AI in hiring and employment: what US law requires and who’s liable

The short version

• US anti-discrimination law reaches a hiring algorithm the same way it reaches a human decision. Title VII bars a practice that causes a disparate impact (an outcome gap) on a protected group unless it is “job related for the position in question and consistent with business necessity” (42 U.S.C. 2000e-2(k)(1)(A)(i)).
• The Age Discrimination in Employment Act (ADEA) protects applicants aged 40 and over, and the Americans with Disabilities Act (ADA) bars selection criteria that “screen out or tend to screen out” people with disabilities (29 U.S.C. 631(a); 42 U.S.C. 12112(b)(6)).
• Under Title VII, the ADEA and the ADA the employer is answerable for the selection practices it uses, including a tool an outside vendor built or ran; Mobley v. Workday is testing whether the vendor itself can also be sued.
• New York City requires a bias audit (an independent check) of an automated employment decision tool within the year before use, plus candidate notice; enforcement began 5 July 2023.
• Illinois makes AI that discriminates by effect, or that uses zip codes as a proxy, a civil-rights violation from 1 January 2026; Colorado’s broader AI Act (SB 26-189, signed 14 May 2026) covers employment, with its duties taking effect 1 January 2027.
• The EEOC’s 2022 and 2023 AI technical-assistance pages were removed from eeoc.gov and no longer load, as of 11 November 2026; the statutes they explained are unchanged.^{1,3,4,5,9,11,12,14}

What law applies when AI is used to hire?

Existing federal anti-discrimination law applies to an AI hiring tool exactly as it applies to a human decision: Title VII, the ADEA and the ADA ask what a selection practice does, not what runs it.^1,2,4

Title VII’s disparate-impact hook sits at 42 U.S.C. 2000e-2(k)(1)(A)(i): a practice that “causes a disparate impact on the basis of race, color, religion, sex, or national origin” is unlawful unless the employer shows it is “job related for the position in question and consistent with business necessity”. Disparate impact, also called adverse impact, means an outcome gap for a protected group, the kind the law shields by race, sex, age or disability. It needs no intent, and Congress added this subsection in 1991.¹

The ADEA covers age: its prohibitions are “limited to individuals who are at least 40 years of age” (29 U.S.C. 631(a); the practices barred are at 29 U.S.C. 623). The ADA covers disability: a covered entity may not use selection criteria that “screen out or tend to screen out” a person with a disability unless they are job-related and a business necessity (42 U.S.C. 12112(b)(6)).^2,3,4

Who answers for what an AI system says more broadly is in AI in law. In the European Union, employment is a high-risk use under the AI Act (Regulation (EU) 2024/1689, Annex III point 4); how that high-risk regime works, in its dispute-resolution setting, is in the EU AI Act in dispute resolution. The same “ordinary duties already govern” thread runs through AI, copyright and training data.¹⁶

What is an automated employment decision tool, and what is a bias audit?

An automated employment decision tool (AEDT) is software that uses machine learning, statistics, data analytics or AI to produce a “simplified output”, a score, classification or recommendation, that is “used to substantially assist or replace discretionary decision making” for an employment decision (N.Y.C. Admin. Code 20-870). It is a program that helps decide whom to interview, hire or promote. Common examples are an AI resume-screening tool and an algorithmic hiring tool that scores a recorded interview.⁹

A bias audit, under the same law, is “an impartial evaluation by an independent auditor”. An independent auditor has no part in using, building or distributing the tool, and no employment or financial tie to the employer or the vendor (DCWP final rule, 6 RCNY 5-300). So the vendor cannot audit its own tool.^9,10

The audit works from two numbers. A selection rate is the share of a group the tool moves forward or assigns a classification. An impact ratio is one group’s selection rate divided by the rate of the most selected group (DCWP final rule, 6 RCNY 5-300). The four-fifths rule, a rule of thumb in the EEOC’s Uniform Guidelines on Employee Selection Procedures, treats a selection rate below four-fifths, or 80%, of the highest group’s rate as something that “will generally be regarded by the Federal enforcement agencies as evidence of adverse impact” (29 C.F.R. 1607.4(D)). By way of illustration, a 60% selection rate for one group and 30% for another gives a ratio of 50%, below 80%. Clearing the rule does not make a tool lawful; the Guidelines treat it only as a starting point.^6,10

What does New York City’s Local Law 144 require?

Local Law 144 of 2021 bars a New York City employer or employment agency from using an AEDT to screen a candidate or employee for a position in the city unless the tool has had a bias audit within the past year, a results summary is published on the employer’s website, and candidates were given notice (N.Y.C. Admin. Code 20-870, 20-871).⁹

The bias audit calculates the selection or scoring rates and the impact ratio for sex categories, race or ethnicity categories, and the intersections of the two (DCWP final rule, 6 RCNY 5-301). The notice must reach a candidate at least 10 business days before the tool is used, and must say how to ask for an alternative selection process or an accommodation (N.Y.C. Admin. Code 20-871(b); 6 RCNY 5-304). Nothing in the law requires the employer to grant that alternative.^9,10

The duty sits with the employer or agency, not the vendor. The law took effect 1 January 2023, and the Department of Consumer and Worker Protection (DCWP) began enforcement on 5 July 2023. If the audit finds bias, the law requires no specific fix. Penalties run from $500 for a first violation to $1,500 for each later one, with each day of use and each missed notice a separate violation (N.Y.C. Admin. Code 20-872). Local Law 144 creates no private right of action, so a candidate cannot sue under it directly; the City enforces it, and it does not limit a candidate’s separate right to sue or the City Commission on Human Rights’ authority (N.Y.C. Admin. Code 20-873, 20-874), as of 11 November 2026.^9,10

Is the EEOC’s AI guidance still in force?

