Bias audit duties are far narrower than the market assumes, and the finding reorders most compliance plans. Across every United States and European regime touching AI in employment, exactly one mandates an independent bias audit, and that one is New York City. Everywhere else the duty is notice, documentation, consumer rights or ordinary discrimination liability. Teams that budgeted for audits in five jurisdictions have usually mispriced four of them, and the work they actually need is closer to detecting and mitigating bias as an ongoing control than to a procurement exercise.
Bias audit jurisdiction lists make that hard to see, because a list organised by state invites you to read all of it and conclude that everything applies. A hiring tool is caught by a bias audit regime, or not, on facts: where the worker sits, how much the tool decides, which decision it touches, and what the date is. Six questions settle it.
Work them in order. Each one eliminates regimes rather than adding them, and the answers have moved substantially during 2026, including a federal change filed eight days before this page was written.
Question one: where does the person the decision affects actually sit
Location of the applicant or employee, rather than location of the employer, is the primary trigger almost everywhere. A Texas company screening a candidate for a New York City role is inside Local Law 144 and owes a bias audit. A New York company screening a candidate in Illinois is inside the Illinois Human Rights Act amendments.
Bias audit scoping comes down to five jurisdictions in practice. New York City reaches employers and employment agencies using an automated employment decision tool to screen candidates or evaluate employees for promotion within the city. Illinois reaches employers using AI in covered employment decisions anywhere in the state. California reaches employment decisions through two separate instruments at once. Colorado will reach consequential decisions from 1 January 2027. The European Union reaches employment uses listed in Annex III of the AI Act, though not until 2 December 2027. Anyone scoping beyond these five should start from which countries have binding AI law at all.
Bias audit duty attaches to exactly one of those five, the first. Hold that thought through the next four questions, because it is the thing most jurisdiction tables obscure.
Question two: does the tool decide, or does it merely inform
Every regime sets a machine-involvement threshold, and no two of them are set at the same height. A single tool can clear one and fall below another, which is why a global answer to “are we covered” is usually wrong.
New York City uses substantially assist or replace discretionary decision making, applied to a computational process derived from machine learning, statistical modelling, data analytics or artificial intelligence. Colorado’s replacement statute uses materially influence, and excludes incidental, trivial or clerical uses. California’s privacy rules use replace or substantially replace human decision making. Illinois reaches AI used in covered employment decisions without importing a quantitative threshold at all.
Read those four side by side and a resume parser that ranks candidates for a human reviewer sits in a different position under each, which decides whether a bias audit is owed at all. Materially influence is the widest of the four. Substantially replace is the narrowest. An honest coverage assessment records which threshold was applied to which tool and why, because that reasoning is the part an enforcement authority will test. The methodology behind selection rates and impact ratios only becomes relevant once a tool is inside a threshold that demands measurement.
Question three: which employment decision does the tool touch
Decision type eliminates more tools than technology does, and it is the question teams skip.
AEDT coverage under Local Law 144 extends to two things only: screening candidates for employment, and evaluating employees for promotion. An AEDT used for workforce scheduling, performance monitoring or compensation banding sits outside it. California’s privacy rules take the opposite approach with a broad list of significant decisions covering hiring, compensation, work allocation or assignment, promotion, demotion, suspension and termination, and extending to independent contracting decisions. Colorado’s consequential decisions span education, employment, housing, financial services, insurance, healthcare and essential government services.
So a compensation model falls outside the New York City bias audit regime, inside the California one, and inside the Colorado one from January 2027. Mapping tools to decision types before mapping them to jurisdictions saves a round of analysis, and the inventory of hiring tools and the records each one generates is where that mapping belongs.
Question four: are you being asked to audit, or only to tell someone
Audit duty and notice duty are different animals, and the distinction reprices programmes more than anything else on this page.
