My vendor says their tool is already compliant. Am I covered?

No. The vendor sells software. You make the hiring decision. Under NYC Local Law 144, California FEHA, and Illinois HB 3773, the employer or agency using the tool holds the liability. A vendor's compliance claim is a starting point, not a shield. Get their bias audit results in writing, then confirm the audit covers the way you actually use the tool. If they screen candidates in three states and their audit only covers New York, you have a gap.

Do these laws apply if my AI only ranks or sorts candidates instead of rejecting them?

Yes. NYC Local Law 144 covers any automated employment decision tool that substantially assists or replaces a hiring decision. Ranking counts. Sorting counts. Scoring counts. If your AI moves a candidate up or down a list and a recruiter follows that order, the tool is influencing the decision. That puts it in scope. Do not assume a ranking feature is safe just because a human clicks the final button.

How much does an independent bias audit actually cost?

For a single tool, expect somewhere between 5,000 and 25,000 dollars depending on the number of jobs and the volume of candidate data. If you run several tools across multiple states, the total climbs. That sounds like a lot until you compare it to a single discrimination claim, which can run into six figures once you add legal fees and settlement. The audit is the cheap part.

The 2026 AI Bias Audit Guide for Staffing Firms

Four AI bias laws are active at once, and the liability sits with your firm, not your vendor. Here is a compliance action plan you can start this week, before a candidate complaint forces your hand.

Four AI bias laws are active right now, and every one of them puts the liability on you, not your software vendor. NYC Local Law 144 has been enforced since 2023. California updated its FEHA regulations to cover automated decision systems in 2025. Illinois HB 3773 took effect January 1, 2026. Connecticut's AI Responsibility Act is now on the books too. If you place candidates across state lines, you are already operating under all of them at once.

Here is the part most operations leaders miss. The law does not care that you bought the tool from a vendor. It cares that you used the tool to make a hiring decision. When a candidate files a complaint, the regulator knocks on your door. Your vendor's terms of service will not save you.

So the question is not whether your AI works. You already know it sources faster and screens cleaner. The question is whether you can prove it is legal when someone asks. Most firms cannot. Let me walk you through what each law actually requires and what you should do this week.

What the four laws actually demand

These laws overlap, but they are not identical. You need to know where they diverge, because the strictest rule wins when you operate in multiple states.

NYC Local Law 144. If you use an automated employment decision tool on a candidate for a job in New York City, you need an independent bias audit completed within the last year. You must post the audit results publicly on your website. You also have to notify candidates at least 10 business days before you use the tool on them. Skip any of these and the fine runs up to 1,500 dollars per violation, per day.

California FEHA. The updated regulations treat automated decision systems as covered under existing discrimination law. There is no separate audit form to file, but you are expected to keep records that show your tool does not produce a disparate impact based on protected traits. You must hold those records for four years. When a claim lands, the burden is on you to produce the proof.

Illinois HB 3773. This law makes it a civil rights violation to use AI in employment decisions in a way that discriminates. It also requires you to notify candidates when AI is used in the process. No public audit posting like New York, but the notification requirement is real and the discrimination exposure is broad.

Connecticut AI Responsibility Act. Connecticut leans on transparency and impact assessment for high-risk AI systems, and hiring qualifies as high-risk. Expect documentation of how the system works, what data it uses, and what steps you took to check for bias.

Read those four together and a pattern emerges. Every one of them wants the same three things: proof the tool was tested for bias, a record you can produce on demand, and notice to the candidate. Build for those three and you cover most of the patchwork.

Where staffing firms get caught

The trap is not ignorance of the law. It is assuming someone else handled it.

Most firms bought an AI sourcing or screening tool in the last two years. The vendor demo mentioned compliance. A sales rep said the tool was audited. Nobody on your team got that audit in writing, confirmed the date, or checked whether it covered your use case. That gap is where the liability lives.

Here is a common scenario. Your firm uses a resume-ranking tool built by a vendor headquartered in Texas. The vendor ran a bias audit two years ago for a client in California. You place candidates in New York, Illinois, and Connecticut. That old California audit does you no good in three states, and it is stale under New York's one-year rule. You are exposed and you do not know it.

Another one. Your recruiters use an AI chatbot to pre-screen candidates. Nobody told the candidates the bot was AI. That single missing notice violates Illinois and New York at the same time.

Your compliance action plan

You do not need a law degree. You need an inventory, an audit, and a notice. Do these in order.

Build the inventory. List every tool your firm uses that touches a hiring decision. Sourcing engines, resume screeners, ranking tools, chatbots, scheduling bots that filter candidates. Note which vendor supplies each one and which states you use it in.
Pull the vendor audits. Ask each vendor for their most recent independent bias audit in writing. Check the date. Check whether it covers your job types and your states. If the audit is older than a year or does not match your use, treat the tool as unaudited.
Fill the gaps. For any tool without a current, relevant audit, commission your own independent audit. Yes, it costs money. It costs far less than a discrimination claim.
Post and notify. Put your audit summary on your website for New York. Add AI-use notice language to your candidate communications for Illinois and New York. Give the 10-day notice where it applies.
Set a records system. Keep every audit, every notice, and every candidate decision record for at least four years to satisfy California. Store it where your ops team can pull it in a day, not a month.

This is not a one-time project. Every new tool you add resets the clock. Build this into how you buy technology, or you will rebuild it in a panic after a complaint.

Do this one thing this week

Open a spreadsheet and list every AI tool your firm uses that touches a candidate. Next to each one, write the vendor name, the states you use it in, and the date of the last bias audit you have on file. If you cannot fill in that audit date from a document in your hands, that tool is a risk. That single spreadsheet tells you exactly how exposed you are and where to start. It takes an hour. Do it before Friday.

Your AI Is Live. Now Prove It's Legal: The Staffing Firm's Guide to the 2026 Bias Audit Patchwork

What the four laws actually demand

Where staffing firms get caught

Your compliance action plan

Do this one thing this week

Common questions