Every hiring team I work with in 2026 wants the same thing: an AI that reads a thousand applications in the time a recruiter reads ten, without walking the company into a discrimination claim. The second half is where projects stall. As the project manager who sets expectations before a build starts, my first job on any AI consulting engagement for a hiring product is to say the uncomfortable part plainly: a resume screener or a candidate-matching model is regulated software now, and the audit that has to prove it is fair cannot be bolted on after launch. It has to live inside the system from day one.
I call it the build gap. The demo ranks candidates beautifully. But nobody has logged a single selection rate, nobody can explain why applicant A scored above applicant B, and there is no way for a candidate to opt out or for a human to overrule the machine. Then a regulator or a plaintiff's lawyer asks to see the audit trail, and there isn't one. Below is what the law actually requires in 2026, the bias that gets flagged, and exactly what we instrument before a recruiting model goes anywhere near a live applicant.
jump in HR AI adoption in a single year
potential penalty under NYC Local Law 144 for skipping bias audits
of screening tools shown to exhibit age bias
Can you use AI in hiring without legal risk?
Yes, but only if you can prove it is fair. AI in hiring is legal in both the US and the EU, and it is spreading fast - HR teams' use of AI jumped from 26 percent to 43 percent in a single year. What is no longer defensible is running an automated screening tool you cannot audit. The risk is not that you used AI. The risk is that a candidate, a regulator, or a court asks how the model decided and you have no records, no impact numbers, and no human who reviewed the call. In regulated hiring, "we trusted the vendor's model" is not a defense. The teams that stay out of trouble are the ones who can produce a selection-rate report and a decision log on demand. That is an engineering choice you make before launch, not a policy you write afterward.
What the law now requires in 2026
Two rulebooks matter most, and a recruiting product usually has to answer to both. The short version: recruitment AI is high-risk, and skipping its bias audit is expensive.
The EU AI Act lists AI used to recruit, filter applications, and evaluate candidates as high-risk. That status brings hard duties: a risk-management process, data governance, technical documentation, automatic record-keeping (logging), transparency to the people affected, and meaningful human oversight, backed by fines that run into the millions. The EU has been moving the enforcement date for these obligations, with the latest agreements pushing the high-risk deadline past 2026, but the classification is settled and the direction is one way. It also applies based on where your candidates are, not only where your office sits.
NYC Local Law 144 is the one already biting in the US. Before you use an automated employment decision tool, an independent bias audit must have been done within the past year, its summary must be published, and candidates must be notified at least ten business days ahead. Miss it and each day of use is a separate violation, up to $1,500 a day. On top of that, US federal law already bans discriminatory outcomes through Title VII and the ADEA, the EEOC applies the four-fifths rule to selection rates, and states from Illinois to Colorado are adding their own duties of reasonable care against algorithmic discrimination. This is the environment where AI projects die faster in regulated industries, and hiring is now firmly one of them.
The bias that actually gets flagged
The bias that surfaces in an audit is rarely someone typing a banned rule. It is the model learning a proxy. The two that get flagged most are age and socioeconomic background, because both hide easily inside a resume.
Age. The ADEA protects workers 40 and over, and screening tools are unusually bad here - in one body of independent testing, roughly 47 percent of the tools examined showed measurable age bias. Graduation years, "digital native" phrasing, a cap on years of experience, even the vintage of the technologies someone lists all leak age into the score. Socioeconomic signals do the same for class and race. A zip code, a first name, the name of a school, or a gap in employment can become a stand-in for a protected characteristic, and the model penalizes it without ever being told to. The system never sees "age" or "race." It sees the shadows they cast on a CV, and a bias audit exists to catch those shadows through impact ratios rather than intent.
Compliant by design: what to instrument before launch
Compliant by design means the audit evidence is a byproduct of normal operation, not a scramble after a complaint. These are the eight things we wire into a recruiting model before it scores a real candidate. Miss any one and the audit gets much harder, and much more expensive, later.
- Disparate-impact logging - selection and scoring rates captured per group on every run, so the impact ratio is always current.
- An immutable decision log - inputs, model version, score, threshold, and outcome recorded for every candidate, tamper-evident.
- Explainability - the top factors behind each score, in plain language a recruiter or an auditor can read.
- Candidate notice and opt-out - clear disclosure that AI is used and a real alternative path, not a dead-end checkbox.
- Human override - a person can change or reject any AI recommendation, and that action is logged too.
- Model and data versioning - you can say which model and which training data made a given decision on a given date.
- Auditor export - a clean way to hand an independent auditor the numbers they need without spinning up a data project.
- Threshold monitoring - automated alerts when any group's impact ratio drifts under the four-fifths line.
None of this is exotic. It is ordinary engineering discipline pointed at a compliance problem, and it belongs in the same governance frame as the rest of your AI governance playbook.
Disparate-impact logging and the audit trail
Disparate-impact logging is the part teams most often skip, and the part an auditor asks for first. In practice it means recording, for every candidate the model touches, the score it produced, the threshold that applied, the model version, and the outcome, alongside the demographic categories the audit needs. Those categories are collected and stored separately, used only for the fairness calculation, and never fed back into scoring.
