AI for HR and Recruitment: Complete Compliance Requirements 2026
AI in hiring is the most heavily regulated AI use case globally. NYC Local Law 144, EU AI Act Annex III, Colorado SB 26-189, GDPR Article 22, and US federal civil rights laws all apply simultaneously. If you use AI to screen resumes, schedule interviews, score candidates, or make promotion decisions — this guide is for you.
Why HR AI Is the Highest-Risk AI Use Case
Three factors combine to make employment AI more heavily regulated than almost any other domain:
Consequential decisions with protected characteristics
Employment decisions affect income, career progression, and economic security. They also frequently involve characteristics protected by civil rights law: race, gender, age, disability, religion, national origin.
Explicit high-risk classification
The EU AI Act (Annex III) and NIST AI RMF both explicitly list employment/recruitment AI as high-risk. Colorado's current law, SB 26-189, dropped the "high-risk AI system" framework entirely (that was the repealed SB 24-205) in favor of ADMT transparency duties — but employment is still one of its expressly covered decision categories.
Proven bias in practice
Multiple documented cases: Amazon's AI recruiting tool biased against women, HireVue scrutinised by EEOC, companies facing OFCCP audit based on AI-filtered applicant data. Regulators cite these cases in every enforcement action.
HR AI Compliance by Jurisdiction
NYC (Local Law 144)
In forceCovers: Automated Employment Decision Tools (AEDTs) used in hiring or promotion
Requires: Annual independent bias audit; public disclosure of audit results; candidate notice before use
Penalty: $500-$1,500/day per violation
Deadline: In force since July 2023 — enforcement active
EU (EU AI Act Annex III)
High-risk deadline Dec 2027Covers: AI for recruitment, selection, promotion, task allocation, monitoring and evaluation of employment contracts
Requires: High-risk AI full requirements: conformity assessment, technical documentation, human oversight, bias testing
Penalty: Up to €15M or 3% of global turnover
Deadline: December 2, 2027 (deferred from August 2, 2026 by the Digital Omnibus)
Colorado (SB 26-189)
Effective Jan 1, 2027Covers: Consequential decisions about employment, promotion, compensation, or termination influenced by ADMT
Requires: Pre-use notice; 30-day post-adverse-outcome disclosure; data correction + human review on request; 3-year recordkeeping. No impact assessment (removed from the repealed SB 24-205).
Penalty: Up to $20,000 per violation ($50,000 if against an elderly person); Colorado AG only, no private right of action
Deadline: January 1, 2027
Illinois (AIVIA + HB 3773)
In forceCovers: AI that analyzes video interviews (AIVIA) plus any AI used across the employment lifecycle (HB 3773)
Requires: AIVIA: written consent before interview, explanation of how AI evaluates candidates, 30-day deletion on request. HB 3773 (separate law): discriminatory-effect ban, ZIP-code proxy ban, AI-use notice.
Penalty: AIVIA: no monetary-penalty schedule, no private right of action. HB 3773: IDHR civil-rights remedies (damages, back pay, scaling civil penalties).
Deadline: AIVIA in force since 2020 (not amended); HB 3773 in force since January 1, 2026
GDPR (EU/EEA)
In forceCovers: Processing personal data in AI-driven recruitment or employment decisions
Requires: Legal basis for processing; DPA with AI vendors; DPIA for high-risk processing; Art.22 rights for automated decisions
Penalty: Up to €20M or 4% of global turnover
Deadline: In force — ongoing obligation
ECOA / Title VII (US)
In force (statute); EEOC AI guidance withdrawnCovers: AI tools that have disparate impact on protected classes in hiring
Requires: Validation studies showing job-relatedness; adverse impact analysis (80% rule); Title VII/UGESP compliance
Penalty: Federal civil rights enforcement; class action liability
Deadline: EEOC withdrew its 2023 AI-specific technical guidance from eeoc.gov in January 2025 — Title VII/UGESP still apply directly
NYC Local Law 144 Bias Audit: What "Independent" Really Means
NYC LL144 is the most specific AI hiring regulation in force globally. Its bias audit requirement is being watched by regulators worldwide as a template. Here is what each element of the requirement actually means:
Scope of audit
The audit must cover the AI tool or algorithm as actually used in your hiring process — not a generic audit from the vendor. NYC LL144 specifically requires auditing the tool as used by each employer.
What is measured
Selection rate by race/ethnicity and gender. NYC uses the "impact ratio" metric: the selection rate of the least-selected category divided by the most-selected category. Ratios below 80% (the EEOC 4/5ths rule) indicate potential disparate impact.
Who conducts the audit
Must be an independent auditor — not the AI vendor who built the tool. The independent auditor must have no material relationship with the employer or vendor.
Publication requirement
Audit results, including the bias score for each category, must be published on the employer's website. Results must include: the date of the audit, the data used, and the impact ratios.
Candidate notice
Before using an AEDT on a candidate, the employer must notify the candidate: (1) that an AEDT will be used; (2) the qualifications and characteristics it uses; (3) how to request accommodation.
GDPR Article 22 in Recruitment: The Right Not to Be Decided by AI
GDPR Article 22 gives candidates the right not to be subject to solely automated decisions that produce significant legal or similarly significant effects. Rejection from a job application clearly qualifies as "significant."
What "solely automated" means
If a human meaningfully reviews the AI's recommendation before a final decision, the decision is not "solely automated" — the Art.22 absolute prohibition does not apply. However, rubber-stamp human review (human who always follows AI) does not count: the EDPB has clarified that human review must be meaningful and capable of overriding the AI.
The three exceptions to Art.22
Solely automated decisions are permitted if:
- • Necessary for entering into a contract (e.g., automated pre-screening) — but candidate must be told and can request human review
- • Authorised by EU or member state law — includes Applicant Tracking System automated filtering in some contexts
- • Based on explicit consent — rarely appropriate in recruitment given the power imbalance between employer and candidate
HR AI Compliance Checklist 2026
Inventory all AI tools used in hiring, promotion, performance management, and compensation
Classify each tool by jurisdiction (NYC employer? EU-facing hiring? Colorado operations?)
Determine which tools qualify as AEDTs under NYC LL144 and high-risk under EU AI Act
Commission independent bias audits for NYC AEDT tools — before each year of use
Publish NYC bias audit results on company website
Implement candidate notice process for all jurisdictions requiring pre-use disclosure
Conduct GDPR DPIA for AI recruitment processing; ensure DPA with all AI HR vendors
Build human review mechanism: no AI tool makes final hiring/promotion decision without human review
Document appeals process: candidates can request explanation and human review of AI decisions
Train HR staff on AI limitations, bias risk, and escalation procedures
Map Your HR AI Compliance Obligations
Aegis Firma identifies which HR AI laws apply based on your locations and AI tools — with task lists, deadlines, and evidence collection for NYC, EU, and Colorado compliance.
Run a Free Risk Assessment