AI Hiring Compliance in 2026: A Practical Checklist for HR Teams
5 min read
What the EU AI Act and NYC Local Law 144 require from teams using AI in hiring — candidate notice, bias auditing, human review, record-keeping — as a checklist you can work through before your next role opens.
Using AI in hiring is legal nearly everywhere. Using it without disclosure, auditing, or a human review path is where teams get into trouble. This is the checklist, written for someone who has to open a role next week rather than write a policy paper.
What the two big regimes ask for
| Requirement | EU AI Act | NYC Local Law 144 |
|---|---|---|
| Risk classification | Recruitment and selection systems are high-risk | Applies to automated employment decision tools |
| Candidate notice | Required for people subject to the system | Required, at least 10 business days before use |
| Bias audit | Risk management and testing obligations | Independent audit, annually, results published |
| Human oversight | Required — a person must be able to intervene | Expected in practice |
| Record-keeping | Logs and technical documentation | Audit results retained and publicly posted |
Neither regime bans AI screening. Both make it something you must be able to explain.
The checklist
- 01Write down which stage the AI touches. Sourcing, screening, interviewing, ranking, or deciding. The obligations attach to decisions, so be precise.
- 02Disclose it to candidates before they enter the stage. One clear paragraph in the job post and the invitation email.
- 03Keep a human on every reject and every advance. Named, and able to answer a candidate's question without contacting the vendor.
- 04Agree the rubric before the role opens. Scoring criteria written first is the difference between assessment and rationalisation.
- 05Require cited evidence for every rating. A score you cannot trace to an answer cannot be defended.
- 06Monitor selection rates by group. Quarterly at minimum, and again after any model change.
- 07Commission the bias audit if you are in scope. Independent, annual, published.
- 08Contract for data. Confirm in writing whether candidate content trains vendor models, how long transcripts are retained, and how you export them.
- 09Give candidates their assessment summary. Not required everywhere; it is the cheapest trust-building step available.
- 10Keep the records. Job post, notice, rubric, transcripts, decisions, and who made them.
The common failure
Not malice — drift. A team adopts a tool for sourcing, then quietly starts using its ranking to reject, and nobody re-reads the notice or the audit scope. Re-check the first item on this list whenever the way you use the tool changes.
Related reading
- AI in HR, explained — where AI works and where it does not.
- How to choose reliable AI HR tools — governance questions to ask vendors.
- AI HR tools comparison table — which categories include bias monitoring.
This is not legal advice; confirm your obligations for your jurisdiction and role types. Octively runs disclosed, structured, evidence-cited, human-reviewed hiring by default — join the waitlist for early access.