AI recruiters and hiring law: bias audits, notices and questions for vendors
This is not legal advice. We read the primary sources and the vendors’ own pages. We do not say any rule applies to your hiring. Where you recruit, how large you are and what the tool does all matter, and a lawyer should answer them.
One point is clear from the sources. The buyer keeps legal duties. New York City’s law is written about employers and employment agencies that use a tool, not about vendors that sell one (NYC DCWP). Illinois frames its notice duty as the employer’s (Public Act 103-0804). A vendor’s badge or audit can help you. It does not move your duty to the vendor.
The rules
| Rule | What it requires | Status |
|---|---|---|
| NYC Local Law 144 (automated employment decision tools) | No use of such a tool unless it has had a bias audit within one year of use, a public summary exists, and candidates and employees get notices. DCWP’s page says notice must be given 10 business days before use. | The DCWP page says enforcement would begin July 5, 2023. We saw no amendment or repeal on that page. We did not find enforcement statistics or court challenges. |
| Illinois Artificial Intelligence Video Interview Act (820 ILCS 42) | Covers an employer that asks applicants to record video interviews and uses AI analysis of those videos, for Illinois-based positions. Before asking for the video: notify each applicant that AI may be used, explain how it works, get consent. Delete interviews on request within 30 days. Demographic reporting if the employer relies solely on AI analysis to pick who gets an in-person interview. | In force since 2020-01-01. Statute |
| Illinois Human Rights Act amendment (Public Act 103-0804) | Unlawful for an employer to use AI that has the effect of discrimination on protected classes in recruitment, hiring, promotion and other employment decisions, or to use zip codes as a proxy for them. Employers must notify employees that AI is used for those purposes; the state Department is to adopt rules on when, how and in what form. | Effective 2026-01-01. |
| California Civil Rights Council regulations | Cover automated-decision systems in employment under the state anti-discrimination law. Records kept a minimum of four years. | The Council’s June 30, 2025 release says they were set to take effect October 1, 2025. Council |
| California privacy agency (CPPA) automated decisionmaking rules | The CPPA’s September 23, 2025 announcement says businesses that use ADMT to make significant decisions must comply with the ADMT requirements “beginning January 1, 2027”. CPPA | Announced as approved by California’s Office of Administrative Law. We did not read the regulation text, so we cannot say which hiring uses it reaches. |
| Colorado SB 26-189 | Lists employment among “consequential decisions”. Deployers must give consumers notice at the point of interaction with a covered tool; developers owe deployers documentation; attorney general enforces. | Signed 2026-05-14, repealing and re-enacting SB 24-205. The 05/12 final act text says the act takes effect January 1, 2027 (PDF). We read that and the bill summary, not the signed copy. Bill page |
| EU AI Act, Annex III point 4 | AI used to recruit or select people (targeted job ads, filtering applications, evaluating candidates) and to decide work terms, promotion or termination is classed as high-risk. | High-risk duties now apply from 2 December 2027, not 2 August 2026, after Regulation (EU) 2026/1744. Act, Omnibus, Commission |
Separate from the table: the AI-interaction notice in EU Article 50(1) applies from 2 August 2026 and was not delayed. See our disclosure guide.
The EEOC pages are gone
The EEOC’s two AI technical-assistance documents, one on the ADA and one on Title VII adverse impact, are not on its site. These pages return “Page not found”: the Title VII document, the ADA document and eeoc.gov/ai. The sources we read show no EEOC statement explaining the removal, so we say only that they are no longer on the EEOC website. We do not say they were formally withdrawn. Title VII and the ADA are separate from those documents, and we did not research any change to them.
What vendors publish on bias audits
These are vendor statements. We opened the pages below, not the audit reports behind them, and an audit by itself is not proof you are compliant.
