AI Hiring Tools Legal Compliance: What Startups Must Do Under NYC LL 144, Illinois AIVA, and Emerging State Laws

If your startup uses AI to screen resumes, analyze video interviews, or rank candidates, you are deploying what regulators call an automated employment decision tool — and a fast-growing patchwork of federal, state, and local laws now regulates how you can use it. New York City began enforcing Local Law 144 in July 2023, with fines up to $1,500 per day per violation. Illinois has required consent for AI-analyzed video interviews since 2020. The EEOC issued enforcement guidance on AI in hiring in May 2023, and Colorado's sweeping AI Act takes effect February 1, 2026. If you are a founder using tools like HireVue, Pymetrics, Eightfold, or a custom AI screening pipeline, you face direct legal liability — and the compliance bar is rising.

Here is what each of these laws requires, which tools trigger them, and what your startup should do before deploying AI in hiring.

Which Tools Trigger Automated Employment Decision Tool Laws

Not every tool that touches a resume counts as an AEDT. The legal definition matters because it determines whether your obligations kick in at all.

Under NYC Local Law 144's adopted rules (effective July 5, 2023), an automated employment decision tool is a computational process derived from machine learning, statistical modeling, data analytics, or artificial intelligence that issues simplified predictions, recommendations, or classifications — and that substantially assists or replaces discretionary decision-making in hiring or promotion decisions. The rule clarifies that a tool "substantially assists" decision-making when it (1) uses machine learning, statistical modeling, or AI to generate a score, classification, or recommendation, or (2) overrides human conclusions with its own algorithmic output.

In practice, this captures:

• Resume screening and ranking software that uses AI to sort, score, or filter candidates
• Video interview analysis tools (like HireVue) that assess facial expressions, tone of voice, or word choice
• Pre-employment assessment platforms that use machine-learning models to predict job performance or cultural fit
• Custom AI screening pipelines built on top of large language models to triage applicant pools

Tools that merely organize applications without algorithmic scoring — for example, a simple applicant tracking system that stores resumes and lets a human sort them — likely do not trigger these laws. But the line is narrower than most founders assume. If your tool uses a model to rank, recommend, or filter candidates, you are likely in scope.

NYC Local Law 144: Bias Audits and Candidate Notification

New York City's Local Law 144 is the most actively enforced AEDT law in the United States. The adopted rules, administered by the Department of Consumer and Worker Protection (DCWP), impose three core obligations on any employer or employment agency using an AEDT on candidates who reside in New York City:

1. Annual Independent Bias Audit

Before using an AEDT, you must obtain an independent bias audit of the tool. The audit must be conducted by an independent auditor — someone who was not involved in the development or distribution of the tool and who does not have a financial interest in the outcome. The audit must evaluate the tool's selection rates and impact ratios across sex, race, and ethnicity categories, using the EEOC's Uniform Guidelines on Employee Selection Procedures (the "four-fifths rule") as the benchmark for adverse impact.

The audit results must be made publicly available, and a summary must be posted on your website or career page. You must update the audit annually.

2. Candidate Notification

At least 10 business days before using an AEDT, you must notify candidates and employees who reside in New York City that the tool will be used. Notification can be provided on the employer's website, in a job posting, or directly via email or U.S. mail. The notice must explain what the AEDT does, how it works, and what data it uses to evaluate candidates.

3. Penalties

DCWP can impose civil penalties of $500 for a first violation and between $500 and $1,500 for each subsequent violation — calculated per day the violation continues. That means a single non-compliant hiring round can generate thousands of dollars in daily fines.

Illinois AI Video Interview Act: Consent, Data Retention, and Deletion

Illinois was the first state to regulate AI in video interviews. The Artificial Intelligence Video Interview Act (AIVA), codified at 820 ILCS 42, applies to any employer that uses AI to analyze video interviews of applicants located in Illinois — regardless of where the employer is headquartered.

