On this page▾
- A note before we start
- Why hiring AI is treated as high-risk
- Disparate treatment versus adverse impact
- The four-fifths rule as a starting signal
- What the EEOC has signaled
- NYC Local Law 144 and the rise of bias audits
- The EU AI Act and high-risk classification
- Practical guardrails you can implement now
- How we think about it, and what it means for you
I am a founder, not a lawyer, and nothing here is legal advice. Your obligations depend on where you operate, where your candidates sit, the specifics of your tools, and counsel who knows your situation. What I can offer is a practical map of the landscape, drawn from building hiring software and watching the rules evolve, so that you walk into a conversation with your legal team asking sharper questions. The goal of this piece is to make you a more informed buyer and operator, not to substitute for professional advice.
Treat AI in hiring the way you would treat any high-stakes automated decision system: with documentation, testing, human oversight, and a healthy respect for the fact that the technology can encode discrimination as efficiently as it encodes anything else. The companies that get this wrong are usually not malicious. They are the ones who deployed a tool without understanding what it was optimizing for.
Hiring decisions change lives, and the law has long recognized that. Employment is one of the most heavily regulated decision domains we have, because access to work shapes everything downstream. When you automate part of that decision, you do not escape the existing body of anti-discrimination law. You inherit it, and you add new layers of scrutiny specific to automated systems.
The core worry is simple to state and hard to solve. An AI system learns patterns from data. If the data reflects historical bias, and almost all hiring data does, the system can learn to reproduce that bias at scale and at speed, while wrapping it in a veneer of objectivity that makes it harder to challenge. A human screener who is biased affects the candidates they personally see. A biased model affects every candidate, consistently, invisibly. That scale is exactly why regulators treat hiring AI as a high-risk category rather than a neutral productivity tool.
To reason about bias you need two concepts that often get blurred. Disparate treatment is intentional discrimination, treating someone differently because of a protected characteristic. Almost nobody builds a hiring tool that does this on purpose, and it is the easier case to avoid. The harder and more common problem is adverse impact, sometimes called disparate impact: a practice that is neutral on its face but falls more harshly on a protected group.
AI hiring tools create adverse impact risk constantly, usually without anyone intending it. A model trained to find candidates resembling your current high performers will tend to reproduce whatever demographic skew your current team has. A screen that rewards continuous employment history can disadvantage people who took caregiving leave. A tool that scores communication style can penalize non-native speakers or neurodivergent candidates. None of these is intentional, and all of them can produce illegal outcomes. The legal question is rarely whether you meant to discriminate. It is whether your process produced a discriminatory result and whether you can justify the practice as job-related and consistent with business necessity.
In the United States, the most commonly referenced yardstick for adverse impact is the four-fifths rule, also called the eighty percent rule, which comes from the Uniform Guidelines on Employee Selection Procedures. The idea: if the selection rate for any group is less than four-fifths of the rate for the group with the highest selection rate, that is generally treated as evidence of adverse impact worth investigating.
A concrete example. If your tool advances forty percent of one group's candidates but only twenty-five percent of another's, the ratio is 0.625, well under the 0.8 threshold, and that is a flag. It is important to understand what the four-fifths rule is and is not. It is a rough screening heuristic, not a safe harbor and not a legal definition of discrimination. Passing it does not make a practice lawful, and failing it does not automatically make a practice illegal, especially with small sample sizes where the ratio is statistically noisy. Courts and the EEOC look at the full picture, including statistical significance and business justification. Treat the four-fifths check as an early-warning system you run continuously, not as a box you tick once.
The Equal Employment Opportunity Commission has been clear on one foundational point: existing anti-discrimination law, including Title VII and the Americans with Disabilities Act, applies fully to AI and algorithmic decision tools. There is no carve-out because a computer made the recommendation. The Commission has issued guidance on the use of software, algorithms, and AI in employment selection, and a recurring theme is employer responsibility. If you use a vendor's tool and it produces discriminatory outcomes, you can be on the hook. You generally cannot outsource your liability to the software company.
