Only one place in America requires an AI bias audit

A client sends you a security questionnaire before signing the contract. Question 14: "Have your AI hiring tools passed an independent bias audit?" You use a sourcing platform, an ATS with resume parsing, and ChatGPT for outreach drafts. You have no idea which of those counts, and the vendor selling audits told you last month that four states now require one.

Here is the actual number. As of July 2026, exactly one jurisdiction in the United States requires an independent bias audit of an AI hiring tool: New York City, under Local Law 144. Not New York State. Not California, Illinois, Colorado, Connecticut or Texas. Every one of those has AI hiring rules on the books or on the calendar, and not one of them mandates an audit.

That gap between what the law says and what the market says matters, because the people who tell you audits are broadly required are often the people who sell them. The audit vendors on page one of Google are not lying to you. They are answering a different question than the one you asked.

This is a practical guide to who is covered by what, current as of July 28, 2026. It is not legal advice. These rules change fast and several are mid-rulemaking, so check your own situation with counsel before you rely on any of it.

What Local Law 144 actually asks for

New York City's AEDT law took effect January 1, 2023, and the Department of Consumer and Worker Protection began enforcing it on July 5, 2023. It applies to what the code calls an automated employment decision tool: a computational process that issues a simplified output, meaning a score, classification or recommendation, that is used to substantially assist or replace discretionary decision making.

DCWP's rules pin down that last phrase, and the definition is narrower than most summaries admit. A tool substantially assists a decision only if you rely on its output alone with no other factors, or you weight that output more heavily than any other single criterion, or you use it to overrule a conclusion a human reached some other way. Note the second prong carefully, because it catches more than people expect. A summary you read, argue with, and then still treat as your heaviest single input is covered.

If a tool is covered, four duties follow. You need an independent bias audit done no more than a year before you use the tool, calculating selection or scoring rates and impact ratios across sex, race and ethnicity, plus the intersectional categories. You publish a summary of that audit, with the tool's distribution date, on your site. You give candidates and employees who live in New York City at least ten business days' notice before you use it, naming the qualifications the tool assesses and telling them how to request an accommodation or an alternative process. And the one most checklists drop: if you have not already published it, you must supply the type of data the tool collects, its source, and your retention policy within 30 days of a written request.

Penalties are not more than $500 for a first violation and for each additional violation on the same day, then between $500 and $1,500 for each subsequent violation. The number that actually bites is not the ceiling, it is the counting rule: every day you use a non-compliant tool is a separate violation, and every notice you fail to send is a separate violation too.

The applicant line

Now the part almost nobody writes down, and the reason that client questionnaire may not apply to half your stack.

Local Law 144 attaches at the moment somebody becomes an applicant. DCWP's own FAQ asks whether the law covers using an AEDT to scan a resume bank, conduct outreach to potential candidates, or invite applications. The answer it gives is one word: no. The requirements apply to assessing candidates for hiring or promotion, and a candidate is defined as a person who has already applied for a specific position in the format you asked for.

Call it the applicant line. On DCWP's reading, what you do before a person applies to your specific role sits outside the law, and what you do to evaluate them afterwards sits inside it. The same phrase "AI hiring tool" describes two very different legal situations depending on which side of that line the tool operates on, which is the same distinction that separates candidate sourcing from recruiting operationally.

Hold that line loosely, though. It comes from the FAQ, not the statute: the operative prohibition in § 20-871(a) just says "screen a candidate or employee," and the code never defines "candidate" at all. So the applicant line is the regulator's interpretation of a gap in the text, published in June 2023, and the Comptroller has since pushed DCWP toward more active enforcement. It is the best available answer today and it is not bedrock.

This is also not a loophole. Federal anti-discrimination law does not care where the applicant line falls, and a sourcing tool that systematically surfaces one demographic creates exposure with or without a city ordinance. But if you are trying to answer question 14 honestly, the question is not "do I use AI," it is "does this tool evaluate people who have applied to my role."

Yes, employment agencies are named in the statute

Recruiters often assume compliance is the client's problem. Local Law 144 does not read that way. The operative sentence in § 20-871(a) makes it unlawful "for an employer or an employment agency" to use an AEDT without a compliant audit, and the notice duty in § 20-871(b) repeats the same pair. The audit summary has to be posted on the website of the employer or the employment agency.

DCWP is blunt about where responsibility sits: employers and employment agencies are responsible for making sure a bias audit was done, and the vendor that built the tool is not responsible for auditing it.

