Staying Legal With AI Resume Screening

AI resume screening is now regulated on both sides of the Atlantic: NYC Local Law 144 requires annual independent bias audits, published results and candidate notice for automated employment decision tools, while the EU AI Act classifies hiring AI as high-risk, bringing transparency, human-oversight, logging and accuracy obligations as its provisions phase in through 2026–2027.

NYC Local Law 144 — the bias-audit law

In force since 2023 and the template other US jurisdictions copy. If an automated employment decision tool substantially assists screening for jobs in New York City, the employer must:

• commission an independent bias audit annually: statistical impact ratios across sex and race/ethnicity categories,
• publish the audit summary on its website,
• notify candidates that an AEDT is in use, before it is used, and disclose the job qualifications and characteristics it assesses.

Note who carries the duty: the employer using the tool. That means every HR-tech vendor's customers will ask for audit-ready data, and vendors who cannot produce it lose the deal.

EU AI Act — hiring is high-risk by name

Annex III lists employment explicitly: systems for recruitment, screening applications, and evaluating candidates are high-risk AI. The obligations that follow (risk management, data governance, technical documentation, logging, transparency to users, human oversight, accuracy and robustness) phase in through 2026–2027, and unlike LL144 they bind providers as well as deployers.

The two design choices that satisfy both

First: score blind. Strip personally identifying information before any model sees the candidate. The SharpAPI match-score pipeline removes name, email, phone, address, birth date, nationality, photo and profile links after parsing, so the scorer evaluates qualifications only. A bias audit of a system that structurally cannot see protected characteristics starts from a defensible place, and the sanitization step itself is documentable evidence.

Second: score in writing. LL144's disclosure duty and the AI Act's transparency duty are both, at bottom, documentation problems. A 20-dimension score with per-dimension explanations gives the recruiter something to tell the candidate, the auditor something to sample, and the regulator something to read. An opaque 0–100 gives none of them anything to work with.

What builders should do this quarter

1. Map your tools against the definitions. “Substantially assists” (LL144) and Annex III's recruitment language are broad; if your product ranks or filters candidates, assume you are in scope.
2. Choose explainable components now. Retrofitting explanations onto an opaque scorer is harder than integrating one that ships them — the audit trail starts at the API response.
3. Log the decisions. Store scores, explanations and the job description version used; the AI Act's logging duty and any discrimination claim both point at the same records.
4. Fold in the GDPR layer. The same pipeline owes Article 22 transparency for automated decisions; the GDPR parsing guide covers that half.

What this means for keyword systems

A keyword matcher cannot explain itself: “the resume lacked the string 'stakeholder management'” is an explanation that embarrasses everyone involved. Regulation is quietly retiring an architecture, and the replacement (semantic, multi-dimensional, explained scoring) happens to also be better at its job.