Bias, regulation and candidate rights
This chapter is general information, not legal advice. Rules change; check with counsel in your jurisdiction.
Why regulators care
Hiring decisions affect livelihoods, and models trained on past hiring can encode past discrimination invisibly. Regulators have responded by targeting automated decisions that affect selection, which is why screening and matching tools face more rules than outreach or note-taking tools.
The main rules
| Rule | Who it covers | What it requires |
|---|---|---|
| New York City Local Law 144 (2023) | Employers using automated employment decision tools for NYC roles | Annual independent bias audit, public summary of results, notice to candidates, alternative process on request |
| EU AI Act (phased 2025–2027) | Providers and deployers of AI used in recruitment and selection in the EU | Classified high-risk: risk management, data governance, human oversight, transparency to candidates, logging, conformity assessment |
| GDPR Article 22 | Any processing of EU/UK residents' data | Right not to be subject to solely automated decisions with significant effects; right to explanation and human review; lawful basis for enrichment and profiling |
| US federal (Title VII, ADA, EEOC guidance) | US employers | Employer liable for disparate impact of tools it uses, including vendor tools; accommodations for disabled candidates in AI assessments |
| State laws (Illinois AI Video Interview Act, Colorado AI Act, California regulations) | Employers in those states | Notice and consent for AI video analysis; impact assessments; anti-discrimination duties for high-risk AI |
What this means for employers
- Keep a human decision point before any rejection influenced by a model.
- Ask vendors for bias audit results, adverse-impact analysis and the ability to explain individual outputs.
- Tell candidates when AI is used in assessment and offer an alternative.
- Check the lawful basis for contact enrichment and outreach data in each country; email outreach to professionals is generally permitted on legitimate-interest grounds in many jurisdictions with opt-out, but the rules on SMS and on scraping differ.
- Outreach, scheduling and note-taking tools carry far less regulatory exposure than screening tools; start there if risk tolerance is low.
What this means for candidates
- In NYC and the EU you are entitled to know when an automated tool assessed you and, in the EU/UK, to request human review of a solely automated decision.
- You can ask any employer how AI was used in your application; many will answer even where not required.
- If a one-way video interview is scored automatically, you may be entitled to notice and, in some states, consent.
- Personalised outreach you did not ask for is usually lawful; a reply of "please remove me" must be honoured by reputable tools.
Questions on this chapter
Does NYC Local Law 144 apply to AI sourcing tools?
It applies to tools that substantially assist or replace discretionary decisions on hiring or promotion. Sourcing and outreach tools that find and contact candidates, leaving all selection to humans, are generally outside its core scope; screening and ranking tools used to filter applicants are inside it. Confirm with counsel for your setup.
Is AI recruiting legal in the EU?
Yes, but AI used for recruitment and selection is classed as high-risk under the EU AI Act, which brings documentation, oversight and transparency duties, and GDPR limits solely automated decisions. Compliance is achievable; it requires process.