| Vendor | What it publishes | What we could not check |
|---|---|---|
| HeyMilo | Monthly bias audits by Warden AI, which it says follow NYC Local Law 144 (HeyMilo). Warden’s dashboard shows a latest audit of Sep 9, 2026 and a sample size of 22,914, and lists NYC, EU, Colorado SB 26-189 and California regimes (Warden). For the EU Act it says it completed a classification analysis. | The underlying reports. We did not read HeyMilo’s own Trust Center. |
| Findem | Says it has “at least annual” independent bias audits and that its most recent third-party audit, by Warden AI, covered its applicant matching (Findem). Says it is “not intended to be used as an automated employment decision tool”. | NYC LL144 and the EU Act are not named in the text we could read. Its interview page calls AI video interviews “fully autonomous” (Findem), which pulls against that line. |
| Eightfold | “Independent bias audits published under NYC Local Law 144”, and third-party audits of its AI Interviewer (Eightfold). Describes the four-fifths rule in testing (Eightfold blog). Labels the EU Act row “Phasing in through 2027”. | The audit PDFs. |
| Juicebox | Lists an NYC LL144 bias audit document in its Trust Center. Internal bias testing “semi-annually” on sample sets of 100 test queries. Says it does not make or contribute to candidate decisions and is for the pre-application phase only (Juicebox). | The audit document itself. |
| Alex | Claims a monthly third-party bias audit and LL144 compliance (Alex blog). Says no candidate is auto-rejected without human input (Alex), while its resume-screen page describes configurable automatic pass-through for high-fit candidates (Alex). | The audit report. No EEOC statement found. |
| Paradox (now Workday) | Says it “regularly conducts bias evaluations” and points to Workday resources (Paradox). Screening can “disposition” candidates (Paradox). Workday says it completed the acquisition on Oct 1, 2025 (Workday). | No audit report or LL144 audit on the pages we opened. |
| HireVue | “Annual independent audits”; says every model passes adverse impact testing before going live; names NYLL144, EEOC and OFCCP (HireVue). | Reports and Trust Center. |
| Ribbon | Claims “2021/144 compliant” status (Ribbon). | The report. See below. |
Ribbon’s bias page also says “100% bias-free hiring”. We flag that as unsupported. An audit measures selected outcomes on a sample at a point in time; it cannot show a tool is free of bias.
Three patterns matter more than any badge. First, cadence: vendors audit monthly, semi-annually or annually, while the NYC rule is framed around an audit within one year of use of the tool, so ask which version and configuration was audited. Second, “human in the loop” is described differently across vendors, and several describe pass-through or disposition steps the AI controls. Third, everything above is the vendor’s own description. We opened pages, not reports.
15 questions for an AI recruiter vendor
- Which hiring laws did you build and document for: NYC, Illinois, Colorado, California, the EU?
- Who performed your bias audit, are they independent, and what is the date?
- Will you share the full report, not a summary or badge?
- Which product version, model and configuration did the audit cover? Is it the one we would run?
- What data and sample size were used, and was it real applicant data or test queries?
- What metrics and groups does it report (selection rates, impact ratios, the four-fifths rule, intersectional groups)?
- How often are you re-audited, and what triggers an audit after a model change?
- Can the tool reject, rank out or “disposition” a candidate automatically? Can we switch each of those off, including pass-through rules?
- What does a candidate see before a screen or interview, and how is consent captured (Illinois asks for notice, explanation and consent for video interviews)?
- Can candidates opt out, or ask for a human alternative or an accommodation?
- What is recorded, who sees it, how long is it kept, and can you delete video within 30 days of a request?
- Is candidate or customer data used to train any model, yours or a third party’s? Which foundation models do you use?
- How do you test for bias if you do not hold demographic data? Do you need us to supply it?
- What reasons does the tool give for a score, and what are its stated limits? (Juicebox itself says “complete explainability remains a challenge”.)
- What do the contract and exit terms say about audit rights, change notice, log retention (California rules set four years), incidents, indemnity, data return, and who the contracting party is after any acquisition?
What to keep for people
- Final decisions to reject or advance anyone.
- Accommodation requests and complaints.
- The notices, consents and records your lawyer says you need.
Related reading
- Best AI recruiters of 2026: sourcing and interview tools
- Do you have to tell people they are talking to an AI? What the rules say
- Security questions to ask before giving an AI employee your inbox
- 13 mistakes companies make when hiring AI employees (and 10 demo questions)
Frequently asked questions
Who carries the legal duty when an AI recruiter is used?
The buyer keeps legal duties. New York City’s law is written about employers and employment agencies that use a tool, not vendors that sell one, and Illinois frames its notice duty as the employer’s. A vendor’s badge or audit can help you, but it does not move your duty to the vendor.
What does New York City’s Local Law 144 require?
Per NYC’s own page: employers and employment agencies may not use an automated employment decision tool unless it has had a bias audit within one year of use, information about the audit is public, and certain notices have been given. This is not legal advice.
Does a vendor’s bias audit page satisfy the rules?
Treat it as the start of your homework. Ask each vendor for the report itself, its date, its sample size and who ran it. Vendor audit claims here were not verified.
What should I ask an AI recruiting vendor?
Fifteen questions are listed, including how candidate data is used to train models, what reasons the tool gives for a score, how bias is tested without demographic data, what is recorded and for how long, and what the contract says about audit rights, log retention and exit.