AI in hiring
The laws that reach a resume-screening tool, worked on a real one.
A screening tool ranks applicants in four jurisdictions. The talent team wants to know whether it needs a bias audit, what the candidates in Germany and the United Kingdom must be told, what California adds and where federal employment law comes in. This page shows the determination LegisGate returned for that exact tool.
The example
Applicant Screening Assistant: a vendor tool that ranks applicants.
It reads CVs and application forms for clinical and administrative roles, scores each applicant against the job description and ranks them into a shortlist. The People and Talent team in Germany, the United Kingdom, California and New York uses the ranking to decide whom to invite to interview. Nobody is rejected by the tool alone.
What a talent team asks
Five questions, answered from the determination.
Each answer is what the product showed for this tool. The obligation titles and citations are quoted as the platform renders them.
Do we need a bias audit before we use it in New York?
Yes for this example. The tool ranks applicants for roles in New York City, so NYC Local Law 144 applies and returned 12 obligations: the audit itself, dated within a year of use; the published summary; ten business days' notice to candidates; and the data disclosure on the website.
- § 20-871(a)(1) Bias audit conducted no more than one year before useN.Y.C. Admin. Code § 20-871(a)(1)NYC Local Law 144
- § 20-871(b)(1) Notice that a tool will be used, ten business days before useN.Y.C. Admin. Code § 20-871(b)(1)NYC Local Law 144
- § 5-301 Required bias audit calculations6 RCNY § 5-301NYC Local Law 144
- § 5-304(d) Website data disclosure, posted request instructions, and the thirty-day response6 RCNY § 5-304(d)NYC Local Law 144
Can we run it on candidates in Germany and the United Kingdom?
The determination lists the groundwork first: a lawful basis for each purpose, a condition for any special-category data in an application, meaningful human review of the ranking, a processor contract with the vendor, a DPIA before the high-risk processing starts, and a transfer safeguard where the data leaves the UK. GDPR returned 15 obligations and UK GDPR 11.
- Identify and document Applicant Screening Assistant's art. 6 lawful basis for each purposeRegulation (EU) 2016/679 (General Data Protection Regulation) art. 6GDPR
- Give a meaningful human review to Applicant Screening Assistant's automated decisionsRegulation (EU) 2016/679 (General Data Protection Regulation) art. 22GDPR
- Identify an art. 9(2) condition before Applicant Screening Assistant processes special-category dataRegulation (EU) 2016/679 (General Data Protection Regulation) art. 9GDPR
- Complete a DPIA before Applicant Screening Assistant's high-risk processing beginsRegulation (EU) 2016/679 (General Data Protection Regulation) art. 35GDPR
- Document the transfer safeguard for restricted transfersUK GDPR (assimilated Regulation (EU) 2016/679) art. 46UK GDPR
What does California add on top?
Two layers. The privacy regulations on automated decision-making technology ask for a risk assessment before the tool is used for a significant decision, and from 2027 a pre-use notice and an opt-out or human appeal. The Civil Rights Department's employment rules speak the recruiter's language directly: adverse impact, business necessity, and four years of record-keeping that includes the system's data.
- Conduct a risk assessment before using Applicant Screening Assistant as ADMT for a significant decision (11 CCR § 7150(b)(3))11 CCR § 7150(b)(3)California ADMT
- Pre-use Notice before using ADMT for a significant decision (by January 1, 2027)11 CCR § 7220California ADMTfrom January 1, 2027
- Opt-out of ADMT, or a qualifying human appeal (by January 1, 2027)11 CCR § 7221California ADMTfrom January 1, 2027
- Facially neutral ADS with adverse impact must be job-related and consistent with business necessityCal. Code Regs. tit. 2, § 11017(e)California CRD Employment AI
- Four-year preservation of records including automated-decision system dataCal. Code Regs. tit. 2, § 11013(c)California CRD Employment AI
- ADS assessments as medical or disability-related inquiriesCal. Code Regs. tit. 2, § 11071(e)California CRD Employment AI
Where does federal employment law come in?
The determination did not treat the tool as new law's problem alone. Title VII and the ADA returned five obligations between them, in the vocabulary of employment law: disparate impact, reasonable accommodation, and tests that must measure the skill rather than an impairment.
