NYC Local Law 144 was only the start. AI hiring tools now answer to federal anti-discrimination law and a growing set of state rules in California, Illinois, New Jersey, Colorado, Connecticut and Texas. Download our obligations matrix to see what each law requires you to test, when, and who owns it.
A two-page reference for counsel, HR and AI teams: every test and audit mapped to its legal driver, responsible party, cadence and required-vs-recommended status. Updated September 2026.
PDF · 2 pages · No form required
Obligations in effect, or with a confirmed effective date, as of September 2026. Each one names who owns it: the developer that builds the tool or the deployer, the employer that uses it.
Independent bias audit of automated employment decision tools: selection rates and impact ratios by sex, race/ethnicity and intersectional categories. Public results summary and 10-business-day candidate notice.
Adverse-impact analysis and a validation study of questions, rubrics and scoring. The validation file is your business-necessity defense; Mobley v. Workday keeps vendors in scope.
Disparate-impact and proxy-variable testing (ZIP codes, employment gaps, availability). No audit mandate, but liability attaches to unintentional discriminatory effects.
Anti-bias testing, with vendor liability as the employer’s agent. Testing, or its absence, is admissible evidence. Retain inputs, outputs, criteria and results for at least four years.
Screen every generated interview question for disability and medical probes, family medical history, age markers, salary history and criminal-history timing. A prohibited question is a violation even when outcomes are balanced.
Test accessibility of the interview flow, alternative formats, and whether scoring penalizes disability proxies such as gaps or speech patterns. A documented accommodation pathway is the core defense.
Consent and explanation flows, plus demographic reporting of screened-out versus advanced candidates. Biometric consent if voice or facial analysis is used.
Pre-use risk assessment for significant employment decisions, with notice, opt-out and access flows. In-use technology must comply by January 1, 2027.
Validate adverse-decision explanations: the AI’s contribution, data types and sources, and correction rights. Colorado from January 1, 2027; Connecticut from October 1, 2027.
Map your governance program to the NIST AI RMF or ISO/IEC 42001. Substantial compliance is an affirmative defense; penalties reach $200,000 per violation.
Screen whether third-party data enrichment makes outputs “consumer reports”, which brings disclosure, authorization and adverse-action duties.
Legal drivers, what actually gets tested, cadence and key artifacts for all 11 obligations, in one two-page PDF.
Download the PDFThis summary reflects obligations in effect, or with a confirmed effective date, as of September 2026. Verify current status before relying on it for a compliance decision. It is a compliance-planning reference, not legal advice.
AI tools that scan and filter resumes against criteria such as skills, qualifications and experience.
Systems that assess verbal and non-verbal cues, such as tone and word choice, to provide insights into candidates.
Tools that analyze performance data over time to identify trends and areas for improvement or recognition.
Predictive analytics that forecast turnover risk and suggest interventions to improve retention.
Asenion turns these obligations into reusable control objectives and context-aware controls for your hiring AI, by jurisdiction and by role, then verifies them and keeps the evidence.
Inventory each hiring AI system, map it to the jurisdictions your candidates are in, and run the CCPA risk assessment and NIST AI RMF or ISO/IEC 42001 conformance mapping.
Independent NYC Local Law 144 bias audits, adverse-impact and proxy-variable testing, accessibility checks, and a red-team suite for prohibited interview questions.
Jurisdiction-aware runtime filtering of generated questions, consent and explanation records, and tamper-resistant evidence retained for as long as each law requires.
Download the US HR AI obligations matrix: every test and audit mapped by legal driver, responsible party, cadence and required-vs-recommended status. Updated September 2026.