AI bias audits are now a legal requirement across multiple jurisdictions – not a best practice. NYC Local Law 144, the EU AI Act, and EEOC guidance collectively impose documented audit obligations on HR teams using AI in hiring. Organizations without a recurring bias audit program face quantifiable legal liability that employment practices liability insurers are beginning to exclude from coverage.

What Laws Now Require AI Bias Audits for HR?

The regulatory stack in 2026 covers most organizations using AI in hiring decisions. NYC Local Law 144 (effective January 2023) requires annual bias audits and public summary publication for any employer using Automated Employment Decision Tools in NYC hiring or promotion decisions. The Illinois Artificial Intelligence Video Interview Act requires disclosure when AI analyzes video interviews, plus annual bias audits of the AI tool. Maryland and California have added similar requirements at different compliance thresholds. The EU AI Act classifies employment AI as high-risk and requires conformity assessments – including bias evaluation – before deployment and continuous monitoring thereafter. Federal EEOC guidance makes employers liable for AI tool disparate impact regardless of whether state law mandates a formal audit.

What Must an AI Bias Audit Include to Satisfy Regulatory Requirements?

A compliant bias audit requires four documented elements. First: scope definition – which AI tools, which decisions, and which data period the audit covers. Second: adverse impact analysis, applying the 4/5ths rule calculation for each protected class in each decision category. Third: statistical significance testing to confirm the sample size supports reliable conclusions. Fourth: remediation documentation – if disparities are found, the corrective actions taken and post-remediation measurement results. NYC LL144 additionally requires the audit be conducted by an independent auditor (not the vendor) and that summary results be published publicly before the tool is used. Retain all audit documentation for a minimum of three years. For a broader look at data governance obligations that feed into bias audit recordkeeping, see 10 HR Data Governance Mistakes to Avoid.

How Often Must AI Bias Audits Run Under Current Regulations?

Minimum required frequencies vary by framework, but all point toward more frequent review than most HR teams currently run. NYC LL144 requires annual audits, completed no more than 12 months before the tool is used. The EU AI Act requires continuous monitoring for high-risk AI systems, with formal assessment at each significant system update. EEOC guidance implies continuous monitoring sufficient to detect and remediate disparities before they become systemic. Best practice is monthly adverse impact monitoring – automated via Make.com scenario – paired with an annual formal audit by an independent third party. The monthly monitoring catches emerging disparities before they accumulate; the annual audit satisfies formal regulatory requirements.

What Are Your Obligations When a Bias Audit Finds Disparate Impact?

When an audit finds a disparity ratio below 0.80, your organization has a defined sequence of required actions. Suspend or modify the affected AI tool immediately – continued use with known disparate impact creates intentional discrimination exposure. Conduct a root cause analysis to identify which rubric dimension or model feature is driving the disparity. Implement remediation (dimension removal, weight recalibration, or model retraining) and validate that it eliminates the disparity before redeployment. Re-review a sample of decisions made during the period of disparate impact and extend offers to any qualified candidate who was incorrectly screened out. Document all steps and retain the documentation. If the disparity was present for more than 60 days, have legal counsel review the remediation plan before redeployment.

Expert Take

HR leaders who say “our AI vendor handles compliance” are not covered. The vendor is responsible for their tool’s design; you are responsible for how you deploy it, what decisions it influences, and whether you conducted the audits required by the laws that apply to your organization. Vendor indemnification clauses rarely cover regulatory fines for your organization’s failure to audit. Own the audit process – contract the vendor’s cooperation, but own the compliance.

Key Takeaways

• NYC LL144, the Illinois AI Video Act, the EU AI Act, and EEOC guidance collectively require AI bias audits for most HR teams using AI in hiring decisions.
• A compliant audit covers scope definition, adverse impact analysis (4/5ths rule), statistical significance testing, and remediation documentation.
• Minimum frequency: annually per NYC LL144, with continuous monitoring required under the EU AI Act and EEOC best practice.
• On finding disparate impact: suspend the tool, conduct root cause analysis, remediate, re-review affected decisions, and document every step.
• Vendor indemnification does not cover your organization’s failure to audit – own the compliance process.

Frequently Asked Questions

Does NYC Local Law 144 apply to out-of-state employers hiring for NYC roles?

Yes – NYC LL144 applies to employment decisions affecting NYC workers regardless of where the employer is headquartered. If your AI screening tool processes applications for roles based in New York City, LL144 applies to those decisions even if your HR team operates from another state. Consult employment counsel for the specific applicability determination for your organization’s hiring footprint.

Can you use your AI vendor’s own bias audit to satisfy regulatory requirements?

No – under NYC LL144, the bias audit must be conducted by an independent auditor separate from the vendor, and a vendor self-audit does not satisfy the law. For other regulatory frameworks, vendor-conducted audits face credibility challenges in enforcement proceedings. Commission an independent audit annually regardless of what vendor audits are available, and use the vendor’s audit as supplementary evidence, not as your compliance documentation.

What should HR leaders expect when scoping an independent AI bias audit?

Independent audit scope – and the investment required – scales with the number of AI tools audited, the volume of decisions analyzed, and the auditor’s methodology. Organizations that build internal monthly adverse impact monitoring via Make.com automated scenarios reduce the scope of the annual independent audit substantially by providing the auditor with a complete, structured decision log rather than requiring them to reconstruct it. A qualified independent auditor is a required line item for any organization subject to NYC LL144 or the EU AI Act – treating it as optional creates the exact liability these regulations are designed to enforce.