- Disparate impact: a practice that causes it must be job related and consistent with business necessity42 U.S.C. § 2000e-2(k)Title VII of the Civil Rights Act of 1964
- Reasonable accommodation for applicants and employees with disabilities42 U.S.C. § 12112(b)(5)(A)Americans with Disabilities Act, Title I
- Employment tests must measure the skill tested, not a sensory, manual or speaking impairment42 U.S.C. § 12112(b)(7)Americans with Disabilities Act, Title I
Is it high-risk under the EU AI Act?
For this example, yes: employment, workers' management and access to self-employment is the reason shown, with a note to confirm the Annex III categorization and the art. 6(3) analysis with counsel. The screen shows the deployer obligations applying from December 2, 2027, extended from August 2, 2026 by Regulation (EU) 2026/1744. Three obligations are in force today.
- Prohibited AI practices — screen the deployment against art. 5 and refrain (Regulation (EU) 2024/1689 art. 5)Regulation (EU) 2024/1689 (Artificial Intelligence Act) art. 5EU AI Act
- Confirm the art. 4a safeguards if special-category data is processed to detect or correct bias in Applicant Screening Assistant (art. 4a)Regulation (EU) 2024/1689 (Artificial Intelligence Act) art. 4aEU AI Act
- EU AI Act art. 4 — confirm AI literacy for staff operating this systemRegulation (EU) 2024/1689 (Artificial Intelligence Act) art. 4EU AI Act
Every law that returned obligations
Eleven laws, sixty-seven obligations.
The determination also checked 59 other laws in those jurisdictions: three covered them with no obligation attached, six could not be determined, and 50 did not apply, each with its reason.
- GDPREuropean Union · 15 obligations
- NYC Local Law 144New York City · 12 obligations
- UK GDPRUnited Kingdom · 11 obligations
- CCPA / CPRACalifornia · 6 obligations, 1 from January 1, 2027
- California ADMTCalifornia · 6 obligations, 3 from January 1, 2027
- California CRD Employment AICalifornia · 4 obligations
- NIS2European Union · 4 obligations
- Americans with Disabilities Act, Title IUnited States · 3 obligations
- EU AI ActEuropean Union · 3 obligations
- Title VII of the Civil Rights Act of 1964United States · 2 obligations
- Bundesdatenschutzgesetz (BDSG)Germany · 1 obligation
Three laws cover the jurisdictions with no obligation attached to this tool: California SB 942, the EU Cyber Resilience Act and the EU Data Act. Six questions were not answered, so six laws are recorded as not determined. The figures are as recorded on October 7, 2026 and move when the law library or the answers change and the AI use case is checked again. Your result depends on your own answers.
What was ruled out, and why
A no is only useful when you can see the reason.
For each law that did not apply, the determination records the intake answer that ruled it out. A sample from this example:
ECOA
The answer to "Does this AI make or influence credit decisions?" is No — recommendations, fraud alerts, or other non-credit decisions only. This law applies when the answer is Yes.
California Insurance Code
The answer to "Does this AI make insurance-product decisions?" is No. This law applies when the answer is Yes — underwriting, pricing, claims, coverage, or similar insurance-product decisions.
Fair Housing Act
The answer to "Which significant-decision domains does this AI touch?" is Employment, hiring, or workplace decisions. This law applies when the answer is Housing.
MHRA AIaMD
The answer to "Does this AI make, support, or influence clinical decisions?" is No — this AI does not make, support, or influence clinical or health-treatment decisions. This law applies when the answer is Yes.
DORA
The answer to "Industry sector" is Workforce and Employment. This law applies when the answer is Financial Services.
California AB 2013
The answer to "What type of AI system is this?" is Predictive or analytical AI — forecasts, scores, or ranks. This law applies when the answer is Generative AI — writes text, images, video, or audio.
The assessment it opens
A DPIA for the candidates in Germany and the United Kingdom.
Because the determination found high-risk processing, the DPIA opens in the workspace with the regulatory part prepared and your part as guided questions across seven sections, from the description of processing to the sign-off record, and an export in the format your authority expects.
- Every obligation is tied to a provision.
- Every provision shown is checked against the primary source, and its in-force status is stated.
- No AI model decides which laws apply, writes the legal content or creates a citation.
Getting started
Your first five AI use cases are free.
Add your hiring tool, answer the intake form and read the determination. Your counsel decides whether it is sufficient.