If we use a third-party AI screening tool, isn't the vendor responsible for compliance?

No. Under NYC Local Law 144 and Illinois HB 3773, the employer using the tool carries the legal obligation, and in a staffing relationship that often means your firm. Your vendor contract can shift some cost through indemnification, but it does not shift the legal duty to notify candidates, produce a bias audit, or answer a regulator. When a candidate files a complaint, the agency comes to you first. Read your vendor agreement and find out exactly what audit documentation they provide and how often. Most vendors give you a summary, not a defensible audit trail.

What counts as an AI screening tool under these laws?

More than you think. NYC calls it an automated employment decision tool, and the definition covers any software that scores, ranks, or filters candidates to substantially assist a hiring decision. That includes resume parsers that rank applicants, chatbots that pre-qualify, and matching engines that surface a shortlist. If your ATS auto-ranks candidates before a human sees them, you are likely in scope. Do not assume you are clear because you never bought a product labeled AI.

We place across multiple states. Which law applies to us?

The location of the candidate and the job usually drives it, not where your office sits. If you place a candidate for a role in New York City, Local Law 144 applies. Place in Illinois, HB 3773 applies as of January 2026. California FEHA regulations cover automated decision systems statewide. Texas RAGA gives the attorney general enforcement power over deceptive AI use in hiring. If you place nationally, build your governance to the strictest standard and apply it everywhere. Running four different processes is how mistakes happen.

Your AI Screener Is a Legal Liability for Staffing Firms

Four AI hiring laws are actively enforced in 2026, and your vendor contract will not save you when a candidate files a complaint. Here is the audit trail every staffing firm needs before the next req closes.

Four AI hiring laws are being enforced right now, and your vendor contract does not protect you from any of them. NYC Local Law 144, Illinois HB 3773, California FEHA regulations on automated decision systems, and Texas RAGA are all active in 2026. Every one of them can land on a staffing firm that uses AI to screen candidates.

Most ops leaders I talk to assume the vendor owns this risk. They bought the tool. They pay the license. The vendor promised it was compliant. So the liability sits with the vendor, right?

Wrong. The firm that uses the tool to make or shape a hiring decision carries the legal duty. In staffing, that firm is often you. And when a candidate files a complaint, the regulator does not ask your vendor for records. They ask you.

Why the Vendor Cannot Take This Off Your Plate

Read the actual text of these laws and one pattern shows up fast. They regulate the employer who uses the tool, not the company that built it.

NYC Local Law 144 requires a bias audit within one year of use, a public posting of the audit results, and advance notice to candidates. The employer owns all three. Illinois HB 3773, effective January 2026, bars discrimination through AI in hiring and requires notice when AI is used. California FEHA now treats automated decision systems as covered under existing discrimination law, which means the same liability you already carry for a biased human decision applies to a biased algorithm. Texas RAGA hands the attorney general power to go after deceptive or discriminatory AI in employment.

None of these say the vendor is on the hook. A vendor can promise indemnification in the contract, and that helps with legal costs after the fact. It does not stop the complaint. It does not produce the audit trail. And it does not answer for you when the agency wants documentation in ten business days.

Here is the part that stings. In a staffing arrangement, you sit between the client and the candidate. That often makes you the employer of record for screening purposes, which puts the notice and audit duties on your desk, not the client's and not the vendor's.

The Audit Trail Most Firms Cannot Produce

I ask ops leaders one question. If a candidate filed a complaint tomorrow claiming your AI screened them out unfairly, could you show what the tool did and why?

Almost nobody can. They have a dashboard that shows scores. They do not have a record that proves the tool was audited, that candidates were notified, and that a human reviewed the output before rejection.

That gap is the liability. Here is what a defensible trail actually includes:

A current bias audit. Dated within the last twelve months, run by an independent party, covering the exact version of the tool you use. A vendor marketing summary does not count.
Candidate notice records. Proof that you told candidates AI was used, what it evaluated, and their right to an alternative. Keep the timestamp and the language.
Human review documentation. A record showing a person reviewed AI output before a candidate was rejected. This is your strongest defense against a discrimination claim.
Data source and criteria logs. What data the tool used to score and rank. If you cannot explain the criteria, you cannot defend the outcome.
Vendor compliance attestation. A signed statement from the vendor confirming what the tool does and how it was tested, updated on a schedule.

If you cannot pull those five things for your last placement, you have a compliance problem, not a technology problem.

What Governance Looks Like When It Works

Compliance here is not a legal project. It is an operations project. The people who touch the tool every day are the ones who create or close the risk.

Start by finding every place AI touches a candidate. Most firms underestimate this by half. Your ATS auto-ranking counts. Your chatbot screener counts. Your matching engine counts. Write down each one and the decision it influences.

Then assign an owner. One person is accountable for the audit trail on each tool. Not a committee. When I see governance fail, it fails because everyone assumed someone else had it.

Build the notice into the workflow so it fires automatically, not when a recruiter remembers. Manual compliance is the compliance that breaks under volume. If your recruiters place fifty candidates a week, you cannot rely on them to send a legal notice by hand each time.

Set a review cadence. The bias audit is annual under NYC law, but your internal check should be quarterly. Laws change fast. Illinois just turned on in January. Something else will turn on next quarter.

And document the human in the loop. This one detail carries more weight than any other. A regulator treats an AI rejection with human review very differently from an automated rejection with no oversight. Make sure a person signs off, and make sure you can prove it.

The Cost of Waiting

The firms that get caught will not be the ones running sophisticated AI. They will be the ones who bought a tool, turned it on, and never thought of it as a legal decision. NYC penalties run per violation, per day. In a high-volume staffing operation, that math gets ugly fast.

The real risk is not one fine. It is a client audit during a contract renewal. PE-backed portfolios are already asking their staffing vendors to prove AI governance before they sign. If you cannot produce the documentation, you lose the contract, and the fine is the smaller problem.

Do This Week

Pull a list of every tool that scores, ranks, or filters candidates before a human sees them. For your most recent placement made with one of those tools, try to produce the five records above: the bias audit, the candidate notice, the human review record, the criteria log, and the vendor attestation.

If you can produce all five, you are ahead of nearly every firm your size. If you cannot, you just found your gap, and you found it before a candidate or a regulator did. That is the whole point.

Your AI Screener Is a Legal Liability: What Staffing Firms Must Do Before Their Next Placement