One honest caveat. Local Law 144 never defines "employment agency," and neither do the rules. Whether a contingency recruiter, a staffing firm and an RPO all land inside that term has not been tested. Do not let anyone tell you the boundary is settled, in either direction.

The geography test is also frequently reported wrong. Coverage follows the job, not the candidate. The law reaches a role based in a New York City office at least part of the time, a fully remote role tied to a New York City office, or an employment agency located in the city. Candidate residence determines who you must notify, not whether you are covered at all. Vendor blogs claiming the law triggers whenever an applicant happens to live in Brooklyn are describing something the FAQ does not say.

The four jurisdictions actually in force

Four jurisdictions, five instruments, and Illinois carrying two of them. Illinois is also the one place other than New York City with a mandated bias-reporting duty of any kind, though it is narrow and it is not an audit: an employer that lets AI analysis of a video interview alone decide who advances has to report applicant race and ethnicity to the state each year.

Texas belongs in the conversation but not really in the table. Its Responsible AI Governance Act took effect January 1, 2026 and it is in force, but it bans intentional discrimination through AI and says outright that disparate impact alone cannot establish intent. It imposes no audit, notice or disclosure duty on private employers hiring in Texas. One caveat, since the same act amended Texas's biometric statute: if you run facial or voice analysis on candidates there, you have separate consent exposure that has nothing to do with AI law. New Jersey is sometimes counted as another jurisdiction. It should not be: the Division on Civil Rights issued guidance in January 2025, and guidance is an enforcement position, not a new obligation. Its most quotable line is still worth knowing, because it says employers are liable for algorithmic discrimination even when a third party built the tool and the employer never understood how it worked.

What is coming, and when

Colorado deserves a note, because it is the law most recruiters think they are already behind on. Governor Polis signed SB 26-189 on May 14, 2026, and it repealed and replaced the 2024 Colorado AI Act, which never took effect at all. The replacement is much smaller: the mandatory risk-management programs, annual impact assessments and self-reporting duties from the 2024 version are gone.

The enforcement picture is worth stating precisely, because it gets garbled everywhere. In litigation filed in April 2026, the federal court in Colorado approved a stay that both sides asked for, and that stay covers the 2024 Act, the statute the legislature repealed three weeks later. What covers the new law is softer: the Attorney General has said he does not intend to enforce the 2024 Act or any legislation replacing it until rulemaking finishes, and that rulemaking is due by January 1, 2027. So Colorado is not a court-frozen obligation. It is a 2027 obligation whose enforcer has publicly committed to waiting.

Illinois has the opposite problem. HB 3773 is in force, but the Department of Human Rights temporarily withdrew its proposed rules on June 2, 2026 and postponed the public hearing, with no new date announced. So the statutory notice duty applies right now while the rules that would have told you what the notice must say, where to post it and how long to keep it do not exist.

That gap creates a genuine trap, and it is worth being honest about rather than tidy. The enacted text obliges an employer to notify an "employee" when it uses AI for covered decisions, and the covered decisions expressly include recruitment. It does not say "applicant." The reading that extends notice to outside applicants came from the proposed rules, which are exactly the rules that got withdrawn. Notifying applicants is the safer course and it is where the regulator was clearly heading, but anyone telling you it is a settled statutory duty today is reading a draft. The same goes for the four-year Illinois recordkeeping figure in circulation, which only ever existed in that draft.

The bigger risk is not the audit

If you run an agency and you are going to worry about one thing on this page, do not make it the New York audit. Make it California.

The FEHA regulations that took effect October 1, 2025 define an agent as anyone acting on an employer's behalf to perform a function the employer traditionally performs, including applicant recruitment and applicant screening, including when that work runs through an automated decision system. Then comes the sentence that should stop you: an agent of an employer is also an employer for purposes of the Act. A separate provision redefines "employment agency" to cover anyone procuring job applicants for compensation, including through an automated decision system.

Read together, that can put a California-facing recruiting firm on two hooks at once, as a deemed employer and as an employment agency. No audit is required. Direct liability is available.

Size changes which hook applies, and this is where solo recruiters should pay attention rather than relax. The deemed-employer route runs through FEHA's five-employee threshold, and the California Supreme Court's 2023 decision in Raines v. U.S. Healthworks requires the agent itself to clear that bar, so a one-person desk plausibly sits outside it. The employment-agency route has no such gate. Being too small to be a deemed employer does not make you unreachable.

