Compliance · July 18, 2026 · 6 min read

Hiring AI is high-risk AI: building for NYC LL144 and the EU AI Act from day one

Automated hiring tools sit in the most regulated corner of applied AI. Why we treat NYC Local Law 144 and the EU AI Act as design inputs rather than legal afterthoughts — and what that means concretely in the product.

If you build AI for hiring, regulators have already decided what you are: NYC Local Law 144 makes automated employment decision tools subject to bias audits, and the EU AI Act places employment-related AI in Annex III — the high-risk category, with obligations around documentation, human oversight, logging and transparency. You can treat that as a legal department's problem, or as an engineering specification. We chose specification.

What that means concretely

• Bias scanning at generation — every question is scanned for bias signals before it can be banked, and the scan result is recorded. A failed scan doesn't quietly pass: unscanned content is held back rather than banked as audited-clean.
• Human oversight as a product feature — the recruiter review queue isn't compliance theatre; it is the Article-14-shaped human-in-the-loop, with approve/edit/reject actions logged.
• Audit trails everywhere — gate verdicts, consent records (data processing and proctoring consent are separate), gate decisions with reasons, and recruiter overrides with actor and reason. When an auditor asks 'why was this candidate rejected?', the answer is a query, not an archaeology project.
• Deletion that preserves integrity — GDPR Article 17 erasure removes personal content while retaining anonymised integrity hashes, so a deletion request doesn't destroy the audit trail itself.

The honest part

Tooling supports compliance; it doesn't confer it. An LL144 bias audit is something an independent auditor performs on your usage, and adverse-impact analysis is something your organisation owns. What a vendor can legitimately promise is to make those exercises possible — by generating the records they require. That's the promise we make, and the one we'd want from any vendor we bought.

There's also a market observation here: most assessment vendors publish no quality-control or audit methodology at all. As enforcement of these regimes matures, 'we can show our work' stops being a differentiator and becomes table stakes. We'd rather be early.