AI Is in Your Hiring Whether You Chose It or Not

Disclosure, up front

We build automation, including tools that touch recruitment workflows, and this article argues that hiring is the one place we would tell you to automate least. It is also not legal advice — employment law is jurisdiction-specific and fact-specific, and the point at which you need a real employment lawyer is section 06. Figures below are dated and attributed.

If you asked most small business owners whether they use AI in hiring, they would say no. Then you look at the software.

The applicant tracking system ranks candidates. The job board suggests a shortlist. The scheduling tool scores availability. The CV parser decides which experience counts as relevant. None of that was bought as "AI hiring", and most of it arrived in an update.

This matters more than any other AI question in your business, for a reason that has nothing to do with new AI statutes: employment discrimination law already existed, already has teeth, and does not care whether a human or a model made the decision.

The short version

You are probably already using it, inside an ATS or job board rather than as a separate product.
New York City has required an annual independent bias audit since July 2023, plus published results and candidate notice.
Almost nobody complied. When researchers checked 391 employers, about 5% had published an audit and 3–4% the required notice.
Enforcement is moving from complaint-driven to proactive in 2026, which changes the risk of that non-compliance considerably.
Illinois bars employer use of AI that discriminates against protected classes, and the underlying exposure exists in every jurisdiction regardless of any AI law.

01What New York City actually requires

Local Law 144 took effect on 5 July 2023 and was the first US law to regulate AI in hiring directly. If you use an automated employment decision tool on candidates or employees in New York City, it imposes three duties:

An annual bias audit by an independent third party. Not you, and not the vendor of the tool — a point people get wrong constantly. The audit calculates selection and scoring rates and the resulting impact ratios, testing for disparate impact by sex, race and ethnicity.
Publication of a summary of the most recent audit on your website.
Notice to candidates and employees that the tool will be used in their evaluation, given clearly and in time to matter.

Penalties run from $500 to $1,500 per violation. The structure is the dangerous part rather than the headline number: each day and each un-notified candidate can count separately. A tool quietly running for a hiring season against a few hundred applicants does not produce one fine.

02Almost nobody complied, and that is about to matter

Researchers checked. Roughly five months after the law took effect, a study examined 391 employers; of the 267 actively posting jobs in New York City, 14 (5%) had published an audit report and 12 (4%) had posted a transparency notice. Across the full set, only 11 employers had published both an audit and a notice that met the law's requirements.

For two years that was a low-consequence failure, because enforcement was complaint-driven and few candidates knew to complain.

That is what changed. Following a critical review of how the law was being enforced, the enforcing agency has committed to proactive rather than complaint-driven investigation, cross-trained staff and more rigorous handling, and employment firms are advising clients to expect a stricter phase in 2026 with more frequent investigations and higher cumulative penalties.

The uncomfortable arithmetic

If a 5% compliance rate was roughly accurate and enforcement becomes proactive, then the great majority of in-scope employers are non-compliant right now — not through defiance, but because nobody told them their ATS counted. The first question is not "are we compliant", it is "does our hiring software rank, score or filter anybody?" Most owners have never asked their vendor that.

03Outside New York, the exposure is older and broader

It is tempting to read this as a New York problem. The more important point is that anti-discrimination law applies to your hiring everywhere, and a tool that produces disparate outcomes is a problem whether or not a statute mentions AI.

Illinois makes it explicit: HB 3773, in force since 1 January 2026, amends the state Human Rights Act to bar employer use of AI that discriminates against protected classes. But Illinois did not create the liability; it named it. The same underlying exposure exists in states with no AI statute at all, under ordinary employment law that has been enforced for decades.

Which is why we treat hiring as the highest-risk AI use in a small business, ahead of anything involving security or data. Elsewhere the failure mode is embarrassment or cost. Here it is a legal claim by an identifiable person with an established cause of action.

04Where the risk actually sits in a small business

Where AI enters small business hiring, and the associated risk
Where it shows up	What it does	Risk
Applicant tracking system	Ranks or scores applicants, filters by "fit"	Highest. This is the classic in-scope tool, and it usually arrived by update.
Job board matching	Decides who sees your advert, suggests candidates	High, and partly outside your control — but you chose the platform.
CV parsing / keyword screening	Extracts and weights experience	High. Proxy discrimination via employment gaps, school names, phrasing.
AI-drafted job adverts	Writes the posting	Moderate. Wording can deter protected groups; a human should read every one.
Interview scheduling	Offers slots, scores availability	Low, unless availability scoring penalises caring responsibilities or observance.
AI note-taking in interviews	Transcribes and summarises	Low for bias, real for consent — recording rules vary by jurisdiction.

Our categorisation, based on where these tools appear in small business hiring stacks. The legal analysis of any specific tool depends on how it is configured and used, which is why section 06 exists.

05What to actually do

Ask every hiring tool one question in writing: does this rank, score, filter or otherwise materially assist a decision about a candidate? Keep the answer. A vendor that will not answer plainly has told you something.
If you hire in New York City and the answer is yes, you need the independent audit, the published summary and the candidate notice. The notice is the cheapest of the three and the one most likely to be missed per candidate.
Keep a human decision-maker on every rejection. Not review of a ranked list — an actual person deciding, able to say why. This is the control that survives across every jurisdiction.
Keep your records. Who applied, who was screened out, at what stage and on what stated basis. Disparate-impact questions are answered with data, and businesses that cannot produce it are in a much worse position than those whose data is imperfect.
Turn off "smart" ranking you did not choose, or at minimum find out how it is weighted. Features arriving in updates are the ones nobody assessed.
Write the job requirements before you see candidates. Old advice, and it is the cheapest bias control that exists, with or without software.

