Do these AI laws apply to my firm if the tool is built by my ATS vendor, not us?

Yes. Under NYC Local Law 144, the employer or employment agency using the tool is on the hook, not just the vendor. Colorado's AI Act puts duties on both developers and deployers, and you are the deployer. You cannot point at your ATS and walk away. Get the vendor's bias audit results and documentation in writing, and keep them on file.

We only place candidates in a few states. Does Colorado or NYC still matter?

Probably. NYC's rule applies to candidates who work or apply for jobs in New York City, even if your office is elsewhere. Colorado's AI Act covers Colorado residents affected by your decisions. If you source nationally, you almost certainly touch both. More states are copying this language, so build one standard that covers the strictest rule and apply it everywhere.

What is the fastest way to know if we have a problem right now?

List every tool that scores, ranks, filters, or recommends candidates. Then ask three questions for each one. Do we have a bias audit less than a year old? Do we tell candidates we use it? Do we have a written policy naming who owns it? If you cannot answer yes to all three for even one tool, you have a gap to close before your next client security review or audit.

The AI Governance Gap in Staffing: Your Audit Checklist

Only 20% of organizations have documented AI governance policies, per Checkr's 2026 report. If you use AI to source, screen, or rank candidates, you are in the other 80%. Here is the checklist to fix that this quarter.

Only 20% of organizations have a documented AI governance policy. That number comes straight from Checkr's 2026 State of Screening report. If you run a staffing firm and you use AI to source, screen, or rank candidates, the odds say you are in the other 80%.

That was fine two years ago. It is not fine now.

Colorado's AI Act is live. New York City enforces bias audits under Local Law 144. More states have bills moving through their legislatures right now. The rules stopped being theoretical, and staffing sits right in the crosshairs because your whole business is making decisions about people.

Here is the uncomfortable part. Most firms do not know they have a problem until a client's procurement team sends a security questionnaire, or a candidate files a complaint, or a regulator asks for records you never kept. By then you are reacting, and reacting is expensive.

This article gives you the checklist to get ahead of it. No legalese. Just the things a busy VP can put in motion this quarter.

Why staffing firms are more exposed than most

A software company that uses AI internally makes decisions about its own people. You make decisions about thousands of people who are not your employees, for clients who will absolutely throw you under the bus if something goes wrong.

Think about what your tech stack actually does. Your ATS ranks candidates. Your sourcing tool decides who shows up in a search. Your screening software scores resumes. Your chatbot decides who advances. Every one of those is an automated employment decision tool under the new rules.

You are the deployer. Under Colorado's law, the deployer has real duties. Under NYC's law, the employment agency using the tool is responsible, not just the company that built it. Pointing at your vendor does not make the risk go away.

And here is the money problem. Clients are starting to ask. PE-backed portfolios are adding AI compliance to their diligence checklists. If you cannot answer the questions, you lose the deal or you take a valuation hit. The legal exposure is real, but the commercial exposure hits faster.

The five-part governance checklist

You do not need a 40-page policy document to start. You need to know five things and be able to prove them. Work through these in order.

1. Build a tool inventory

List every tool that touches a hiring decision. Sourcing, screening, ranking, matching, chatbots, and any scoring feature inside your ATS or CRM. For each one, write down what it does, what data it uses, and who the vendor is.

Most firms cannot produce this list in an afternoon. That alone tells you how big the gap is. You cannot govern what you have not counted.

2. Get a bias audit for anything that scores or ranks

NYC requires an independent bias audit within the last year for automated employment decision tools. Colorado requires impact assessments. If your vendor performed an audit, get the results in writing and read them. If they did not, that is a red flag about the vendor, not just a compliance gap.

Ask the vendor directly. When was the last bias audit? Who ran it? Can I have the summary? A good vendor answers in a day. A bad one stalls, and now you know something useful.

3. Fix your candidate notices

NYC requires you to tell candidates when an automated tool is used, at least ten business days before use, and let them request an alternative. Colorado has its own notice rules. Most career pages say nothing about AI.

Add plain-language notice to your application flow and job postings. Tell people a tool is involved, tell them what it evaluates, and give them a way to ask questions. This is a website update and a template change, not a rebuild.

4. Assign an owner

Governance dies when it belongs to everyone, which means it belongs to no one. Name one person who owns AI compliance. Could be a VP of Ops, a compliance lead, or you. That person keeps the inventory current, collects the audit documents, and reviews new tools before they go live.

Write their name down in the policy. When a client asks who owns this, you have an answer.

5. Keep records you can hand over

Every rule here shares one theme. You must be able to show your work. Keep the tool inventory, the bias audit summaries, the candidate notices, and a short written policy in one folder. Date everything. Review it twice a year.

When the security questionnaire or the audit request lands, you send a folder instead of scrambling for a month.

What this actually costs you if you skip it

NYC penalties run up to 1,500 dollars per violation, and each day and each candidate can count as a separate violation. That adds up fast when you screen at volume. Colorado's enforcement sits with the Attorney General and carries its own teeth.

But the fine is not the real cost. The real cost is the enterprise client who drops you during a security review. The PE buyer who discounts your firm because your AI use is undocumented. The candidate complaint that turns into a news story your best clients read.

You built a firm that clients trust with their hiring. Undocumented AI use quietly puts that trust at risk. Documented governance protects it and, honestly, becomes a selling point when your competitors cannot answer the same questions.

Do this one thing this week

Open a spreadsheet and start the tool inventory. List every system that scores, ranks, filters, or recommends candidates. Add a column for the vendor, a column for the last bias audit date, and a column for whether you notify candidates.

You will fill some cells with question marks. Those question marks are your gap, and now you can see it. That single spreadsheet turns a vague worry into a fixable list.

Do not wait for a client or a regulator to build it for you. Build it yourself, on your terms, this week.

The AI Governance Gap: Why 80% of Staffing Firms Are One Audit Away From a Legal Problem