The law imposes four requirements:

1. Consent: You must obtain the applicant's consent before using AI to analyze their video interview. If the applicant declines, the employer must use an alternative method.
2. Explanation: You must explain to the applicant how the AI works, what characteristics it evaluates, and how it scores candidates.
3. Data sharing restriction: Video interview data may only be shared with persons whose expertise or technology is needed to evaluate the candidate's fitness for the position.
4. Deletion: Within 30 days of an applicant's request, the employer must delete the applicant's video interview. Failure to do so exposes the employer to a private right of action under the law.

The private right of action is significant — it means applicants can sue directly, without going through an administrative agency. Class action exposure is a real risk, particularly for startups that conduct high-volume video interviews without a compliance workflow.

EEOC Enforcement: Disparate Impact and AI Hiring Tools

Even if your startup is not located in New York City or Illinois, federal anti-discrimination law applies. On May 18, 2023, the EEOC issued a technical assistance document titled "Assessing Adverse Impact in Software, Algorithms, and Artificial Intelligence Used in Employment Selection Procedures Under Title VII of the Civil Rights Act of 1964."

The EEOC's guidance applies the well-established disparate impact theory to AI-driven hiring tools. Under Title VII, if a selection practice — including an algorithmic one — causes a statistically significant difference in selection rates between protected groups, that constitutes adverse impact. The EEOC applies the "four-fifths rule" as a rule of thumb: if the selection rate for a protected group is less than 80% of the rate for the highest-selected group, adverse impact may exist.

Key takeaways from the EEOC guidance:

• Employers are responsible for the tools they use. Even if you license a third-party AI hiring product, you — not the vendor — are liable for discriminatory outcomes under Title VII. The EEOC has been clear that you cannot outsource your compliance obligations.
• Algorithmic decisions are selection procedures. If your AI tool screens out candidates based on a model, the EEOC treats that as a test subject to the Uniform Guidelines on Employee Selection Procedures.
• You must validate the tool. If adverse impact exists, the employer must show that the selection procedure is job-related and consistent with business necessity, and that no less discriminatory alternative exists.
• Consider ADA implications. The EEOC separately issued guidance on AI and the ADA, warning that AI hiring tools may unlawfully screen out individuals with disabilities — for example, by penalizing atypical speech patterns, facial expressions, or test-taking behaviors.

The EEOC has already pursued enforcement. In 2022, the EEOC reached a settlement with a tutoring company that used an AI hiring tool that allegedly discriminated against older applicants, resulting in a $365,000 settlement. This is not a theoretical risk.

Emerging State Laws: Colorado, New Jersey, and Beyond

The regulatory landscape is expanding rapidly beyond New York and Illinois. Here is what is coming:

Colorado Artificial Intelligence Act (SB 24-205)

Colorado's Artificial Intelligence Act, signed by Governor Polis on May 17, 2024, and effective February 1, 2026, is the broadest state-level AI law enacted to date. It classifies employment decisions as "consequential decisions," making AI systems used in hiring "high-risk AI systems."

For startups deploying AI in hiring, the Colorado AI Act requires:

• Reasonable care: Deployers of high-risk AI systems must use reasonable care to protect consumers from known or foreseeable risks of algorithmic discrimination.
• Impact assessments: Deployers must complete an impact assessment of each high-risk system before deployment and annually review it.
• Consumer notification: If an AI system makes or is a substantial factor in making a consequential decision about a consumer, the deployer must notify the consumer that the system is being used and provide an explanation of the system's purpose.
• Right to correct and appeal: Consumers must be given an opportunity to correct incorrect personal data and to appeal adverse decisions through human review.
• Enforcement: The Colorado Attorney General has exclusive enforcement authority, and violations are treated as deceptive trade practices under the Colorado Consumer Protection Act.

Other States to Watch

New Jersey has introduced legislation requiring bias audits and transparency for AI hiring tools, modeled in part on NYC Local Law 144. California has proposed regulations under its Civil Rights Council that would apply disparate impact analysis to automated decision-making in employment. Connecticut and Washington have both introduced or are considering AI hiring transparency legislation. And Texas recently enacted TRAIGA, effective January 1, 2026, which creates a broader AI accountability framework that, while not hiring-specific, imposes disclosure and governance obligations that can reach employment AI systems. (We cover TRAIGA's requirements in detail in our guide to TRAIGA compliance for Texas AI startups.)

