The AI Hiring Compliance Checklist: 10 Steps for Small Employers
7 min read · Last reviewed 1 Aug 2026
General information, not legal advice. Laws in this area change; verify against the official sources at the end of this guide and confirm specifics with employment counsel.
Across NYC's Local Law 144, Illinois' HB 3773, California's automated-decision regulations, Colorado's AI Act, and the federal disparate-impact framework, the duties repeat: know what your tools do, tell candidates, check for bias, keep records, and let humans decide. That repetition is good news, because it means one process, done once, covers nearly everything.
This checklist is that process, in ten steps ordered so each builds on the last. A small employer with a part-time office manager can complete the setup steps in an afternoon and the recurring steps in about an hour a quarter. It organizes your obligations; it does not discharge them, and it is not legal advice: where a step flags a jurisdiction-specific duty, the linked guide and your counsel carry the details.
Steps 1-2: inventory your tools and map your jurisdictions
Step 1: list every automated step between "application received" and "interview scheduled." Include the obvious screening tool, but also the features you did not choose deliberately: your job board's "top matches" ranking, the ATS relevance score, a chatbot that pre-screens, an LLM someone pastes resumes into. For each, write one line: what it takes in, what it puts out, and whether its output influences who advances. Anything that scores, ranks, filters, or recommends candidates is in scope; anything that merely stores or formats is not.
Step 2: list where your candidates and roles are. Any NYC-based roles? Illinois, California, or Colorado applicants? This mapping decides which duties bind you: NYC roles trigger the audit-and-notice regime, Illinois brings effect liability and notice, California brings four-year records and testing-as-evidence, Colorado brings notice and adverse-decision rights from 2027. If you hire remotely and nationally, assume all four and run the strictest common baseline.
Re-do both lists whenever you add a tool or expand hiring into a new state. The 2-minute compliance check automates step 2's conclusions.
Steps 3-4: notices in postings and honest criteria
Step 3: put an AI-use notice in every job posting, on your careers page, and in the application confirmation email. The notice states that an automated tool assists screening, lists the qualifications and characteristics it assesses, says a human makes final decisions, and gives a contact for questions, accommodations, or alternative-process requests. Posting placement solves NYC's 10-business-day clock automatically; blanket delivery beats per-state logic. Use the free generator to build it from your actual criteria, and regenerate when criteria change.
Step 4: make the criteria the notice discloses genuinely job-related and human-set. Screen on experience, skills, availability, credentials: things you could defend out loud to the candidate. Remove proxies: ZIP codes and location signals (banned outright in Illinois), school prestige as a stand-in for ability, writing-style polish that penalizes non-native speakers. If you cannot explain why a criterion predicts success in the role, it should not be scoring candidates.
These two steps are where compliance and candidate experience align: an honest notice with real criteria reads as professionalism, not legalese.
Steps 5-6: self-check for bias, and the official audit where required
Step 5: run a four-fifths self-check on your funnel quarterly and after any change of tool or criteria. Export per-candidate outcomes from your screening tool, join your voluntarily collected demographic self-ID data (kept separate from applications, never inferred), compute each group's selection rate against the highest group's, and investigate anything under 0.80 with a real sample behind it. The free browser-based self-check does the math without uploading anything. Keep the results and a note on what you did about them: in California, your testing history is evidence.
Step 6: if any role is NYC-based, the self-check is not enough: LL144 requires an independent third-party audit of the tool within the last year, with the summary published on your careers page. The realistic path is your vendor's pooled independent audit: collect the current summary and distribution date, publish, and calendar the annual refresh. No current audit from the vendor is a switch-tools signal.
Order matters: employers who self-check quarterly walk into official audits without surprises.
Steps 7-8: records and documented human decisions
Step 7: keep the full record of each screening: the criteria and weights used, every candidate's scores with the evidence behind them, the shortlist outcome, and who made the final call. Export it when the screening closes and retain four years, which satisfies California's extended requirement and everything shorter. The test of a good record: a year from now, could you reconstruct why candidate 41 did not advance, in one sentence, with a quote? If your current tool cannot produce that export, that is a tooling problem to fix now, not during discovery.
Step 8: make human decision-making real and visible. No stage of your funnel should reject a candidate without a person having decided; "the software ranked them low" is not a decision, it is an input. Have the reviewer confirm the shortlist, record who confirmed it, and note any overrides (a low-scored candidate advanced, a high-scored one held back) with a reason. Courts and regulators treat rubber-stamp review as no review (the Mobley v. Workday litigation exists precisely because of that), so the point is not a checkbox but a documented judgment on evidence.
Steps 9-10: vendor diligence and the annual review
Step 9: put five questions to any screening vendor, current or prospective. What exactly does the tool assess, and can I see and set the criteria? Does anything auto-reject? Can I export per-candidate scores, evidence, and outcomes? Where roles require it, is there a current independent bias audit I can publish? What documentation supports my duties under Colorado-style laws (intended use, known limitations)? A vendor that answers all five in writing is carrying its share of your compliance load; a vendor that cannot is quietly transferring risk to you. (For the record, SiftFirst's answers: the criteria are yours and visible, nothing auto-rejects, every score carries a quoted line of evidence, exports are built in, and the explainability statement is public.)
Step 10: calendar an annual review: re-run the inventory and jurisdiction map, refresh the audit summary if NYC applies, regenerate notices against current criteria, spot-check that records are actually being exported and retained, and re-check the laws' status via the guides in this hub, which carry last-reviewed dates and primary sources. Laws in this space moved every year for the past four; an hour annually keeps the process current.
Start with the 2-minute compliance check to see which steps bind you today, and take the checklist to counsel to confirm the details for your specific footprint.
Key takeaways
- ✓One process covers the overlapping core of NYC, Illinois, California, Colorado, and federal rules: inventory, notices, honest criteria, bias checks, records, human decisions.
- ✓Setup is an afternoon: tool inventory, jurisdiction map, notice in every posting, and job-related criteria with proxies removed.
- ✓Recurring work is about an hour a quarter: a four-fifths self-check with documented follow-up, plus record exports as screenings close; add the vendor's annual independent audit summary if NYC roles apply.
- ✓Records answer the only question that matters later: why did this candidate not advance, in one sentence, with a quote; four-year retention covers the strictest rule.
- ✓Vet vendors with five written questions (criteria visibility, no auto-reject, exports, audit, documentation); a vendor that cannot answer is transferring risk to you.
Screening built for these rules
SiftFirst scores candidates against criteria you set, quotes the resume line behind every score, never auto-rejects, and exports the records these laws expect. The candidate notice generator and bias audit self-check are free.
FAQ
How long should I keep screening records?
Four years covers the strictest applicable rule (California's ADS recordkeeping); federal baselines are shorter, and NYC's audit cycle is annual. Standardizing on four years for criteria, scores, evidence, outcomes, and decision notes is simpler than per-jurisdiction schedules, and storage is effectively free at small-business volumes.
If I complete this checklist, am I compliant?
The checklist organizes the recurring duties shared across the major regimes; it cannot certify compliance, because details (NYC's audit independence rules, Illinois' notice regulations, Colorado's amendment status) are jurisdiction-specific and change. Treat it as the structure that makes counsel's review short and cheap rather than a substitute for it. Anyone promising that a tool or checklist makes you compliant is overselling.
What is the single highest-risk gap to close first?
Silent screening: candidates rejected by an automated ranking with no notice given, no records kept, and no human decision documented. That combination violates the notice duties where they exist, leaves you nothing to answer a discrimination claim with anywhere, and is entirely self-inflicted. The fixes are steps 3, 7, and 8, and they take a day.