My ATS vendor already ran a bias audit. Am I covered?

No. A vendor bias audit tests the tool. State laws hold the deploying party responsible, and that party is you. NYC Local Law 144 requires the employer or employment agency to publish the audit results and give candidate notice. Your vendor cannot post notices on your website or manage your candidate disclosures. Get a copy of the audit, confirm it covers your actual use case, and handle the notice and posting obligations yourself.

We only place workers in a few states. Do all these laws apply to us?

The law that applies depends on where the candidate is, not where your office sits. If you place a worker in New York City, Local Law 144 applies. Illinois, California, and Connecticut work the same way. If you recruit across state lines, assume more than one law is in play. Map your placements by state, then match each state to its rule. That is a one-day project that saves you from a very expensive surprise.

What happens if we ignore this and just keep using our AI tools?

Penalties vary by state, but NYC fines run per violation per day, and each affected candidate can count as a separate violation. Beyond fines, you open the door to discrimination claims and client indemnification demands. PE-backed firms also face diligence problems, since a buyer will flag AI compliance gaps during a deal. The cost of getting ahead of this is small. The cost of ignoring it is not.

AI Hiring Laws: Why Staffing Firms Are Liable Too

Four state AI hiring laws are now active or imminent, and they name employment agencies as liable parties. Your ATS vendor's bias audit protects the vendor, not you. Here is what your firm has to own before 2026.

Your ATS vendor's bias audit protects your vendor. It does not protect you. That gap is about to cost staffing firms real money.

Four state laws are now active or close to it. NYC Local Law 144 is live. The Illinois Human Rights Act amendments took effect January 2026. California's ADMT rules are rolling out. Connecticut's AIRT Act is on deck. Every one of them names employment agencies as liable parties. Not just employers. Agencies. That means your firm.

If you place workers across state lines and lean on AI for sourcing, screening, or ranking, you are the deploying party under these laws. The vendor built the tool. You used it on a candidate. The law follows the use, not the code.

Why the vendor audit does not save you

Here is what a vendor bias audit actually does. It tests the tool for disparate impact across protected groups, usually on a general dataset. It produces a report the vendor can hand to buyers. That report says the tool passed a test under certain conditions.

It says nothing about how you use the tool. It does not cover your candidate notices. It does not cover your posting obligations. It does not cover your specific job categories or your candidate pool.

NYC Local Law 144 makes this obvious. The law requires the employer or employment agency to do three things. Publish a summary of the bias audit on your website. Give candidates notice at least ten business days before you use an automated tool on them. Tell candidates what data the tool uses and how.

Your vendor cannot do any of those three for you. They do not control your website. They do not send your candidate communications. The obligation sits with you, and the fine lands on you.

What each law puts on your plate

The details differ by state, but the pattern is the same. The party deploying the tool owns the compliance work. Here is what that looks like in the four states that matter most right now.

New York City (Local Law 144). You need an independent bias audit no more than one year old. You post a public summary. You give candidates a ten-day heads-up before using an automated employment decision tool. Fines run per violation per day, and each candidate can count separately.

Illinois (HRA amendments). Effective January 2026, it is a civil rights violation to use AI in a way that produces discriminatory effect in recruiting, hiring, or promotion. You also cannot use zip code as a proxy for a protected class. Notice requirements apply. The burden is on the employer or agency using the tool.

California (ADMT rules). The rules cover automated decision-making technology used in employment. You need to give notice, keep records, and in some cases allow candidates to opt out or request human review. Documentation is the whole game here.

Connecticut (AIRT Act). This one leans on impact assessments and transparency for high-risk AI systems, and employment decisions qualify. You will need to document how the system works and what you did to check for bias.

Notice a theme. Notice. Documentation. Public disclosure. Human review. None of that lives inside your vendor's audit PDF.

The three things your firm has to own

You cannot outsource the following to a software company. These are yours.

Candidate notice and disclosure. Every candidate touched by an AI tool in a covered state needs the right notice at the right time. In NYC that is ten business days out. Build the template once and put it in your workflow.
Public posting. Your bias audit summary and your AI usage policy go on your website, not the vendor's. Someone at your firm owns that page.
Your own use-case audit. You need to know exactly where AI touches a hiring decision in your process. Sourcing filters count. Resume ranking counts. Chatbot screening counts. If you cannot list every spot, you cannot prove compliance.

Most firms fail on the third point. They think AI compliance is only about the ATS. It is not. Your sourcing tool, your screening bot, and your scheduling assistant may all make automated decisions. Every one of them is in scope.

What this means for PE-backed portfolios

If you run ops across a portfolio, this is a diligence problem waiting to happen. A buyer's counsel will ask about AI hiring compliance in 2026. If your portfolio companies each use different tools with different audit status and no consistent notice process, you have a finding on your hands.

Standardize now. One AI usage inventory template. One notice template. One posting standard. Roll it across every company in the portfolio before the next deal, not during it.

The firms that treat this as a legal checkbox will scramble. The firms that build it into how they operate will move faster and sell cleaner.

Do this week

Pull one list. Write down every AI or automated tool that touches a candidate in your hiring process, from first contact to placement. Sourcing, screening, ranking, scheduling, all of it.

Next to each tool, note two things. Which states your candidates for that tool sit in. Whether you have a current bias audit and a candidate notice in place for it.

That single list will show you your gaps in about an hour. Once you can see the gaps, you can close them. The firms that do this before 2026 gets busy will spend a fraction of what the firms who wait will pay.

Your AI Vendor's Bias Audit Doesn't Cover You