How AI Hiring Laws Interact with Other Compliance Obligations

AI hiring tools don't exist in a compliance vacuum. They sit at the intersection of employment law, privacy law, and AI governance — and the obligations compound:

• Biometric privacy laws (Illinois BIPA, Texas CUBI) may apply if your video interview tool collects facial geometry or other biometric identifiers.
• State data breach notification laws apply if your AI vendor suffers a security incident involving candidate data.
• Board oversight obligations — as we explain in our article on board oversight of AI and cybersecurity risk, Delaware law now extends Caremark fiduciary duties to AI risk management, meaning your board may face personal liability for failing to oversee AI hiring compliance.
• ADA website accessibility requirements — if your AI hiring tool is deployed through a web interface, it must be accessible to candidates with disabilities. (See our founder's guide to ADA website accessibility compliance.)

Practical Compliance Checklist Before Deploying AI in Hiring

Before your startup turns on an AI hiring tool, work through this checklist:

1. Identify whether your tool qualifies as an AEDT. Does it use machine learning, statistical modeling, or AI to score, rank, filter, or recommend candidates? If yes, the laws above likely apply.
2. Determine which jurisdictions are in play. Where do your candidates reside? If you hire in New York City, Illinois, Colorado, or any state with pending legislation, map your obligations now.
3. Commission an independent bias audit (NYC LL 144). Engage an auditor who was not involved in developing the tool and has no financial stake in the outcome. The audit must evaluate selection rates by sex, race, and ethnicity. Publish the results on your careers page and refresh annually.
4. Build candidate notification workflows. For NYC candidates, provide notice at least 10 business days before using the AEDT. For Illinois video interviews, obtain written consent and explain how the AI works. For Colorado, prepare consumer notification language for consequential decisions.
5. Establish data retention and deletion protocols. Under Illinois AIVA, you must delete video interview data within 30 days of a candidate's request. Build this into your data governance from day one.
6. Conduct vendor due diligence. Your AI hiring vendor is not liable for your EEOC compliance — you are. Ask vendors for their bias audit results, validation studies, and documentation of how the model was trained and tested. If they cannot provide these, that is a red flag.
7. Implement human oversight. Colorado's AI Act requires a right of appeal through human review. Even outside Colorado, the EEOC expects employers to retain meaningful human judgment — not just rubber-stamp algorithmic recommendations.
8. Document everything. Keep records of your bias audits, candidate notifications, consent forms, vendor due diligence, and internal policies. If the EEOC or DCWP opens an investigation, your documentation is your defense.
9. Train your hiring team. Make sure recruiters and hiring managers understand what the AI tool does, what it does not do, and how to flag concerning outcomes. Human override logs should be part of your compliance record.
10. Review annually. Laws are changing fast. Re-assess your compliance posture at least once a year, and whenever you add a new jurisdiction or substantially modify your AI tool.

Actionable Next Steps

If your startup is already using AI in hiring or plans to within the next six months, here is what we recommend you do right now:

1. Audit your current stack. List every tool in your hiring pipeline and flag any that use machine learning, scoring, or algorithmic filtering. You may have AEDTs in use without realizing it — ATS integrations often include AI ranking features by default.
2. Map your candidate jurisdictions. Identify where your applicants live and work. If you hire nationally, assume NYC, Illinois, and Colorado rules will eventually apply to some subset of your candidate pool.
3. Get your first bias audit scheduled. If you are already using an AEDT for NYC candidates and have not had a bias audit performed, you are currently out of compliance. Prioritize this immediately.
4. Draft candidate notification templates. Prepare notices for NYC candidates, Illinois consent forms for video interviews, and Colorado disclosure language. These should be ready to deploy before your next hiring round.
5. Talk to counsel. AI hiring compliance is a multi-jurisdictional, multi-framework problem. An experienced attorney can help you avoid the most common pitfalls — from choosing the right auditor to structuring vendor agreements that shift risk appropriately.

The regulatory trajectory is clear: more jurisdictions, more requirements, and more enforcement. Startups that build compliance into their hiring infrastructure now will avoid the fines, class actions, and reputational damage that are already hitting companies that did not. The cost of compliance is a fraction of the cost of getting it wrong.