On Monday, a recruiter loads 2,000 resumes into a screening tool. By Wednesday, 200 candidates are on the shortlist, and nobody on the team can say exactly why those 200. If a regulator, a rejected candidate or a lawyer asked tomorrow how the tool made its choices, could you explain it?
For many companies, the honest answer is no. AI screening has spread fast, and the hidden risks of AI recruitment are now showing up in courtrooms and regulations. At the same time, the rules around it have become stricter and far more scattered. This guide gives you the plain-language version: what the 2026 rules say, what a bias audit actually checks, and a 10-point checklist you can start using this month.
One note before we begin. This is a general guide, not legal advice. Rules differ by city, state and country, and they are still changing, so confirm the details with your employment lawyer.
Quick answer: If you use AI to screen, rank, score or reject candidates, you are probably covered by at least one law, and you remain responsible for the results even when a vendor built the tool. The safest position is simple: know what the tool does, test its results for bias at least once a year, tell candidates when it is used, and keep a named person accountable for every final decision.
Why This Has Become Urgent in 2026
In 2025, a US federal judge allowed an age discrimination case against Workday, over its AI screening tools, to move forward as a collective action. The claims are allegations and the case is ongoing. But it sent a clear signal: when an automated tool filters candidates, both the employer and the company that built the tool can end up answering for the outcome.
At the same time, new laws keep arriving. New York City, Illinois, California, Colorado and the European Union have all taken different approaches, and a company that hires across locations can fall under several of them at once.
Compliance is also about trust. Candidates increasingly ask whether a company’s hiring is fair, and a team that cannot explain its tools loses credibility quickly. Our guide on how to improve the candidate experience during hiring explains why that trust shapes who applies in the first place.
Where the Main Rules Stand Right Now
This section is a quick snapshot. For a wider overview, read our guide to AI hiring laws for recruiters.
New York City: Local Law 144
If you use automated tools to screen candidates or employees for jobs in New York City, you need an independent bias audit every year, a public summary of the results on your website, and advance notice to candidates that includes how to request an alternative process. Fines can reach $1,500 per violation.
In December 2025, the New York State Comptroller called the city’s enforcement of this law ineffective, and the city agreed to act on most of the recommendations. Weak enforcement is not permission. Expect more scrutiny, not less.
Illinois
Since January 1, 2026, Illinois law covers discrimination that comes from using AI in hiring, firing, discipline and training. Employers must tell applicants and employees when AI is used for those decisions. State regulators proposed detailed notice rules in May 2026 and withdrew them in June, so the exact format is still unsettled. Clear notice is the safe route in the meantime.
California
Since October 1, 2025, California’s civil rights regulations on automated-decision systems apply to tools that make or help make employment decisions. Separate privacy rules on automated decision-making begin on January 1, 2027.
Colorado
Colorado’s original AI Act was delayed and then, in May 2026, replaced with a narrower law built around notice and disclosure. The new law takes effect on January 1, 2027, and draft rules were published in August 2026.
European Union
The EU AI Act treats AI used in recruitment as high risk. The strict obligations were due on August 2, 2026, but an agreement approved by the European Parliament on June 16 and by the Council on June 29, 2026,
moves the date for stand-alone high-risk systems to December 2, 2027. If you hire in Europe, use that time to prepare rather than to wait.
The federal picture in the US
A December 2025 executive order targets what it calls excessive state AI regulation, and talks about national rules continue. Until something concrete replaces the state laws, the practical advice is to follow the strictest rule that applies to you.
Because the picture moves quickly, check the current status of each rule before you act on this summary.
What Is a Bias Audit, in Plain Words?
A bias audit checks whether a tool selects people from different groups at noticeably different rates. The most common measure is the impact ratio, which comes from the four-fifths rule that US regulators have used since 1978. If one group’s selection rate is below 80 percent of the highest group’s rate, it is treated as a warning sign.
Here is a simple example. Say a tool moves 40 percent of male applicants to the next round but only 28 percent of female applicants. Divide 28 by 40 and you get 0.70, which is below 0.80. That does not prove discrimination, but it tells you to investigate and be ready to explain or fix the cause.
New York City’s law specifically requires testing by sex and by race and ethnicity. Many employers also test for age and disability, because those are common areas of complaint.
The 2026 Bias Audit Checklist: 10 Points
1. List every tool that touches a candidate. Resume parsers, ranking tools, chatbots, video and skills assessments, job-matching features and the “recommended candidate” scores inside your ATS. Many teams discover tools they had forgotten.
2. Mark what each tool actually decides. Does it reject, rank, or only suggest? A tool that filters or scores people carries more risk than one that schedules interviews.
