AI in HR: Compliance Risks, Bias Audits, and What New Laws Require

The most important thing to understand about AI in HR is that the legal exposure is not new. Title VII, the ADA, the ADEA, and the Uniform Guidelines on Employee Selection Procedures applied to selection tools long before machine learning existed, and they apply to algorithmic tools now without modification.

What is new is a layer of AI-specific statutes on top — bias audit requirements, candidate notice obligations, and impact assessment duties — and the practical reality that a discriminatory algorithm operates at a scale no individual hiring manager can match. A biased interviewer affects the candidates they interview. A biased screening model affects every applicant, consistently, and produces a clean documentary record of having done so.

Existing Law Already Reaches AI

Disparate impact

A facially neutral selection procedure that disproportionately excludes members of a protected group is unlawful unless the employer can show it is job related and consistent with business necessity — and even then, it may be unlawful if a less discriminatory alternative exists that serves the employer's needs.

An algorithmic screening tool is a selection procedure. The Uniform Guidelines on Employee Selection Procedures apply, including the four-fifths rule as a rule of thumb for identifying adverse impact: if the selection rate for a group is less than four-fifths of the rate for the highest-selected group, that is generally regarded as evidence of adverse impact warranting scrutiny.

Proxy discrimination

A model trained on historical hiring data learns the patterns in that data, including its biases. It does not need access to race or sex to reproduce disparities — zip code, school attended, employment gaps, distance from the office, and word choice all correlate with protected characteristics. A model can produce disparate impact through variables nobody chose for that purpose.

Opacity

With a traditional test, you can articulate why it predicts job performance. With a complex model, the employer often cannot explain the basis of a decision — which makes the business necessity defense substantially harder to mount.

The ADA

Two distinct exposures:

• Screening out. A tool that measures traits affected by a disability — reaction time, facial expression, speech pattern, keystroke rhythm, gaps in employment history — may screen out qualified individuals with disabilities who could perform the essential functions with accommodation.
• Accommodation in the assessment itself. Applicants are entitled to request accommodation in the application and assessment process. If your process offers no visible route to request one, or the vendor's platform cannot accommodate, you have a problem — and the applicant will not know to ask if you do not tell them.

Practical requirement: state clearly in the process that accommodations are available and how to request one, and confirm with the vendor that alternatives exist.

Age and other characteristics

Models trained on a workforce skewed young will learn that skew. Graduation dates, technology fluency signals, and career-length inferences all correlate with age.

[VERIFY current EEOC guidance on AI under Title VII and the ADA — guidance documents in this area have been issued, withdrawn, and revised across administrations.]

The AI-Specific Statutes

A growing patchwork sits on top of the discrimination laws.

Multinational employers face an additional layer under the EU AI Act, which classifies employment-related AI as high risk with corresponding obligations, and under GDPR provisions on automated decision-making.

[VERIFY the entire table — this is the fastest-changing area covered in this guide.]

Where the Risk Concentrates

The targeted advertising case deserves attention because employers frequently do not think of it as a selection tool. If your job ads are delivered predominantly to one demographic by the platform's optimization — even without any targeting choice by you — you have a recruitment pipeline problem with a documented, third-party-controlled cause.

Vendor Due Diligence

Most employers do not build these tools; they buy them. Buying does not transfer liability. You are the employer making the decision, and you remain responsible for the outcome regardless of whose model produced it.

Ask every vendor, and require documented answers:

1. What data was the model trained on? Whose hiring decisions does it encode?
2. What variables does it use? Which are proxies for protected characteristics?
3. Has adverse impact testing been performed? By whom, on what population, how recently, and can we see the results?
4. What validation evidence supports job-relatedness? For our roles, not in general.
5. How is the output explainable? Can we articulate why a specific candidate was ranked as they were?
6. How does the tool accommodate disabilities? What alternatives exist?
7. What happens to candidate data — retention, deletion, use for further model training?
8. How is the model updated, and are we notified when it changes materially?
9. Will you support us in an agency investigation or litigation?
10. What contractual representations, indemnities, and audit rights are you offering?

A vendor unwilling to answer questions 1 through 5 in writing is telling you something.

Get audit rights in the contract. Without them you cannot satisfy a bias audit requirement or defend a disparate impact claim, and you will discover that after the claim arrives.

Building a Governance Framework

11. Inventory every AI tool touching employment decisions — including tools embedded in your ATS, HRIS, and scheduling systems that were never separately procured. Most employers underestimate this inventory substantially.
12. Classify by risk, based on whether the tool affects a selection or employment decision and at what scale.
13. Establish an approval process. No AI tool affecting employment decisions goes into use without HR, legal, and privacy review.
14. Require adverse impact testing before deployment and on a regular cycle after, at minimum by race, sex, and age. Consider running this under privilege.
15. Keep a human in the loop for consequential decisions. Automated rejection without human review maximizes both legal and reputational exposure, and several statutes require the ability to appeal to a person.
16. Provide notice where required — and consider providing it universally, since the jurisdictional map changes faster than your posting process will.
17. Make accommodation available and visible in every assessment process.
18. Document everything — the tool, its purpose, validation evidence, testing results, and the decisions made about it.
19. Train recruiters and hiring managers on what the tool does, what it does not do, and that its output is an input, not a decision.
20. Reassess when the model changes. Vendors update models continuously, and a tool validated last year may behave differently today.

What Is Genuinely Lower Risk

Not every use of AI in HR touches a protected decision. Comparatively low-risk applications include drafting job descriptions and postings (reviewed by a human), summarizing documents and policies, answering routine employee questions from your own approved content, scheduling logistics, and analyzing aggregate anonymized survey data.

The distinction that matters: does the tool influence a decision about an individual's employment? If yes, it is in scope for everything above. If no, ordinary data privacy and accuracy considerations apply.

Frequently Asked Questions

Does existing discrimination law apply to AI hiring tools?

Yes, fully. Title VII, the ADA, the ADEA, and the Uniform Guidelines on Employee Selection Procedures apply to algorithmic selection tools exactly as to any other selection procedure, including the disparate impact framework and the four-fifths rule.

What is a bias audit?

An independent evaluation of an automated employment decision tool for disparate impact across protected groups. New York City requires an annual audit with a published summary of results and advance notice to candidates. Requirements differ by jurisdiction.

Are we liable if the vendor's tool discriminates?

Yes. You are the employer making the decision. Vendor contracts can allocate risk between you and the vendor, but they do not shift your liability to the applicant or the agency.

Can AI screen out candidates with disabilities?

It can, and that is a core ADA exposure — both through tools that measure traits affected by a disability, and through processes that offer no accessible route to request an accommodation. State clearly that accommodations are available and confirm the vendor can provide alternatives.

Do we have to tell candidates we're using AI?

In some jurisdictions, yes, with specified timing and content. Given how quickly the jurisdictional map is changing, providing notice universally is the more practical approach.

What's the highest-risk use of AI in HR?

Resume screening and ranking — it is directly a selection procedure, applied to every applicant, typically trained on historical hiring decisions that encode prior bias, and often not explainable.

The Bottom Line

Start with the inventory, because most employers do not know how many AI tools already touch their employment decisions. Then require adverse impact testing before deployment and on a cycle, get contractual audit rights from every vendor, keep a human in the loop on consequential decisions, and make accommodation visible in every assessment. The AI-specific statutes will keep changing; the disparate impact framework underneath them will not.

For structured instruction, explore our EEO Training, Employment Law Training, and ADA Compliance Training.