Regulations
We work with organizations and their counsel to translate relevant requirements into a clear audit scope, evidence plan, and set of deliverables.
Current frameworks
Last reviewed October 2026
New York City
May affect: Employers and employment agencies using a covered automated employment decision tool in New York City.
Requires an independent bias audit no more than one year before use, a publicly available summary of the results, and notices to candidates or employees.
Conduct the independent bias audit, document the required analyses, and prepare a public summary within the agreed scope.
California
May affect: Employers and other covered entities using automated-decision systems in employment.
Effective October 1, 2025, the regulations clarify how California’s existing employment discrimination protections apply to automated systems. They do not create a general independent-audit requirement.
Examine group outcomes, job relevance, and supporting evidence, and identify analytical or documentation gaps.
Illinois
May affect: Employers using AI in recruitment, hiring, promotion, and other employment decisions in Illinois.
Effective January 1, 2026, the law addresses discriminatory effects, prohibits using ZIP codes as a proxy for protected classes, and includes notice requirements.
Map how AI influences employment decisions, analyze available group outcomes, and identify evidence and documentation gaps.
Colorado
May affect: Developers and deployers of covered automated decision-making technology used in consequential employment decisions.
Signed in May 2026, the law replaces Colorado’s earlier AI Act with a narrower framework built around transparency. Its main requirements apply from January 1, 2027 and include developer documentation, notices to affected people, disclosures after adverse decisions, consumer rights, and recordkeeping. It does not set an independent bias-audit requirement.
Review system evidence and documentation, and examine fairness and validity risks, to support readiness for the notice and disclosure duties within an agreed scope.
European Union
May affect: Providers and deployers of covered AI systems used for recruitment, employment decisions, and worker management in the EU.
Specified employment uses fall within the high-risk framework. The main requirements for these systems apply from December 2, 2027 and include risk management, data governance, documentation, human oversight, accuracy, and monitoring.
Assess fairness, validity, transparency, documentation, and controls while accounting for the organization’s role and the system’s intended use.
A readiness review shows what evidence you have, what’s missing, and what to tackle first.
Fairness and validity
Bias testing asks whether outcomes differ across groups. Validity asks whether the tool measures something meaningful and job-related, and whether its scores support the decisions being made.
A tool can show similar group outcomes and still lack evidence that it works as intended. Where appropriate, our audits examine both fairness and the evidence supporting the tool’s validity for its stated use.
A tool used across locations may be subject to more than one set of requirements. Some analyses can inform several frameworks, while notices, documentation, and reporting may need to be tailored to each jurisdiction. We set out exactly what the audit addresses and which deliverables are included.
Requirements change and depend on the facts of each use. An audit documents findings about the system, data, and use examined. Employers, agencies, and vendors retain their own responsibilities, and legal interpretation should be coordinated with qualified counsel.
Tell us where the tool is used, who uses it, and what role it plays in hiring. We can help define a practical starting point.
Discuss your requirements