This is not legal advice; it is an engineer's reading of two laws that change how a staffing firm should buy or build a screening tool. Confirm the specifics with your counsel. The structural point, though, is one every owner should understand before a vendor demo: the obligations attach to the firm that uses the tool, not to the company that sold it.
The two laws in one paragraph each
New York City Local Law 144 (enforced since July 2023) covers "automated employment decision tools": computational processes that issue a simplified output, such as a score, classification or ranking, that substantially assists or replaces discretionary decisions on hiring or promotion for jobs in the city. Before using one, the employer or employment agency needs an independent bias audit within the past year, must publish a summary of the results, and must give candidates notice, including the job qualifications and characteristics the tool assesses and how to request an alternative process or accommodation.
Illinois HB 3773 amended the Illinois Human Rights Act, effective January 1, 2026. It makes it a civil rights violation for an employer to use AI in recruitment, hiring, promotion, discipline, discharge and similar decisions in a way that has a discriminatory effect on protected classes, prohibits using zip codes as a proxy for protected classes, and requires employers to notify employees and applicants when AI is used for those decisions. Rules on the form and timing of notice come from the Illinois Department of Human Rights.
Colorado's AI Act, on its own timetable, adds duties for developers and deployers of "high-risk" AI systems, including in employment decisions. Other states are drafting. The direction is consistent: the deployer carries the duty.
Why "the vendor is compliant" is not an answer
A staffing firm sits in an unusual position. It is often the employer of record for contractors, an employment agency for direct-hire work, and a processor of candidate data on behalf of clients, sometimes all at once. Under LL144, employment agencies are named directly. Under HB 3773, the firm is the employer making the decision for its own contractors, and its clients will increasingly write AI-use clauses into their vendor agreements that push the obligation down to you.
A vendor can give you a bias audit summary for their model in the aggregate. They cannot give you:
- A record of what notice your candidates saw and when
- The selection-rate data for your candidate pool, by the categories the audit needs
- The reason a specific candidate was scored the way they were
- Evidence that a human made the final call
Those are the things a client's procurement team, a candidate's lawyer or a city enforcement letter will ask for. If they are not being recorded from the first candidate, they cannot be reconstructed later.
The records to keep from day one
Whether you buy or build, insist on the following being captured for every candidate the tool touches.
Inputs. Exactly what the tool read: which resume version, which application fields, which structured data. Not a pointer to a record that will change; a snapshot.
The rubric or criteria. Versioned. If you change a weight in March, you need to know which candidates were scored under the old one.
The output and a rationale. A score with no reason is a liability. A score with a written justification per criterion, citing the evidence, is something a recruiter can defend and an auditor can sample.
The human action. Who looked at the output, what they decided, and when. If the tool rejected a candidate with no human involved, you should know that, and you should probably stop it.
The notice. What text was shown to the candidate, on what date, and whether they requested an alternative process.
Selection-rate data. Impact ratios by sex and race/ethnicity categories, as LL144's audit rules describe, computed on your candidate pool, not the vendor's. This is what an independent auditor will need.
Proxies are the quiet risk
HB 3773 names zip codes explicitly. In practice the proxy problem is broader: years since graduation, employment gaps, the name of a college, a home address, even the format of a resume can correlate with protected characteristics. A rubric workshop where recruiters write down what they actually value, and someone checks each criterion for what it might stand in for, is the single most useful hour in a screening project. It is also the hour vendors skip, because the rubric is the product they are selling you.
A buying checklist
When you evaluate any screening tool, vendor-built or custom, ask:
- Can I export, per candidate, the inputs, the criteria version, the score with rationale, the human decision, and the notice shown?
- Can I export selection-rate data for my own candidate pool in the format an independent auditor needs?
- Is the rubric mine to read and change, or is it inside the model?
- Can the tool be configured so that no candidate is rejected without a person acting?
- What happens to these records if I leave the vendor?
A "no" on any of the first four should end the demo. A vague answer on the fifth should make you nervous.
What this means for building
We build screeners so that the records above exist before the first candidate is scored, because retrofitting them is close to impossible. The rubric is a document the firm owns. Every score carries a written reason. The recruiter makes the stage change. Audit exports are a button, not a project. Details are on the Rubric Screener page.
The law is moving toward the position staffing firms have always been in: you are responsible for the decision, whatever tool helped you make it. Buy and build accordingly.