06When to stop and call an employment lawyer

You hire in New York City and any tool ranks or scores. The audit must be genuinely independent; getting that wrong is worse than not having one, because you have documented a defective process.
A candidate has asked how a decision was made. Answer carefully and get advice first.
You are about to buy a tool that promises to predict performance or culture fit. Those are the claims most likely to encode proxies for protected characteristics.
You operate in several states. The obligations differ, and a single national process may be non-compliant in one place while fine in another.

07The honest summary

Hiring is where AI carries the most legal risk for a small business, and it is the place people are least likely to know they are using it, because the ranking arrived inside software they already had.

New York City has required an independent bias audit, a published summary and candidate notice since 2023; compliance ran at around 5% and enforcement is now going proactive. Illinois names the same exposure that ordinary employment law has always created everywhere else.

Ask your hiring software whether it ranks anyone, keep a human making every rejection, and keep the records that would answer the question if it is ever asked.

08Common questions

Am I using AI in hiring without realising it?

Very likely, if your applicant tracking system ranks or scores candidates, your job board suggests shortlists, or your CV parser decides which experience is relevant. Most small businesses never bought an AI hiring product; the ranking arrived inside software they already had, usually in an update nobody assessed. The useful first step is asking each hiring tool, in writing, whether it ranks, scores or filters candidates.

What does New York City's Local Law 144 require?

Three things, in force since 5 July 2023, if you use an automated employment decision tool on candidates or employees in New York City: an annual bias audit by an independent third party — not you and not the tool's vendor — calculating selection and scoring rates and impact ratios by sex, race and ethnicity; publication of a summary of the most recent audit on your website; and clear, timely notice to candidates and employees that the tool will be used.

What are the penalties under Local Law 144?

Between $500 and $1,500 per violation. The structure matters more than the headline figure, because each day and each un-notified candidate can be counted as a separate violation. A ranking tool running quietly through a hiring season against a few hundred applicants does not produce a single fine.

Is anyone actually enforcing AI hiring rules?

Increasingly, yes. For its first two years enforcement was complaint-driven and compliance was very low — researchers checking 391 employers roughly five months after the law took effect found about 5% had published a bias audit and 3 to 4% the required notice, with only 11 employers having both in compliant form. Following a critical review, the enforcing agency has committed to proactive rather than complaint-driven investigation, and employment firms are advising clients to expect stricter enforcement through 2026.

I do not hire in New York. Does any of this apply to me?

The specific audit and notice duties are New York City's. The underlying liability is not. Anti-discrimination law applies to hiring everywhere and does not care whether a human or a model produced a disparate outcome. Illinois HB 3773, in force since 1 January 2026, makes this explicit by barring employer use of AI that discriminates against protected classes, but Illinois named an exposure that already existed rather than creating one.

Which hiring tools carry the most risk?

Anything that ranks, scores or filters people. Applicant tracking systems that score fit, job board matching that decides who sees your advert, and CV parsing that weights experience are the highest risk, partly because CV screening can discriminate by proxy through employment gaps, school names or phrasing. AI-drafted job adverts are a moderate risk since wording can deter protected groups. Interview scheduling and note-taking are lower risk for bias, though recording consent rules vary by jurisdiction.

What is the single most useful control?

Keep a human decision-maker on every rejection — an actual person deciding and able to say why, not someone reviewing an already-ranked list. It works in every jurisdiction, does not depend on which AI statute applies, and is the thing you will most want to be able to describe if a decision is ever questioned. Pair it with keeping records of who applied, who was screened out, at what stage and on what stated basis.

Can our AI vendor do our bias audit?

Not for Local Law 144 purposes. The audit must be conducted by an independent third party, which excludes both the employer and the vendor of the tool. This is one of the most commonly misunderstood parts of the law, and a vendor-run audit presented as compliance is worse than no audit, because it documents a defective process.

Ask your hiring software one question

Send your applicant tracking system, job board and CV screening tools this question: does it rank, score or filter candidates? Forward us what they say. We will tell you which of them puts you in scope of anything, and which is simply storing applications. Most stacks come back with one tool that matters and several that do not, and the audit is free.

Ask for a hiring AI check

Sources, read 9 September 2026: the text and requirements of New York City Local Law 144, effective 5 July 2023, and law firm analyses of the 2026 shift toward proactive enforcement; the peer-reviewed compliance study of 391 employers conducted 24 October to 9 November 2023 for the 5% audit and 3–4% notice figures; and Illinois HB 3773, in force 1 January 2026. The risk table and the practical controls are our own. This describes legislation and is not legal advice — employment law is jurisdiction- and fact-specific, and the situations in section 06 need a qualified employment lawyer. Related: The State AI Law Everyone Told You to Prepare For and Which Decisions You Should Never Hand to an AI Agent.

Hero image from Unsplash, used under the Unsplash License.