An agent that screens, scores or ranks job candidates is regulated in at least two places. New York City requires a bias audit within one year of use, a published summary and candidate notice. The EU AI Act lists recruitment systems as high risk in Annex III. This is a plain-language guide, not legal advice.
New York City Local Law 144
The city's Department of Consumer and Worker Protection (DCWP) enforces Local Law 144 on automated employment decision tools. Its page states these points:
- An employer or employment agency may not use such a tool unless it has been subject to a bias audit within one year of its use.
- Information about the bias audit must be publicly available, and the page lists the duty to post a summary of the audit results.
- Candidates and employees must receive notice. The page says notice must be given 10 business days before use of the tool, a timing DCWP clarified in June 2023.
- DCWP began enforcing the law and its rule on 5 July 2023.
The DCWP page itself does not define the tool or list penalties. Read the law text and the DCWP FAQ for those points.
EU AI Act, Annex III point 4
Annex III lists high-risk areas under Article 6(2). Point 4 covers employment, workers management and access to self-employment:
- 4(a): systems for recruitment or selection of natural persons, including targeting job ads, screening applications and evaluating candidates.
- 4(b): systems used to make decisions affecting terms of work relationships, including promotion or termination, task allocation based on personal traits, and monitoring and evaluating performance and behaviour.
Our post on the Article 6(3) exemption explains when a listed system may still fall outside high risk. Check it before assuming either way.
Agents change the question
A classic screening tool scores a resume. An agent may go further: search for candidates, send outreach, schedule, and reject. Each step needs the same questions:
- Does it screen or rank candidates? If yes, treat it as in scope for both regimes until a lawyer says otherwise.
- Who audits it, how often, and where is the summary posted?
- When do candidates get notice, and what does it say?
- Can a person review and reverse a rejection? See also GDPR Article 22 for solely automated decisions in the EU.
- Are the agent's actions logged so you can show what it did?
A practical checklist
- Keep a list of every AI tool and agent touching hiring, including features inside your applicant tracking system.
- Ask each vendor for audit evidence, and for what the tool does with candidate data.
- Put notice in the job posting flow, well before first use.
- Keep humans in the decision to reject, with the authority to disagree.
- Review monthly: what did the agent decide, and what did humans change?
Where Safeguard fits
Safeguard's asset discovery and compliance and evidence automation can help you keep the inventory and review records. Policies and gates can require a human approval step before an agent takes an action that affects a person.
Quick check
Does Local Law 144 apply if a human makes the final call?
Check the law text and DCWP FAQ. The DCWP page does not define the tool, so the definition decides, not the presence of a human alone.
Is every hiring AI high risk under the EU AI Act?
Annex III lists recruitment and selection systems, but Article 6(3) can exempt some. Assess each system.
Sources
Last reviewed: 19 October 2026.