The Commission has also flagged disability-specific concerns. An AI tool can screen out candidates with disabilities even when they could perform the job, for example a timed assessment that disadvantages someone with a motor impairment, or a video analysis tool that misreads a speech difference. Employers are expected to provide reasonable accommodations and to consider whether their tools create barriers. Note that enforcement priorities and published guidance shift with administrations and over time, so the durable takeaway is not any single document but the underlying principle: the law follows the decision, not the technology, and the employer owns the outcome.
New York City was an early mover with Local Law 144, which regulates what it calls automated employment decision tools. The law's central requirement is worth understanding even if you do not operate in NYC, because it points to where the broader trend is heading. If you use a covered automated tool to substantially assist or replace a hiring or promotion decision for a role in the city, you generally must have the tool subjected to an independent bias audit within the prior year, publish a summary of the audit results, and provide notice to candidates that an automated tool is being used.
The bias audit itself centers on calculating selection or scoring rates across sex and race or ethnicity categories and computing impact ratios, the same adverse-impact logic discussed above, performed by an independent auditor. The law has been criticized for its narrow definitions and uneven enforcement, but the direction of travel is unmistakable: independent auditing, public transparency, and candidate notice are becoming baseline expectations. Other jurisdictions, including states and countries, are moving toward similar regimes. If you build the muscle of auditing your tools and disclosing their use now, you will be ahead of the regulation rather than scrambling behind it.
The European Union took the most comprehensive approach with the EU AI Act, a risk-tiered framework that explicitly classifies AI systems used in employment, worker management, and access to self-employment as high-risk. This includes AI used to recruit or select people, to filter applications, and to evaluate candidates. High-risk is a meaningful legal category, not a label, and it carries substantial obligations that phase in over time.
For high-risk systems, the Act contemplates requirements such as risk management processes, high-quality and governed training data to reduce bias, technical documentation and record-keeping, transparency to users, meaningful human oversight, and appropriate accuracy and robustness. Obligations fall on both providers, the companies that build the systems, and deployers, the companies that use them, with different responsibilities for each. Critically, the Act has extraterritorial reach: if your hiring AI affects people located in the EU, it can apply to you even if your company sits elsewhere. For a growing company hiring across borders, this is not a someday problem. It is a factor in which tools you adopt and how you document their use today.
You do not need a compliance department to behave responsibly, and most of what regulators want is what a thoughtful operator would do anyway. A few concrete practices. First, keep a human meaningfully in the loop on consequential decisions, especially rejections. AI should triage and surface, not silently reject at scale with no human accountable. Second, write down the job-related criteria your tools screen for, in plain language, before you turn anything on. If you cannot articulate why a signal predicts job performance, do not screen on it.
Third, test for adverse impact continuously, not once. Run the four-fifths-style check on your actual outcomes by group where you lawfully can, and investigate flags rather than explaining them away. Fourth, demand documentation from your vendors: ask what data the model was trained on, whether it has been audited, how it handles accommodations, and what they will sign up to contractually. A vendor who cannot answer these is a risk you are absorbing. Fifth, maintain an accommodations path so candidates can request an alternative to an automated step. And sixth, keep records. If you are ever questioned, contemporaneous documentation of your criteria, your testing, and your decisions is your strongest defense.
When we built the AI agent inside VScout, the governing principle was that the agent assists and surfaces rather than silently decides, and that every action it takes is logged and attributable. A human stays accountable for consequential calls, and the reasoning behind a recommendation is visible rather than a black box. I share that not to pitch but because it reflects what I think the responsible posture looks like regardless of vendor: auditable, human-supervised, and honest about what the system is optimizing for.
The honest bottom line is that AI in hiring is genuinely useful and genuinely risky, and the regulatory landscape is converging on a consistent message across the EEOC, NYC, and the EU. Document your criteria, test for impact, keep humans accountable, demand transparency from vendors, and disclose your use of automation. Do those things and AI becomes a tool that makes hiring faster and arguably fairer than the inconsistent human-only process it replaces. Skip them and you have built a discrimination machine that operates at scale with a paper trail pointing back at you. The technology is not the risk. The absence of governance around it is. Talk to real counsel about your specific situation, and treat this piece as the briefing that helps you ask them better questions.