New York City requires an annual bias audit by an independent auditor, evaluating disparate impact by sex, race and ethnicity through selection rates, scoring rates and impact ratios, with a summary of the most recent audit posted clearly and conspicuously on the employer’s website, plus advance notice to candidates identifying the qualifications assessed and the right to request an alternative process or accommodation. A bias audit under Local Law 144 is therefore a measurement duty with a publication duty attached. The full set of Local Law 144 requirements runs deeper than most summaries suggest.
Illinois requires notice when AI is used in a covered employment decision, bars the use of zip codes as a proxy for protected classes, and prohibits AI use that discriminates under state law. No bias audit is mandated.
California layers a privacy regime on top of an anti-discrimination regime. The Fair Employment and Housing Act regulations extended discrimination protections to automated decision systems. The privacy rules add pre-use notice, at least two opt-out methods, access rights covering the logic and the specific output for that individual, and a risk assessment weighing privacy risks against benefits. A risk assessment is not a bias audit, and the question it answers is different.
Colorado’s replacement statute requires clear and conspicuous pre-use notice, an explanation within 30 days where an adverse outcome results, rights to correct materially inaccurate personal data and to request human review where commercially reasonable, and developer documentation flowing down to deployers.
Bias audits mandated across those four paragraphs: one.
Question five: the federal methodology layer is being withdrawn under everyone
Bias audit reports lean on a federal methodology that is now being withdrawn, and the change has not reached most compliance guidance yet.
The four-fifths rule, under which a selection rate below 80 per cent of the highest group’s rate is generally treated as evidence of adverse impact, is a creature of the Uniform Guidelines on Employee Selection Procedures at 29 C.F.R. Part 1607. On 16 October 2026 the EEOC sent a final rule rescinding the interpretive portions of those Guidelines to the Office of Information and Regulatory Affairs, under RIN 3046-AB43. The regulatory agenda projects final action in November 2026 and an effective date in January 2027. Recordkeeping sits in a separate proposal that has not yet gone out for comment.
Direction of travel is already visible elsewhere in the federal estate. The Office of Personnel Management published an interim final rule on 31 July 2026 stripping references to the Guidelines out of federal personnel regulations, citing a Department of Justice Office of Legal Counsel opinion of 9 June 2026 titled Constitutionality of Disparate-Impact Liability Under Title VII. OLC concluded that the Guidelines embrace an unconstitutional reading of Title VII.
Now trace what survives, because the answer is not nothing. Disparate impact liability lives in the statute at 42 U.S.C. 2000e-2(k)(1)(A)(i), not in the Guidelines, and private plaintiffs can still bring those claims. Fourteen state attorneys general have issued joint guidance that disparate impact liability remains enforceable. Illinois will codify disparate impact liability in employment more broadly from 1 June 2027. So the interpretive scaffolding is going while the underlying exposure stays, which is close to the worst configuration for anyone relying on a vendor report.
Bias audit methodology under Local Law 144 sits in the city’s own rules rather than in the federal Guidelines, which is the chain worth following to its conclusion. Rescinding the Guidelines does not touch the city duty. A vendor bias audit whose stated authority is the Uniform Guidelines will nonetheless, from January 2027, cite an authority that no longer exists, while the city obligation it was procured to satisfy carries on unchanged. Reviewing what your bias audit reports actually cite is a short task with a hard deadline, and the federal Title VII position is the context it needs.
Question six: what is today’s date, because four of these moved in 2026
Commencement is where plans break, and 2026 has been unusually unkind to anyone who wrote a compliance calendar in 2025.
Colorado repealed and reenacted its landmark statute. The governor signed Senate Bill 26-189 on 14 May 2026, removing the duty of reasonable care to prevent algorithmic discrimination, the deployer risk management programme and the annual impact assessment. What replaced them is a transparency framework built on automated decision-making technology, effective 1 January 2027, with Attorney General rules due the same day, enforcement reports from January 2028 and the right to cure sunsetting in 2030. Enforcement runs through the Attorney General as a deceptive trade practice, with a 60 day cure period unless the violation was knowing or repeated, and there is no private right of action. Teams holding an older Colorado readiness checklist are holding a plan for a statute that no longer exists.
