White-Label AI Recruitment CRM (ATS + Sourcing)

NYC Local Law 144 (AEDT — Automated Employment Decision Tool) is the most operationally immediate compliance requirement for any AI recruitment platform serving NYC candidates or employers with NYC employees. It requires: (1) an independent bias audit conducted within the prior year by a qualified auditor; (2) a summary of the audit published on the employer's website; (3) candidate notice at least 10 business days before the tool is used; and (4) an accommodation process for candidates who request alternative evaluation. Penalty: approximately $500/violation/day; no DOC/DCWP enforcement grace period as of June 2026.

Mitigation: Engage an approved NYC AEDT bias auditor before serving any NYC candidate or employer. The audit must cover both the selection rate disparity analysis (4/5ths rule) and the scoring-based analysis. Display the required candidate notice on every job application page. Budget $15K–$30K/yr for the annual audit retainer.

Mobley v. Workday (NDCA) was certified May 2025 as a nationwide collective action alleging Workday's AI applicant-screening tool discriminated by race, age, and disability. EEOC guidance (May 2023) confirms that algorithmic screening tools impute liability to the employer even when built by a third-party vendor. A white-label ATS faces the same theory as the labeled vendor — the reseller cannot disclaim Title VII liability to the end employer, and the end employer cannot disclaim liability to a vendor.

Mitigation: The architectural defense is a documented, unbypassable human-review gate before any candidate is shortlisted. Store the diff between AI recommendation and human decision for every candidate action. Fairlearn quarterly audits provide the ongoing monitoring evidence. Retain an independent bias-audit specialist for annual review.

EU AI Act Annex III explicitly lists 'recruitment or selection of natural persons, notably for advertising vacancies, screening or filtering applications, evaluating candidates' as high-risk AI. Full obligations apply August 2, 2026: risk management system, data governance, technical documentation, automatic event logging, transparency obligations to candidates, human oversight requirements, accuracy standards, and conformity assessment. No EU deployment is legal without completing the conformity assessment.

Mitigation: Budget 10–14 weeks and $40K–$80K for Annex III compliance preparation before EU launch. Key implementation requirements: automatic logging of every AI inference with inputs, outputs, and model version; DPIA for EU candidate data processing; transparency notice to EU candidates explaining AI use; human-override pathway; and a conformity assessment filing.

Illinois HB 3773 requires employers using AI in employment decisions affecting Illinois employees or candidates to: (1) disclose the use of AI; (2) not use AI to discriminate based on protected characteristics; and (3) comply with posting and notice requirements. The law applies to any AI system used to screen, score, or evaluate candidates in Illinois.

Mitigation: Display an AI use disclosure on every job application page for Illinois-located jobs. Include in the application acknowledgment: 'This employer uses AI assistance to analyze applications. AI outputs are reviewed by a human recruiter before any hiring decision is made. You may request an alternative evaluation method by contacting [HR contact].' Log disclosure delivery per candidate.

Colorado SB 24-205 imposes a 'reasonable care' duty on developers and deployers of 'high-risk AI systems' used for 'consequential employment decisions' — explicitly including hiring. Reasonable care includes: conducting impact assessments, monitoring for discrimination, providing notice to consumers, and disclosing AI use. Failure is an unfair trade practice under CPA.

Mitigation: Document the 'reasonable care' measures: Fairlearn audit methodology, training data provenance, human-review gate design, impact assessment results. Provide employer-customers with a risk summary document per SB 24-205's disclosure requirements before they use the platform for Colorado candidates.

GDPR Art. 22 prohibits solely automated decisions with significant legal effects on EU individuals. Candidate shortlisting decisions that exclude candidates from interview consideration likely qualify. Standard Contractual Clauses (SCCs) are required for any EU candidate data transferred to US-based infrastructure (Schrems II framework).

Mitigation: Use Azure OpenAI EU endpoints for all EU candidate data processing. Implement SCCs in your customer DPA before processing EU candidate data. Build a candidate request process for Art. 22 — EU candidates must be able to request human review of any automated screening decision. Log all human-review responses.