If my vendor built the AI tool, why am I the one who is liable?

Because you are the one making the employment decision. The law follows the employer and the employment agency, not the software company. Your vendor sells a product. You deploy it against real candidates and real reqs. Illinois HB 3773 and NYC Local Law 144 both put the duty on the deployer. A great vendor contract can shift some cost after the fact, but it does not move the legal duty off your desk. Read your Master Services Agreement and find the indemnification clause. If it does not name AI bias claims, you are carrying that risk alone.

We use AI to rank and rerank candidates but a human makes the final call. Are we covered?

Not automatically. NYC Local Law 144 covers any tool that substantially assists or replaces human decision making. Ranking, scoring, and reranking all count. A human clicking approve at the end does not exempt you if the AI decided who that human ever saw. Regulators look at whether the tool shaped the outcome, not whether a person touched the final button. If your AI filters the top 20 out of 300, it made the decision. Assume you are covered by the law until an attorney tells you otherwise in writing.

How long does a bias audit take and what does it cost?

Plan on four to eight weeks and $8,000 to $25,000 for a first independent audit, depending on how many tools and roles you run through it. The bigger cost is data. Most firms cannot pull clean selection-rate data by race and sex because their ATS was never set up to track it. Fixing that data gap usually takes longer than the audit itself. Start pulling the data now so the auditor is not waiting on you.

AI Screening Tools Are a Legal Liability for Staffing Firms

If you deploy an AI screening tool, you are the legally liable party, not your vendor. Here is what is live, what is coming, and the governance file you need before a buyer or regulator asks.

The AI screening tool your team bought to speed up sourcing is now a legal exposure sitting on your balance sheet. Illinois HB 3773 went live in January 2026. NYC Local Law 144 has been enforced since 2023 and requires an independent bias audit before you use an automated tool on a single candidate. A dozen more states have bills moving right now. And here is the part most staffing leaders miss: when the complaint lands, the liable party is you, not the vendor who sold you the software.

You are the employer or the employment agency. You made the employment decision. The law follows you.

Most staffing firms have zero governance documentation to hand a buyer during due diligence or a regulator during an inquiry. That gap is a problem you can fix this quarter. But you have to see the map first.

What Is Actually Live Right Now

Three laws already have teeth. Know these cold.

Illinois HB 3773. Live since January 1, 2026. It amends the Illinois Human Rights Act to make it a civil rights violation to use AI that discriminates in recruiting, hiring, promotion, or firing. It also bans using ZIP code as a proxy for a protected class. If you place candidates in Illinois, this covers you. There is no vendor carve-out.

NYC Local Law 144. Enforced since July 2023. If you use an automated employment decision tool on anyone applying for a job in New York City, you need an independent bias audit completed within the last year. You must post the audit results publicly. You must notify candidates at least 10 business days before you use the tool. Miss any of these and each violation is a separate fine.

Colorado SB 205. The AI Act takes effect in 2026 and treats hiring as a high-risk use. It requires you to use reasonable care to prevent algorithmic discrimination and to keep documentation you can produce on request.

These are not future risks. They are current obligations. If you screen candidates in Illinois, New York City, or Colorado today and you cannot produce an audit or an impact assessment, you are already out of compliance.

What Is Coming And Why It Matters Now

California, Texas, New Jersey, Virginia, and roughly eight other states have AI hiring bills in motion. The details differ, but the pattern is identical across all of them.

The deployer carries the duty, not the software maker.
You must run some form of bias or impact assessment.
You must notify candidates that AI is being used.
You must keep records and produce them when asked.

That pattern is your planning tool. You do not need to track 50 statutes. You need to build a program that satisfies the four things every one of these laws asks for. Do that once and you are ready for most of what is coming.

There is a second reason to move now, and it has nothing to do with regulators. It has to do with buyers.

If your firm is PE-backed or headed for a sale, AI governance is a diligence item. A sharp buyer's counsel will ask for your bias audits, your candidate notices, and your vendor contracts. When you have nothing to show, they do one of two things. They knock the price down or they carve out an indemnity that keeps your money at risk for years after close. I have watched a clean governance file protect real value in a deal. I have also watched the absence of one become a negotiating weapon.

The Four-Part Governance File You Can Build This Quarter

You do not need a law degree. You need a folder. Here is what goes in it.

1. A tool inventory

List every AI tool that touches a hiring decision. Sourcing bots. Resume rankers. Chat screeners. Matching engines. Video assessment tools. For each one, write down what it does, which reqs it runs on, and which states those candidates sit in. Most firms find three to six tools they forgot they were even using. You cannot govern what you have not counted.

2. Bias audits for the states that require them

For anything used in NYC, get an independent bias audit now. For Illinois and Colorado, run an impact assessment that checks selection rates across protected groups. Your vendor may offer a shared audit. Read it. A generic vendor audit often does not cover your specific configuration or your candidate pool, and that is exactly what a plaintiff's attorney will attack.

3. Candidate notices

Draft the language that tells candidates AI is being used, what it evaluates, and how they can request an alternative. Put it in your application flow. NYC requires 10 business days of lead time, so this is a workflow change, not just a legal edit.

4. Vendor accountability records

Pull every AI vendor contract. Find the indemnification and the data-use terms. If the contract does not name AI bias claims, get an addendum. The liability stays with you, but a strong contract determines who pays the bill.

Assign one owner for this folder. Not a committee. One person with a name and a deadline. This is a change-management problem as much as a legal one, and change without an owner does not stick.

Do This Week

Open a spreadsheet and build the tool inventory. One row per AI tool that touches a candidate. Four columns: what it does, which reqs use it, which states the candidates are in, and whether you have an audit or notice on file. You will finish it in under two hours, and you will know exactly where you stand.

That single spreadsheet turns a vague legal fear into a short punch list. Once you can see the gaps, you can close them. And you will be able to answer the buyer or the regulator with a document instead of a shrug.

Your AI Screening Tool Is Now a Legal Liability: The State-by-State Compliance Map Every Staffing VP Needs