Illinois has a live statute with no rules behind it. The amendments took effect 1 January 2026. The Department of Human Rights published proposed rules on 15 May 2026, then postponed the rulemaking on 2 June 2026 and cancelled the hearing set for 10 June, giving no revised timeline. The statutory duties bind regardless. The withdrawn draft remains the best available signal of what notice content will eventually be required, and the current Illinois position rewards close reading.
California runs two clocks. The Fair Employment and Housing Act regulations covering automated decision systems took effect 1 October 2025. The privacy rules on automated decision-making technology began on 1 January 2026, with full compliance required by 1 January 2027 for businesses already using the technology for significant decisions, and compliance before implementation for anyone adopting it later. The agency finalised those rules in September 2025. Penalties reach 2,500 dollars per violation and 7,500 dollars for an intentional violation, and the state regulations on automated decision systems in employment are the discrimination half of that pair.
The European Union moved the other way and gave everyone more time. Employment uses listed in Annex III are high-risk, and those obligations now apply from 2 December 2027 rather than August 2026.
| Jurisdiction | Bias audit required | Core duty | Binds from |
| New York City | Yes, annual, independent | Audit, publish summary, notify candidates | In force |
| Illinois | No | Notice, no zip code proxy, no discriminatory use | 1 January 2026, rules postponed |
| California, employment regulations | No | Anti-discrimination duties extended to automated systems | 1 October 2025 |
| California, privacy regulations | No | Pre-use notice, opt-out, access, risk assessment | Full compliance 1 January 2027 |
| Colorado | No, removed in 2026 | Pre-use notice, adverse outcome explanation, correction and human review rights | 1 January 2027 |
| European Union | No | High-risk obligations for Annex III employment uses | 2 December 2027 |
| Federal, Title VII | No | Statutory disparate impact exposure survives the Guidelines rescission | In force |
What enforcement actually looks like, measured rather than assumed
Enforcement deserves measurement rather than assumption, and the available evidence is unflattering.
The New York State Comptroller audited the city’s enforcement of Local Law 144 across July 2023 to June 2025 and reported in December 2025 that enforcement was ineffective. Three findings carry the story. Seventy-five per cent of test calls to the city’s 311 hotline about automated employment decision tool issues were misrouted and never reached the enforcing department. The department reviewed 32 posted bias audit summaries and identified one compliance issue, while the Comptroller’s review of the same 32 found at least 17 potential issues. The department had not used its own enforcement workbook.
Two conclusions follow, and they point in opposite directions. Historic enforcement has been weak, so a compliance record built on the assumption that nobody checked is probably accurate about the past. The department agreed to implement most of the Comptroller’s recommendations, so the same assumption is a poor guide to the future. Penalties run to 1,500 dollars per violation per day, and a daily multiplier applied to a bias audit summary that was never published is not a small number.
A bias audit that was performed is not the same as a bias audit that was correct. One that passed internal review but showed at least 17 potential issues on inspection is evidence of a defective audit rather than evidence of compliance. Procuring a bias audit and reviewing a bias audit are separate controls, and most programmes only have the first.
What to hold, and for how long
Retention is the quiet obligation, and the periods are not aligned.
Colorado requires compliance records for at least three years after the decision. California requires risk assessments reviewed and updated at least every three years, and updated within 45 calendar days after a material change to the processing. New York City requires the most recent audit summary to stay published, which in practice means the previous year’s evidence has to survive long enough to prove continuity. The EEOC’s general records retention rule at 29 C.F.R. 1602.14 is untouched by the Guidelines rescission, which matters because the temptation to shorten retention alongside a rescission creates a spoliation problem rather than solving a storage one.
