decision tools, or AEDTs, used to substantially assist those decisions. The city’s Department of Consumer and Worker Protection (DCWP) began enforcement on July 5, 2023.

• An independent bias audit within one year before use; the employer’s or the vendor’s own staff do not count as independent
• Selection or scoring rates and impact ratios by sex, race and ethnicity, and intersectional categories
• Historical data from the tool where available; inferred demographic data cannot be used
• A posted summary of the most recent audit and the tool’s distribution date
• Notice to candidates who live in New York City that an AEDT is in use

Civil penalties run from $500 to $1,500 per violation, and each day a tool is used without a compliant audit or notice can count as a separate violation.

A December 2, 2025 audit by the New York State Comptroller found DCWP’s complaint-based enforcement ineffective. DCWP had reviewed 32 companies’ posted audits and found one issue. The Comptroller’s team reviewed the same 32 and found at least 17 potential problems. DCWP generally agreed with the recommendations while disputing some findings.

Local Law 144 does not set a pass or fail threshold. An audit that shows a low impact ratio does not itself violate the law. It does create evidence that a discrimination claim under other laws can use.

What does Illinois require?

Illinois regulates AI in employment through two laws: HB 3773, which amended the Human Rights Act, and the Artificial Intelligence Video Interview Act.

HB 3773 (Public Act 103-0804)

Effective January 1, 2026, the Illinois Human Rights Act makes it a civil rights violation for an employer to use AI in recruitment, hiring, promotion, training selection, discipline, discharge, tenure, or the terms of employment in a way that has the effect of discriminating on a protected basis. It also bars using zip codes as a proxy for protected classes, and makes failing to give notice of AI use a violation in its own right.

The law reaches effect, not only intent. A tool that screens out older applicants at a higher rate can create liability even if no one meant it to.

The Department of Human Rights was directed to write rules on when and how notice must be given. It published proposed rules in the Illinois Register on May 15, 2026, then announced on June 2, 2026 that it was postponing the rulemaking, including the June 10 hearing, and withdrew the proposal; no replacement had been adopted as of this writing. According to law firm summaries, the withdrawn draft would have required notice each year and within 30 days of adopting a new or substantially updated AI tool, naming the product, its developer and vendor, the decisions it affects, its purpose, and a contact. Until rules are final, a notice with that content is a reasonable interim approach.

Artificial Intelligence Video Interview Act (820 ILCS 42)

An employer that uses AI to analyze recorded video interviews must, before the interview, tell the applicant AI may be used, explain how it works and what it evaluates, and get consent. Videos may be shared only with those whose expertise is needed to evaluate the applicant, and must be deleted within 30 days on request. Employers that rely solely on AI analysis to decide who gets an in-person interview must report demographic data each year.

What does California require?

California treats discriminatory use of an automated-decision system as a potential violation of the Fair Employment and Housing Act, under Civil Rights Council regulations that took effect October 1, 2025.

• Using an automated-decision system that discriminates on a protected basis can violate FEHA.
• Evidence of anti-bias testing, or its absence, is relevant to a claim or defense. Testing is not required, but the absence of testing can count against you.
• Employment records, including automated-decision system data, must be kept for at least four years.
• An AI game, puzzle, or question likely to elicit information about a disability can be an unlawful pre-offer medical inquiry.
• Criminal history screening through an automated system before a conditional offer is restricted, as it is when done by hand.

Separately, the California Privacy Protection Agency’s rules cover ADMT used for significant decisions, which include employment. Those duties, including pre-use notice and an opt-out or appeal right, apply from January 1, 2027.

The governor vetoed SB 7, the “No Robo Bosses Act,” on October 13, 2025. It would have required notice before AI use in employment and barred relying solely on AI to discipline or fire workers.

What about Colorado?

Colorado’s SB 26-189 lists employment among the consequential decisions it covers. From January 1, 2027, an employer that uses automated decision-making technology that materially influences hiring, firing, or pay decisions must give notice before use, explain the technology’s role within 30 days after an adverse decision, and offer meaningful human review on request, to the extent commercially reasonable. The enacted law keeps employment decisions covered even for HIPAA covered entities that are otherwise exempt.

See the state law guide for the full requirements.

What is the federal position?

The federal agencies have stepped back from AI guidance and disparate impact enforcement in employment, but the statutes did not change, and private plaintiffs and state agencies still bring claims.

The EEOC published technical assistance on AI under Title VII and the ADA in 2022 and 2023. Secondary sources report that those documents were removed from the EEOC website in January 2025.

Executive Order 14281, signed April 23, 2025, directs agencies to deprioritize enforcement based on disparate impact, naming Title VII’s provision at 42 U.S.C. 2000e-2. Reports describe a September 2025 EEOC memo directing closure of charges that rest only on disparate impact, with notice that the charging party may sue.

Title VII still prohibits employment practices that cause a disparate impact unless they are job-related and consistent with business necessity. The ADA still requires reasonable accommodation, including in an AI-driven application process. Private plaintiffs can still sue, and state agencies such as those in California and Illinois still enforce state law.

Where does the FCRA come in?

The Fair Credit Reporting Act applies when an employer uses a consumer report, prepared by a third party, for hiring, retention, promotion, or reassignment.

That can include AI-generated reports. A vendor that assembles information about candidates from outside sources and sells scores or profiles to employers may be a consumer reporting agency, whatever the product is called.

• A standalone written disclosure and the applicant’s written authorization before obtaining the report
• A pre-adverse action notice with a copy of the report and the summary of rights
• An adverse action notice after the decision, with the agency’s contact details and dispute rights
• Certification to the agency that the report will not be used to violate equal employment laws

The pre-adverse action step matters most with AI. It is the moment a candidate can say the data is wrong.

What should an employer do now?

Test the tool, tell the candidate, and keep the record. Those three steps address the core of what New York City, Illinois, California, and Colorado ask for, and the table lists the rest.

This guide is general information as of October 2026, not legal advice. Confirm obligations with employment counsel in each state where you hire.