The same theory is being tested in court. In Mobley v. Workday, the Northern District of California let a claim proceed that an AI vendor can be directly liable under Title VII, the ADA and the ADEA as an agent of its employer customers, on the reasoning that a tool performing a traditional hiring function is doing the employer's job. That was a ruling on a motion to dismiss, not a finding of liability. In May 2025 the court conditionally certified an opt-in ADEA collective covering applicants 40 and older rejected through the platform since September 2020. If the theory survives for a vendor, the argument that it stops short of a human intermediary doing the same screening is thin.

None of this is new in principle. The federal Uniform Guidelines have said since 1978 that using an employment agency does not relieve an employer of its obligations. The 2025 and 2026 state rules are mostly making explicit what already applied, which is roughly the same conclusion we reached about where recruiting automation stops: the accountability does not transfer to software.

Five claims about these laws that are not true

There is a reason so much of this is wrong. The topic is technical, it changed three times in eighteen months, and a lot of the pages answering it were generated rather than researched. When you check a claim, check it against the statute, the agency FAQ or a named law firm with a date on the page.

What enforcement actually looks like

Worth knowing before you budget for panic. New York State's Comptroller audited DCWP's enforcement of Local Law 144 and published the results on December 2, 2025, covering July 2023 through June 2025. In two years DCWP received two complaints. It reviewed 32 companies and identified one compliance issue, while the Comptroller's own reviewers looking at the same companies found at least 17 potential issues. Auditors also placed 12 test calls to 311 to file an AEDT complaint, and nine of them never reached DCWP at all.

Compliance on the other side is just as thin. Researchers from Cornell and Data & Society checked 391 employers for the 2024 FAccT conference and found 18 with a published bias audit, about 5%, and 13 with a published notice. Their conclusion was not that 95% are violating the law. It was that the law lets an employer decide its own tools are out of scope and post nothing at all, a state they named null compliance.

Two things follow. The odds of a fine today are low, and that is exactly why the audit is the wrong thing to organize your compliance around. DCWP generally agreed with the Comptroller's recommendations while still defending education plus complaint-driven enforcement as its approach, so read the trajectory rather than the promise. Meanwhile the liability that does not depend on any of this, disparate impact under federal law, has been available the whole time.

There is a parallel worth noticing here. New York State added a question to its WARN filings in March 2025 asking employers whether layoffs were driven by AI or automation. In roughly the first year, more than 160 companies filed and not one attributed a layoff to AI. Self-reported AI disclosure regimes tend to produce very quiet paperwork, which is the same pattern behind AI washing in tech layoffs.

What to do on Monday

Start by inventorying your stack against the applicant line rather than by vendor logo. Anything that evaluates people who have already applied to a specific role is a candidate for coverage. Anything that finds people before they apply is very likely not, at least under Local Law 144.

For the tools that do sit past the applicant line, find out whether you rely on their output alone, weight it above every other criterion, or use it to override your own read. If none of those is true, the New York definition probably does not reach it, and you should write down why you concluded that. Be aware of what you are doing when you write it, though: self-scoping is precisely the discretion the Cornell researchers called null compliance and the Comptroller identified as the enforcement gap. Documented reasoning is defensible. A convenient conclusion with nothing behind it is the thing regulators are now looking for.

For the tools where the definition does reach and you hire into New York City, you need the audit, the published summary and the ten-day notice, and you need them before you use the tool, not after.

Then handle the duties that have nothing to do with audits: notice in Illinois, four-year retention of automated-decision data in California, and pre-use notice plus an adverse-outcome explanation on the Connecticut and Colorado calendars. If you place candidates in California, get advice specifically on the agent rule, because that one changes who is liable rather than what you have to file. Our guide to what AI resume screening can and cannot do walks the automation levels themselves, and the rules for candidates using AI in interviews covers the other side of the same conversation.

Where Glozo sits in this

On the sourcing side of the applicant line, deliberately. Glozo is not an automated employment decision tool. It does not sit in your application funnel, it does not screen applicants, and it does not reject anyone. Smart Search reads intent rather than keywords and surfaces people from more than 30 sources, ordered by how closely they match what the role actually needs, with a matching summary rather than a verdict. The Sourcing Agent runs that search in the background and brings back a shortlist worth contacting.

Everything after somebody applies stays yours: the read, the call, the decision, and the accountability that goes with it. We are not going to tell you that using Glozo makes you compliant, because no sourcing tool can make that claim about a law that governs a different part of your funnel.