Retention is also where multi-jurisdiction programmes quietly fail. The bias audit exists, the notice went out, the risk assessment was written, and none of the three can be produced against a named tool on a named date two years later. govern365.ai exists to hold those artefacts against the system that generated them, with the jurisdiction, the threshold applied and the date of each decision attached, so that a question about one tool in one state does not become a document hunt across three teams. Firms running this across several regimes can see how govern365.ai handles multi-framework evidence rather than reconstructing it per audit.
Two practical sequencing notes close the analysis. Classify by decision type first and jurisdiction second, since decision type eliminates faster. Then record the threshold reasoning for every tool you concluded was outside bias audit scope, because out of scope is a position you will have to defend, and an undocumented one is indistinguishable from an oversight. The pillar guide to bias audit scope and method covers how to run the measurement once a tool is in, and the wider state-by-state tracker carries the regimes outside employment. Where several of these regimes land on the same organisation at once, the consolidated view is what govern365.ai was built for.
Questions teams ask when scoping a bias audit
Does every AI hiring tool need a bias audit?
Bias audit mandates exist in exactly one jurisdiction. New York City requires one, and only for automated employment decision tools used to screen candidates or evaluate employees for promotion within the city. Illinois, California, Colorado and the European Union impose notice, documentation, rights or anti-discrimination duties instead. Conflating the two is the most common and most expensive scoping error in this area.
Who counts as an independent auditor under Local Law 144?
A bias audit is independent only where the auditor had no involvement in using, developing or distributing the tool, and no employment relationship or financial interest that would compromise judgment. An internal team that helped select or configure the tool is not independent for this purpose. Reviewing the auditor’s own independence statement is part of the employer’s duty, not the auditor’s.
Is the four-fifths rule still the federal standard?
Bias audit reports citing the four-fifths rule are about to lose their federal footing. The rule comes from the Uniform Guidelines on Employee Selection Procedures at 29 C.F.R. Part 1607. On 16 October 2026 the EEOC sent a final rule rescinding the interpretive portions of those Guidelines to OIRA, with final action projected for November 2026 and an effective date in January 2027. Statutory disparate impact liability under Title VII is unaffected, and New York City’s impact ratio methodology sits in city rules rather than the federal Guidelines, so the city requirement continues either way.
Did Colorado’s AI Act requirements go away?
Bias audit and impact assessment duties under the original Colorado statute are gone. Senate Bill 26-189, signed on 14 May 2026, repealed and reenacted the earlier statute, removing the duty of reasonable care to prevent algorithmic discrimination, deployer risk management programmes and annual impact assessments. A transparency framework replaces them from 1 January 2027, built on notice, adverse outcome explanations and consumer rights, enforced exclusively by the Attorney General with no private right of action.
What does Illinois actually require right now?
Notice when AI is used in a covered employment decision, a prohibition on using zip codes as a proxy for protected classes, and a prohibition on AI use that discriminates under the Illinois Human Rights Act. The statute took effect on 1 January 2026. The Department of Human Rights postponed its rulemaking on 2 June 2026 with no revised timeline, so no implementing rules are in force, and the statutory duties bind regardless.
Is a California risk assessment the same thing as a bias audit?
A bias audit and a risk assessment answer different questions. A risk assessment under the state privacy rules weighs privacy risks against benefits to the consumer, the business, other stakeholders and the public, and must be reviewed at least every three years and updated within 45 days of a material change to the processing. A bias audit measures disparate impact through selection rates, scoring rates and impact ratios. Different question, different method, different evidence.
When do the EU AI Act employment obligations start?
Employment uses listed in Annex III are high-risk, and the Digital Omnibus moved those obligations to 2 December 2027. Employers with European operations have longer than the original August 2026 date, but the obligations are substantially heavier than any United States equivalent when they arrive.
How should a multi-jurisdiction employer sequence this work?
Inventory tools by the decision type they touch, since decision type eliminates regimes faster than geography. Apply each jurisdiction’s own involvement threshold separately and record the reasoning, including for tools ruled out. Check what authority existing vendor audit reports cite, ahead of the January 2027 federal change. Then align retention to the longest applicable period rather than to each regime separately.
