# Deploy an AI hiring tool without creating legal exposure. Here is the sequence. > An AI screening tool is a decision-maker the law treats as yours. Here is the order to deploy one in: inventory, audit, notice, retention, location-mapping, and human review, with the failure mode at each step. - **Pillar:** HR & Work - **Author:** Adithya Sulaiman (Contributor ยท CEO, Demand Nexus) - **Published:** 2026-06-15T19:55:00.000Z - **Tags:** hiring, compliance, bias-audit ## TL;DR An AI hiring tool is a decision-maker the law treats as yours. Deploy it in order: inventory decision points, run an independent bias audit, wire in candidate notice, set retention to the strictest state, map obligations by candidate location, and keep a human on every adverse decision. import Figure from '~/components/article/Figure.astro'; Here is the principle, and every step hangs off it: an AI hiring tool is a decision-maker the law treats as yours, so deploy it like you own every decision it makes, because you do. The vendor sells convenience. The liability for a biased rejection or a missing disclosure stays with you. Get the sequence right and the tool is a genuine accelerator. Get it wrong and it is a discrimination claim with a software license attached. Do these in order, before the tool touches a single live candidate. ## 1. Inventory every point where the tool touches a decision Map exactly where the system sources, screens, ranks, or rejects. Why first: the law attaches to employment decisions, not to tools, so you cannot audit, disclose, or defend what you have not mapped. A tool bought for "screening" that also auto-rejects is making decisions you are accountable for. List them all, because the consistent advice across the patchwork is to [inventory AI tools across the entire employment lifecycle](https://www.akingump.com/en/insights/alerts/the-growing-patchwork-of-state-ai-laws-what-it-means-for-employers) before anything goes live. ## 2. Run an independent bias audit before go-live, and on a schedule Do not deploy on the vendor's say-so. Why: New York City's Local Law 144 requires an [independent bias audit before an automated employment decision tool is used, with the results published](https://natlawreview.com/article/patchwork-ai-hiring-laws-create-rising-compliance-risks-employers). Connecticut goes further, treating [use of the tool as no defense to a discrimination claim, while crediting documented anti-bias testing as mitigation, with no safe harbor](https://www.klgates.com/Connecticut-Passes-Legislation-Regulating-the-Use-of-AI-in-Employment-Decisions-5-15-2026). The audit is both your compliance obligation and your evidence if you are challenged. "Independent" is load-bearing: a vendor grading its own homework is not an audit. ## 3. Wire candidate notice into the funnel Build the disclosure into the application flow, not a policy page nobody reads. Why: NYC requires notice to candidates [at least ten business days before the tool is used, including the qualifications it assesses](https://natlawreview.com/article/patchwork-ai-hiring-laws-create-rising-compliance-risks-employers), and Illinois [requires notice when AI is used in hiring](https://darroweverett.com/ai-hiring-workforce-management-2026-legal-analysis-updates/). Notice is concrete, already in force, and cheap to get wrong, which makes it the first thing a regulator checks. ## 4. Set retention to the strictest state you hire in Fix your records policy before go-live. Why: California requires retaining [automated-decision and employment records for at least four years](https://calcivilrights.ca.gov/wp-content/uploads/sites/32/2025/03/Attachment-B-Final-Unmodified-Text-of-Proposed-Employment-Regulations-Regarding-Automated-Decision-Systems.pdf), and a typical applicant-tracking system that purges after 12 or 24 months is now a compliance gap for any California-touching role. Set retention to the longest requirement across the states you hire in, not the shortest. ## 5. Map obligations by where the candidate sits, not where you do Tag every requisition with the candidate's location. Why: state AI employment laws [apply based on where the candidate is located, not where your company is headquartered](https://perkinscoie.com/insights/update/navigating-growing-landscape-state-ai-employment-bills-and-laws-what-employers-need), so a remote-hiring funnel inherits the rules of every state your applicants live in. One national tool can put you under a dozen regimes at once. ## 6. Keep a human on every adverse decision Never let the tool issue a rejection unreviewed. Why: the clear direction of the law, from California's move against relying solely on AI to discipline or fire, treats AI as assistive, and an unreviewed automated rejection is the single riskiest output the system can produce. A human owner on adverse actions is your last and best guard. ``` PRE-DEPLOYMENT CHECKLIST (run before any live candidate) [ ] Decision points mapped (source / screen / rank / reject) [ ] Independent bias audit complete + results published [ ] Candidate notice live in the funnel (>=10 business days, NYC) [ ] Retention set to strictest state (>=4 years for CA-touching roles) [ ] Obligations mapped by candidate location, not HQ [ ] Named human reviewer on every adverse decision [ ] Re-audit date on the calendar ```
The deployment order Inventory → Audit → Notice → Retention → Map bylocation → Humanreview
## Where this goes wrong Three failure modes, each with a guard. The tool quietly expands scope: bought to screen, now auto-rejecting, which means it is making decisions you never audited. The guard is step one, re-run whenever the tool updates. The vendor's "audit" is not independent: a self-assessment is marketing, not compliance. The guard is to commission your own. And you disclose in one state and forget another: [the patchwork is inconsistent](/ai-hiring-compliance-patchwork), and [federal signals toward leniency do not reduce state burden](https://news.bloomberglaw.com/legal-exchange-insights-and-commentary/ai-hiring-compliance-is-a-patchwork-and-leaves-big-employer-gaps). The guard is step five, the location map. And the whole map keeps moving: with [more than a thousand AI bills introduced across dozens of states, hiring among the most active areas](https://www.multistate.ai/artificial-intelligence-ai-legislation), a policy that is compliant today can fall behind by next quarter, and some statutes are themselves [in flux, like Colorado's, challenged in court and stayed](https://natlawreview.com/article/patchwork-ai-hiring-laws-create-rising-compliance-risks-employers), which is why the re-audit date belongs on the calendar. ## Where the playbook stops Be honest about the ceiling. This sequence keeps you compliant, auditable, and defensible. It does not make the tool fair on its own, and it does not transfer the liability off you, because the law treats the decision as yours and a passed audit mitigates rather than immunizes. This is operational guidance, not legal advice, and before you go live, your employment counsel reviews the audit, the notice language, and the retention policy for the specific states you hire in. The tool makes hiring faster, even as it [reshapes which jobs exist in the first place](/removing-the-first-job). Keeping it lawful is still a human job, and it is yours. ## FAQ ### What is the first step in deploying an AI hiring tool legally? Inventory every point where the tool sources, screens, ranks, or rejects candidates, because legal obligations attach to employment decisions rather than to the tool, and you cannot audit or disclose what you have not mapped. ### Do I need a bias audit for AI hiring tools? In several jurisdictions, yes. New York City's Local Law 144 requires an independent bias audit with published results before an automated employment decision tool is used, and the audit doubles as your evidence if a decision is challenged. A vendor's self-assessment does not satisfy the independence requirement. ### Which state's rules apply if I hire remotely? Generally the rules of the state where the candidate is located, not where your company is headquartered. A national hiring funnel can therefore trigger obligations in every state your applicants live in, so map requirements by candidate location. ### Does following this checklist remove my legal liability? No. It keeps you compliant, auditable, and defensible, but the law treats the AI's decision as the employer's, and a passed audit mitigates rather than eliminates liability. Have employment counsel review your audit, notices, and retention before deployment.