No. The EEOC’s two main AI technical-assistance documents were removed from eeoc.gov and now return a 404, the web server’s page-not-found error, as of 11 November 2026, but the statutes they explained still apply. Technical assistance is the agency’s non-binding explanation of the law, not law itself; the document said so on its face.⁵

The May 2023 Title VII document (its EEOC reference number, EEOC-NVTA-2023-2) and its 2022 ADA companion no longer resolve on eeoc.gov. The EEOC’s disability-TA index still lists the ADA and AI page, though its link 404s. Because the documents only restated Title VII and the ADA, their removal changes what the agency publishes, not what the statutes forbid.^5,7

For the policy backdrop, read as policy and not a repeal: Executive Order 14281 of 23 April 2025 states a federal policy “to eliminate the use of disparate-impact liability in all contexts to the maximum degree possible” and tells agencies to deprioritise enforcement of statutes that rely on disparate impact, naming 42 U.S.C. 2000e-2 (Sections 2 and 4). The order does not repeal Title VII, the ADEA or the ADA, which remain in force.^1,8

Can an AI hiring vendor be liable, not just the employer?

That is the open question in Mobley v. Workday, Inc. (No. 3:23-cv-00770-RFL, in the US District Court for the Northern District of California): whether an AI hiring-tool vendor, not only the employer, can itself be liable under the ADEA. So far the court has let the claim against the software provider proceed, with no merits finding of discrimination as of 11 November 2026.¹¹

On the motion to dismiss, the provider’s request to throw the case out, the court denied dismissal of the ADEA disparate-impact claim on a delegation theory. As the later order records it, the plaintiff alleged that “Workday’s customers delegate traditional hiring functions, including rejecting applicants, to the algorithmic decision-making tools provided by Workday”, and that the software is “participating in the decision-making process by recommending some candidates to move forward and rejecting others” (Dkt. 80, at 9, quoted in Doc. 128). The reading is that a provider handed the screening decision can be reached, where a tool only sorting on the employer’s criteria would not.¹¹

On 16 May 2025 the court granted preliminary, meaning conditional, certification of a nationwide ADEA collective, an opt-in group action. It defined the collective as “all individuals aged 40 and over who, from September 24, 2020, through the present, applied for job opportunities using Workday, Inc.’s job application platform and were denied employment recommendations” (Doc. 128). Certification is procedural, not a merits ruling; Workday may later ask to decertify the collective.¹¹

Which states regulate AI in hiring?

A handful of states now have AI-in-employment rules, led by Illinois and Colorado; the detail belongs to our state-laws guide.^12,14

Illinois HB 3773, enacted as Public Act 103-0804, amends the Illinois Human Rights Act. It is a civil-rights violation for an employer to use artificial intelligence that “has the effect of subjecting employees to discrimination on the basis of protected classes”, or “to use zip codes as a proxy for protected classes”, and a separate violation to fail to notify employees that AI is used (775 ILCS 5/2-102). A proxy is a neutral-looking data point that stands in for a protected trait. The Act’s AI definition takes in generative AI (775 ILCS 5/2-101), and the Illinois Department of Human Rights is to make the notice rules. It takes effect 1 January 2026, per the enrolled Public Act.¹²

Illinois has had a separate Artificial Intelligence Video Interview Act (820 ILCS 42) since 2020, which requires notice, an explanation and consent before AI analyses a recorded video interview. We could not open the ILCS text, so we state only its general requirements and hand the detail to the state-laws page.¹³

Colorado repealed and re-enacted its 2024 AI Act (SB 24-205) as SB 26-189, signed 14 May 2026, whose duties take effect 1 January 2027 and are not yet in force. The re-enacted Act replaced the 2024 version’s reasonable-care framework with disclosure and liability-allocation rules: a developer documents a covered tool for deployers, and a deployer gives consumers notice and, after an adverse outcome, an explanation plus a right to correct data and to human review. It covers automated decision-making technology used for a consequential decision, with employment among the covered domains; the Attorney General enforces it, and it creates no new private right of action, leaving discrimination claims to existing state law. The full detail is in US state AI laws: Colorado and Texas, and the voluntary frameworks an organisation might run, the NIST AI RMF and ISO/IEC 42001, are in AI governance standards.^14,15

What is still undecided?

As of 11 November 2026, several questions are open.

• Whether the Mobley collective survives a decertification motion, and how the merits come out; the case has no merits ruling yet.
• Whether the EEOC issues replacement AI guidance, and how far Executive Order 14281 shifts federal enforcement away from disparate-impact theories, since the statutes stay in force.
• Illinois’s Department of Human Rights notice rules under HB 3773, and Colorado’s Attorney General rules before the AI Act’s 1 January 2027 start.^8,11,12,14

What does this mean for anyone building or buying AI?

In our view, the pattern across these rules is that the law was already here. Title VII, the ADEA and the ADA reach a hiring tool the same way they reach a person making the same call, and withdrawing the EEOC pages left those statutes untouched. New York City’s Local Law 144 and Illinois’s amendment mostly make an existing duty explicit: test the tool and tell the candidate, with a person kept in the loop and the employer answerable for the result. Mobley v. Workday points the same way, on the theory that a provider handed the screening decision can be handed the liability with it, though the court has decided no merits and may still decertify the collective. The settled case law still trails the technology, so the plain reading is the safe one: anti-discrimination duties already govern an automated decision about a person, and the audits and new statutes are filling in how to show the tool was checked before anyone relies on it.^{1,3,4,5,9,11,12}

For who answers for what an AI system says more broadly, see AI in law; for the risk-management standards an organisation can adopt, see AI governance standards.