3. Map where your candidates live. Many rules follow the candidate’s location, not your office. Hiring remotely across states means more rules to meet.
4. Get the vendor’s documentation. Ask how the tool was trained, what data it uses, how it was tested and whether a bias audit report exists. If a vendor cannot share this, that is your answer.
5. Run or commission an independent bias audit. Do it at least once a year, and again after major changes to the tool or your job criteria. Use real outcomes from your own candidates.
6. Check selection rates by group. Calculate the impact ratio at each stage, not just at the final shortlist. Flag anything below 0.80 and look into why.
7.   Look at the inputs, not only the outputs. Watch for data that quietly stands in for protected traits, such as graduation year, employment gaps, postcodes or names. A shift toward skills-based hiring can reduce how much your process depends on these proxies.
8. Give candidates notice and an alternative. Tell them AI is used, what it looks at and how to ask for human review or an accommodation. Post audit summaries where the law requires it.
9. Keep a human accountable. A named person should review rejections, be able to override the tool and sign off on final decisions. “The system said so” is not an answer.
10. Document everything and repeat. Keep audit reports, notices, decisions and overrides, and put the next review date in the calendar.
Questions to Ask Any AI Hiring Vendor
· Who audited the tool, and when? Can we see the full report?
· What data was it trained on, and how do you check it for bias?
· Can we see why it ranked or rejected a specific candidate?
· What happens when it is unsure? Does it pass the case to a person?
· How is candidate data stored, and for how long?
· Will you support us if a candidate files a complaint?
The same questions apply when you outsource part of your sourcing. Our comparison of RPO vs EOR explains where responsibility sits in each model.
Five Mistakes Companies Make
· Assuming the vendor carries the risk. Contracts can share costs, but the employer usually stays responsible for hiring decisions.
· Testing once, at launch. Tools, data and job criteria change. A single test goes stale quickly.
· Auditing only the final shortlist. Bias can enter early, at the resume screen, long before the shortlist exists.
· Treating candidate notice as fine print. Notice is a legal duty in some places and a trust signal everywhere.
·     Removing people to save time. Speed is useful, but a tool with no human review turns a small error into a repeated one. Our do’s and don’ts of recruitment automation go deeper on this.
Where Human Judgment Still Matters
AI can sort, summarise and schedule faster than any team. It cannot be accountable. That part still belongs to people, and it is a leadership question as much as a technical one. If you are thinking about how far to trust automation, start with our guide on using AI ethically in recruitment.
A good rule of thumb: let the tool handle repetitive work, and keep people responsible for any decision that affects someone’s livelihood.
How Get Workz Can Help
At Get Workz, we help companies build hiring processes where technology supports recruiters instead of replacing their judgment. If you want to review your process, or hand the day-to-day work to an experienced team, our RPO services are a good place to begin.
Want a Second Look at Your Hiring Process? Talk to Get Workz
Tell us how you hire today, which tools you use and where you recruit. We will help you spot the gaps and decide what to fix first. Contact the Get Workz team to start the conversation.
Final Thoughts
AI hiring tools are not going away, and they do not need to. The risk is not in using them. It is in using them without knowing what they do, without testing the results, and without a person standing behind the decision.
Start with the checklist. List your tools, ask your vendors the hard questions, test your results, and write down what you find. Companies that do this now will be ready when the rules tighten, and candidates will notice the difference.
FAQs on AI Hiring Tools and Bias Audits
1. Is using AI in hiring legal in 2026?
In general, yes. But it is regulated, and the rules depend on where your candidates are located. Some places require audits or notice, and anti-discrimination law applies everywhere.
2. Do I need a bias audit for my AI hiring tool?
New York City requires an independent bias audit every year for covered tools. Elsewhere an audit may not be mandatory, but it is the best evidence that you tested your tools for fairness.
3. What is the four-fifths rule?
It is a long-standing US guideline. If one group’s selection rate is less than 80 percent of the highest group’s rate, it is treated as a sign of possible adverse impact that needs a closer look.
4. Who is responsible if the vendor’s tool is biased?
Usually the employer remains responsible for its hiring decisions. Courts are still working out how much responsibility vendors carry, as the Workday case shows.
5. Do candidates have to be told that AI is used?
In New York City and Illinois, yes. Even where it is not required, clear notice is good practice and builds trust.
6. How often should we audit our tools?
At least once a year, and again after any major change to the tool, the data it uses or your job criteria.
7. Does the EU AI Act apply if our company is outside the EU?
It can, when a tool is used on candidates located in the EU. Speak with legal counsel about your specific case.
