Build a White-Label AI Talent Management System (TMS)

NYC Local Law 144 (in force July 5, 2023; enforced by DCWP) defines an 'Automated Employment Decision Tool' as any computational process that substantially assists or replaces discretionary decision-making for employment decisions — including promotion. A TMS that generates succession candidates or promotion-readiness scores is an AEDT. Obligations: (1) independent bias audit by a qualified auditor at least annually before use; (2) public publication of audit results on the employer's website or in a public notice; (3) advance written notice to affected candidates or employees that an AEDT is being used. Violations: $500 per day per violation while the tool is in use without a compliant audit.

Mitigation: Commission an independent bias audit from Holistic AI, Fairly AI, or BABL AI before any production deployment in NYC. Budget $15,000–$30,000 per audit per customer. Build the candidate/employee notice workflow into the platform as a non-optional step before the TMS generates any output for that individual. Build a mechanism for employers to publish their audit results (a public-facing compliance page in the platform). Do not rely on your internal Fairlearn monitoring as a substitute for the independent audit.

The EU AI Act explicitly lists AI systems used for 'making decisions or assisting in making decisions on promotion, termination of work relationships, allocation of tasks regulated by law or collective agreements, and monitoring and evaluation of performance and behavior of persons in such relationships' in Annex III as high-risk. All obligations apply August 2, 2026. High-risk system obligations include: a documented risk management system throughout the lifecycle, data governance and data-quality policies, technical documentation, record-keeping (logs of system inputs and outputs), transparency and user information provisions, human oversight mechanisms, accuracy and robustness requirements, and a conformity assessment. The conformity assessment is the most burdensome: for Annex III systems where the developer is not the deployer, either the developer performs a self-assessment against harmonized standards or a notified body performs a third-party conformity assessment.

Mitigation: Engage a EU AI Act compliance consultant before any EU deployment. The conformity assessment + documentation effort is a 6–12 month project for a well-resourced team. Build human oversight as a non-negotiable architectural constraint: every TMS output that could influence an employment decision must have a documented human-review path. Maintain complete audit logs in AWS Bedrock CloudTrail — each log entry must include the inputs, outputs, model version, timestamp, and human-review outcome.

Colorado's Artificial Intelligence Act (effective February 1, 2026) imposes a 'reasonable care' duty on deployers of high-risk AI that makes or substantially contributes to consequential decisions. Promotion, succession, and pay decisions are explicitly consequential under the Act. The duty includes: conducting impact assessments before deployment, notifying affected employees that AI is being used, providing a process for employees to appeal or correct AI-driven decisions, and taking reasonable steps to protect against algorithmic discrimination.

Mitigation: Build an employee-facing appeal mechanism into the platform: an employee who believes an AI-generated succession or promotion-readiness output is incorrect or discriminatory must be able to flag it, trigger a human review, and receive a written explanation. Log all appeals and outcomes. Conduct impact assessments before each new deployment and on material system changes. Include Colorado SB 24-205 compliance documentation in your enterprise client contracts.

The EEOC's May 2023 guidance confirms that Title VII applies to algorithmic employment decisions even when the algorithm is vendor-built — the employer retains liability. Mobley v. Workday (NDCA, 3:23-cv-01940) was certified as a nationwide collective action in May 2025 on claims that Workday's AI applicant-screening tool discriminated against Black, disabled, and older job applicants. The theory that survives class certification is that AI-powered screening or scoring tools produce disparate impact on protected classes. A TMS that generates succession candidates or promotion-readiness scores uses the same architecture and faces the same theory.

Mitigation: Never use the LLM as the primary scoring engine for promotion-readiness — only as an explanation layer over a deterministic skills-match score. Run monthly Fairlearn disparate-impact analysis on all TMS outputs. Commission annual independent bias audits. Build architectural documentation that clearly distinguishes the deterministic skills-matching layer (auditable) from the LLM explanation layer (advisory only). Include these architecture diagrams in your enterprise client contracts and make clear the employer retains ultimate decision authority.

Illinois HB 3773 (effective January 1, 2026) requires employers to disclose when AI is used in employment decisions and prohibits AI from discriminating in employment on the basis of protected characteristics. GDPR Art. 22 provides EU individuals the right not to be subject to solely automated decisions with legal or significant effects — requiring a human review path for any EU employee whose career is materially affected by TMS outputs.

Mitigation: For Illinois employees: build a pre-use disclosure flow that informs the employee AI is being used in succession and internal-mobility processes and provides a process to contest the output. For EU employees: ensure no TMS output is applied to an employee record without an explicit human-approval step that constitutes meaningful (not rubber-stamp) review. Log both the AI output and the human decision with rationale — the log must be producible in a GDPR Subject Access Request.