AI Hiring Bias and the Law: A 2026 CTO Compliance Checklist

The four regulatory frames every CTO needs to know

EEOC — Title VII liability sits with the employer

The EEOC issued technical assistance in May 2023 making explicit that Title VII applies to AI hiring tools used by the employer, even when the tool was built by a vendor. Disparate-impact liability cannot be transferred via contract. Do: verify the vendor publishes adverse-impact statistics and update the verification annually. Don\'t: rely on a vendor SLA that promises "Title VII compliance" — that language doesn\'t mean what it sounds like.

NYC Local Law 144 — bias audit + candidate notice

Effective July 5, 2023. Any "automated employment decision tool" used on a NYC candidate requires an independent bias audit (selection-rate analysis across protected categories) published within the last year, plus notice to the candidate at least ten business days before use. Do: centralise the bias-audit publication so candidates can find it in one click. Don\'t: assume LL 144 applies only to candidates in NYC offices — the relevant attribute is the candidate\'s location.

Illinois AIVIA — video-specific consent and destruction

Effective January 2020, the Artificial Intelligence Video Interview Act requires explicit consent from candidates before AI is used to analyse video interviews, plus destruction of the video on candidate request. Maryland has similar provisions. Do: build the consent step into the candidate experience explicitly rather than burying it in a privacy policy. Don\'t: retain interview video any longer than your stated retention period — destruction-on-request is enforceable.

EU AI Act — high-risk classification

Annex III of the EU AI Act lists AI systems used in employment, worker management, and access to self-employment as high-risk. Providers must complete conformity assessments. Deployers (employers using the tools) must use them per their intended purpose, maintain logs, and provide transparency to candidates. Phasing in through 2026-2027. Do: verify vendor conformity-assessment status as part of procurement. Don\'t: assume your existing GDPR processes cover it — they don\'t.

The procurement checklist

Walk through these twelve points with the vendor before signing. If they cannot answer most of them clearly, do not buy the tool.

1. Most recent independent bias audit — date, auditor name, headline impact ratios, link to public summary.
2. Data retention schema — what is stored about each candidate, for how long, in which jurisdictions.
3. Candidate-notice language — the exact text the candidate sees, and when.
4. Opt-out path — what happens if a candidate declines AI evaluation. (If the answer is "they cannot apply," that is a legal exposure, not a policy.)
5. Human-review override — can a recruiter overrule an AI score, and is that override logged?
6. Model-card transparency — does the vendor publish a model card describing intended use, limitations, and tested populations?
7. EU AI Act conformity assessment — provider status, deployer obligations, CE marking if applicable.
8. NYC Local Law 144 alignment — current audit date, publication URL, notice flow.
9. Illinois AIVIA consent flow — applicable for any video-analysing product, even outside Illinois.
10. EEOC defensibility — would the vendor sit beside you in a Title VII investigation and explain their model?
11. Integration logs — what is logged on every scoring decision, and for how long.
12. Termination clause — on contract end, what happens to the candidate data the tool has accumulated about your pipeline.

None of this is legal advice. Run all of it past actual counsel before procurement. But if the vendor cannot give you concrete answers to these twelve, you do not have enough information to buy.

Related guides