We use a third-party ATS with AI screening. Isn't the vendor liable, not us?

No. The laws draw a line between the developer who built the tool and the deployer who uses it to make hiring decisions. Your firm is the deployer. When you run candidates through AI screening to place them, you own the disclosure, the audit results, and the recordkeeping. The vendor built the engine. You are the one driving. Get your vendor's bias audit and disclosure language in writing, but do not assume it covers you.

We place candidates across several states. Which rules apply?

The strictest one that touches the transaction. If you are in Chicago sourcing for a New York City role and screening a candidate who lives in California, you can trigger three different regimes at once. NYC Local Law 144 wants a public bias audit and candidate notice. Illinois and California have their own disclosure and recordkeeping expectations. The safe move is to build one process that satisfies the toughest standard, then apply it everywhere. Trying to run state-by-state exceptions is how things fall through the cracks.

How far back do we need to keep AI hiring records?

Plan for at least four years, and longer if a claim is active. NYC requires you to retain data used in an audit. California's proposed rules push recordkeeping toward four years. Standard EEOC guidance already sits at one to two years for hiring records, and AI adds a layer on top. The point is not the exact number. It is that you can pull, for any placement, what tool was used, what it scored, what notice the candidate got, and when. If you cannot produce that today, you have a gap.

AI Governance Gap: Staffing's 2026 Legal Risk

Illinois, New York City, and California are enforcing AI hiring laws right now, and the liability lands on staffing firms as deployers, not vendors. The risk isn't your software. It's the fact that you can't prove what it did.

Your AI screening tool is not what gets you sued in 2026. Your inability to prove what it did is.

Three states are already enforcing AI hiring laws. Illinois, New York City, and California each have rules on bias audits, candidate disclosure, and recordkeeping. And here is the part most staffing leaders miss: the liability does not sit with the company that built the software. It sits with the company that uses it to make hiring calls. That is you.

The law calls you a deployer, not a vendor. When you run a candidate through an AI-powered ATS, an automated screener, or a resume ranker to decide who moves forward, you are deploying that tool in a hiring decision. The paperwork burden is yours. Not your software provider's.

Most firms have zero documented process to meet these rules. They bought the tools. They never built the file that proves those tools were used fairly. That file, or the missing one, is now the fastest-rising compliance exposure in staffing.

Why the Paper Trail Is the Real Risk

A biased algorithm is a problem. But you can fix an algorithm. What you cannot fix after the fact is a missing record.

When a candidate files a complaint or a regulator opens an inquiry, they do not start with your code. They start with a request for documents. Show us your bias audit. Show us the disclosure the candidate received. Show us your retention records for this placement.

If you can produce all three, you are in a defensible spot even if a tool had flaws. If you cannot produce them, you lose the argument before it starts. Silence reads as guilt in a compliance file.

This is the governance gap. Firms are focused on picking the right AI tool. Regulators are focused on whether you can document how you used it. Those are two different projects, and most firms only started the first one.

What the Three Big Regimes Actually Require

You do not need to memorize every statute. You need to know what each one demands so you can build one process that covers all of them.

New York City Local Law 144. If you use an automated employment decision tool for candidates in NYC, you need a bias audit done by an independent auditor within the past year. You must post a summary of that audit publicly. And you have to notify candidates that the tool is being used, at least 10 business days before you use it. Enforcement started in July 2023. Fines run per violation, per day.

Illinois. The state amended its Human Rights Act to cover AI in employment decisions, effective January 2026. If AI use leads to a discriminatory outcome, the employer is on the hook. There are also existing disclosure rules around AI video interviews. Illinois has a long history of aggressive enforcement on employee data. Do not treat this as a soft rollout.

California. New regulations treat automated decision systems as covered by existing anti-discrimination law. The rules push recordkeeping toward four years and make clear that using a third-party tool does not move the liability off the employer. If you place into California, you carry this weight.

Read those three together and a pattern jumps out. Every one of them wants the same thing: proof. Proof the tool was audited. Proof the candidate was told. Proof you kept the records. The details differ. The core demand does not.

Build One Process, Not Three

Here is the trap. Firms try to run a different playbook for each state where they place. That fails fast. Your recruiters move too quickly, your reqs cross state lines, and a Chicago recruiter working a New York role for a California candidate will not stop to check which rule applies.

So do not make them. Build one governance process to the strictest standard and run it everywhere. It is easier to follow and easier to defend.

A workable process has four parts.

Tool inventory. List every tool that touches a hiring decision. ATS ranking, automated screening, chatbots that qualify candidates, video interview scorers. If it filters or ranks people, it counts.
Bias audit on file. For each tool, hold a current independent bias audit. Get it from your vendor in writing and confirm it covers how you actually use the tool. If the vendor cannot provide one, that is a red flag about the vendor.
Standard candidate disclosure. Write one notice that tells candidates AI is used in screening, delivered before you screen them. Bake it into your application flow so nobody forgets.
Retention system. For every placement, store the tool used, the score or output, the disclosure sent, and the dates. Keep it for four years minimum. Make it searchable so you can pull one candidate's file in minutes, not days.

None of this requires new software. It requires a documented process and someone who owns it. That is the whole point. The gap is not a technology gap. It is a governance gap.

What This Costs You If You Wait

Play it out. A candidate you screened out files a complaint in New York. The request comes in for your bias audit and your disclosure records. You have neither because you assumed the ATS vendor handled it.

Now you are negotiating from zero. Legal fees start. The fine clock in NYC runs per day. Your PE sponsor asks why AI compliance was not in the last ops review. Your best client hears you are under investigation and quietly moves the account.

The tool did not cause any of that. The missing file did.

Do This Week

Pull your tool inventory. Sit down for 30 minutes and list every tool in your hiring flow that ranks, filters, or scores candidates. For each one, write down two answers: do we have a current bias audit on file, and do we send candidates a disclosure before we use it.

If the answer to either is no on any tool, you have found your gap. That list is the first page of your governance file, and it is the single most useful thing you can build before 2026 enforcement widens.

You do not have to solve the whole thing this week. You have to know where you stand. Most firms have never looked. Look.

The AI Governance Gap: Your Biggest Legal Risk in 2026 Isn't the Tool, It's the Paper Trail