Compliance & Fair Hiring for HR AI
No enterprise AI use case draws more legal scrutiny than automated hiring. Any agent that sources, scores, screens, ranks, or filters candidates can create discriminatory outcomes, and a growing patchwork of federal, state, city, and EU rules now governs how these tools may be used. The obligations below are the ones every HR AI buyer needs to work through before a tool touches a real candidate. This is general information, not legal advice — confirm your specific obligations with employment counsel.
EEOC / Title VII Adverse Impact and the Four-Fifths Rule
Title VII applies to algorithms: The EEOC has been explicit that using an algorithmic decision tool for hiring is subject to the same Title VII disparate-impact standards as any other selection procedure, under the long-standing Uniform Guidelines on Employee Selection Procedures. The four-fifths rule is the common screen: if the selection rate for any protected group is less than 80% (four-fifths) of the rate of the highest-selected group, that is generally treated as evidence of adverse impact. The EEOC has cautioned that the four-fifths rule is a rule of thumb, not a safe harbor — smaller differences can still indicate adverse impact. If a tool produces adverse impact, the employer must be able to show the selection procedure is job-related and consistent with business necessity, with no less-discriminatory alternative that is equally effective. Crucially, an employer generally remains responsible even when the tool is built and run by a third-party vendor.
NYC Local Law 144 (Bias Audits for AEDTs)
New York City's Local Law 144 took effect on January 1, 2023, with the Department of Consumer and Worker Protection beginning enforcement on July 5, 2023. It prohibits employers and employment agencies from using an Automated Employment Decision Tool (AEDT) for candidates or employees in NYC unless three conditions are met: the tool has undergone an independent bias audit within the prior year, a summary of the audit results is publicly available, and candidates receive notice — generally at least 10 business days before the tool is used — that an AEDT will be used and how to request an alternative. Penalties accrue per violation and per day of use without a valid audit. If any tool in your stack scores, ranks, or filters candidates, assume Local Law 144 is in scope for NYC applicants and treat the audit as a prerequisite to launch.
EU AI Act (Employment AI as High-Risk)
The EU AI Act classifies AI systems used for recruitment, candidate selection, and employment decisions — including task allocation, evaluation, and promotion or termination — as high-risk, which brings obligations such as risk management, data governance, technical documentation, human oversight, transparency, and post-market monitoring. Under the 2026 "Digital Omnibus" package, the application of the high-risk obligations for these Annex III use cases has been deferred — reporting indicates a move toward late 2027 rather than August 2026 — but the classification stands and penalties for non-compliance are steep. Any organization hiring in the EU should treat employment AI as high-risk and build documentation and oversight now rather than waiting for the deadline. Confirm the current timeline with counsel, as the Omnibus terms were still being finalized in mid-2026.
GDPR & Automated-Decision Rights
Under the GDPR, candidate and employee data is personal data requiring a lawful basis, data minimization, and defined retention. Article 22 gives individuals rights around decisions based solely on automated processing that produce legal or similarly significant effects — which can include a fully automated hiring rejection — typically requiring meaningful human involvement, the ability to contest the decision, and transparency about the logic involved. Keeping a genuine human in the loop on adverse decisions is both a fairness safeguard and a compliance mechanism.
Illinois AI Video Interview Act & Human Oversight
Illinois' Artificial Intelligence Video Interview Act requires employers using AI to analyze video interviews to notify applicants beforehand, explain how the AI works and what it evaluates, and obtain the applicant's consent — with additional deletion rights on request. Illinois has since broadened its Human Rights Act to address discriminatory use of AI in hiring and promotion. The throughline across every one of these regimes is the same: transparency, testing for bias, and human-in-the-loop review of any adverse decision. Never let an agent autonomously reject a candidate.
Vendor Due Diligence Checklist: Before deploying any AI agent that touches hiring or employment decisions, verify:
Bias Audit / Local Law 144
Vendor supports an independent bias audit within the prior year, publishable results, and candidate notice for AEDTs used with NYC applicants.
Adverse-Impact Testing
Documented four-fifths-rule and disparate-impact testing across protected groups, with evidence of job-relatedness for any tool that scores or ranks candidates.
Candidate Notice & Consent
Built-in candidate notification, explanation of the AI's role, and consent capture where required (for example, video-interview analysis under Illinois law).
EU AI Act High-Risk Readiness
Risk management, technical documentation, transparency, and human-oversight features aligned to high-risk obligations for employment AI in the EU.
Data Security & Retention
Encryption in transit and at rest, defined candidate-data retention and deletion, GDPR lawful basis, and SOC 2 Type II or equivalent controls.
Human Review of Decisions
Configurable human-in-the-loop review so no adverse hiring decision is made solely by the agent, with the ability to explain and contest outcomes.