From that log you compute two numbers an auditor recognizes on sight: the selection rate for each group, and the impact ratio between groups. The four-fifths rule is the trigger - if any group is selected at less than 80 percent of the top group's rate, you have a flag to explain. The reason this has to be architecture and not a spreadsheet is simple: you cannot reconstruct rates you never recorded. If the logging starts the day the complaint arrives, your first honest audit covers zero of the decisions already made. Build the trail immutable, time-stamped, and exportable, and the annual audit becomes a report you run, not a crisis you manage.
Where a human has to make the final call
Some decisions the AI should never close on its own. My rule with clients is blunt: AI can rank, surface, summarize, and flag, but a human makes every decision that takes away a person's opportunity. Auto-rejecting an applicant with no human in the loop is the single fastest way to turn a screening tool into a legal liability.
The EU AI Act writes this in as a human-oversight duty, and it means real review, not a rubber stamp on whatever the model ranked. In the workflows we design, a recruiter sees the score and the reasons behind it, can disagree, and has to actively confirm any adverse action. The final hiring decision, any rejection at the screening gate, and any exception to the model all route to a named person whose override is logged. Keeping a human on the irreversible calls is not only good ethics. It is the control regulators and courts look for, and it is the difference between a tool that assists your recruiters and one that quietly makes unlawful decisions at scale.
Build vs buy for hiring AI
Buying an off-the-shelf tool is faster and cheaper up front, and for a small team it can be the right call. But you inherit the vendor's audit trail, the vendor's idea of explainability, and the vendor's opt-out flow, while the compliance liability stays with you as the employer. Building gives you control of exactly the things an audit examines. Here is the trade-off I walk clients through before we pick a lane.
| What an audit needs | Buy off-the-shelf | Build custom |
|---|---|---|
| Disparate-impact logging | Whatever the vendor exposes | Designed to your audit |
| Explainability depth | Often a black box | Score reasons you define |
| Candidate opt-out and override | Fixed by the product | Fits your workflow |
| Fit to your roles and data | Generic model | Tuned to your hiring |
| Who owns the liability | Still you | Still you |
| Time to first hire | Fast | Slower, deliberate |
| Cost shape | Subscription | Build, then own it |
The row that surprises people is the liability one: it never transfers to the vendor. That is why so many teams that start by buying end up commissioning a custom AI development effort once the first audit shows them how little of their own tool they can actually explain.
How we build audit-ready recruiting AI
We start every recruiting build from the audit backward. Before anyone tunes a matching score, we map what has to be logged, where a human must sit, how a candidate opts out, and how an independent auditor will get the numbers. The bias audit stops being a threat and becomes a spec. That order, compliance controls first and model second, is the whole difference between a tool you can defend and one you have to quietly retire.
We are a CMMI Level 5 team of 80-plus engineers who have delivered for 700-plus companies across the UK, US, UAE, and Australia, and our AI development work on regulated products runs on this principle: the demo is the easy 20 percent, and the audit trail is the 80 percent that decides whether you ever launch. If you are building or buying AI for hiring and are not sure your tool would survive an independent bias audit, tell us how you hire and we will show you where the gaps are before a regulator does.
Frequently Asked Questions
Is it legal to use AI to screen job candidates in 2026?
Yes, in both the US and the EU, provided you can prove the tool does not discriminate. The catch in 2026 is documentation. NYC Local Law 144 requires an independent bias audit before you use an automated hiring tool, and the EU AI Act treats recruitment AI as high-risk with its own logging and oversight duties. Legal use now means auditable use.
What is a bias audit for hiring AI?
A bias audit is an independent review that measures whether your tool selects candidates from protected groups at meaningfully different rates. Under NYC Local Law 144 it calculates selection rates and impact ratios by sex and race or ethnicity, uses the four-fifths rule as the red line, and the summary has to be published before the tool goes live.
Does the EU AI Act apply to my recruiting software?
If the tool recruits, filters applications, or evaluates candidates in the EU, yes - the Act lists recruitment AI as high-risk. That brings duties for risk management, data governance, record-keeping, transparency, and genuine human oversight. The EU has been adjusting the enforcement date, but the classification is settled, and it applies based on where candidates are, not only where your company sits.
How is disparate impact measured in hiring?
Most commonly with the four-fifths rule. You compare the selection rate of each group against the group with the highest rate, and if any group is selected at less than 80 percent of that rate, that counts as evidence of adverse impact. To calculate it at all, you have to log selection and scoring rates by group from day one.
Should we build or buy AI recruiting software?
Buying is faster, but you inherit whatever audit trail and explainability the vendor built, and the compliance liability still sits with you as the employer. Building lets you instrument disparate-impact logging, candidate opt-out, and human override the way your roles and your auditor actually need. The honest answer depends on how unusual your hiring is and how much scrutiny you expect.
Have a project in mind? Let's scope it together.
You get a named team, written estimates, full code and IP ownership, and 48-hour response times. CMMI Level 5 certified. 700+ projects delivered across the UK, US, UAE, and Australia.
