The Rules Guarding Against Bad AI Hiring Are Getting Weaker Right When Adoption Is Accelerating

Three separate developments landed within a few months of each other in 2026, and taken together they describe a specific kind of risk that most "AI in hiring" coverage misses. It isn't that AI hiring tools are spreading — that part is old news. It's that the two mechanisms that were supposed to catch a bad one are both getting weaker at exactly the moment adoption is accelerating, and the risk that creates isn't going away. It's moving somewhere less predictable: private litigation.

The audit law got audited, and it didn't do well

New York City's Local Law 144 was the first U.S. law requiring employers to run an independent bias audit before using an "automated employment decision tool" to screen candidates, and to publish a summary of the results. It's been in force since July 2023. On December 2, 2025, the New York State Comptroller's office released an audit of how well the city's Department of Consumer and Worker Protection (DCWP) has actually enforced it, covering July 2023 through June 2025 (NYS Comptroller, Report 2024-N-6).

The findings were blunt. DCWP had identified zero violations in two years. Auditors found the agency's complaint-driven enforcement model routed complaints poorly — in a sample of calls to the city's 311 hotline about automated hiring tools, 75% were never properly directed to DCWP at all. A law firm summary of the audit called the resulting enforcement regime "ineffective," citing weak complaint handling and inaccurate compliance reviews, and noted the agency agreed to adopt most of the auditors' recommendations after initially disputing some of the findings (DLA Piper). DCWP can fine a noncompliant employer $500 to $1,500 per day. In practice, almost no one has paid it.

So the first law of its kind in the country — the one most other jurisdictions pointed to as a model — spent two years not catching anything, by its own regulator's account.

Colorado went further: it pulled the law back before it even started

Colorado took a different and more direct path. Its 2024 AI Act (SB 24-205) would have required companies deploying "high-risk" AI systems, including hiring tools, to run impact assessments, maintain a risk-management program, and exercise "reasonable care" to prevent algorithmic discrimination. It was due to take effect in 2026. It never got the chance: a federal magistrate stayed enforcement in April 2026 after xAI sued and the Department of Justice intervened on constitutional grounds. Rather than fight that out, the Colorado legislature repealed the 2024 Act outright and replaced it with SB 26-189, signed by Governor Polis on May 14, 2026, effective January 1, 2027 (JD Supra).

The replacement is narrower by design. Multiple law firms tracking the bill agree it drops the three heaviest obligations of the original law — the risk-management program, the impact assessments, and the duty of "reasonable care" to prevent algorithmic discrimination — in favor of a notice-based model: tell people when they're interacting with the system, tell them within 30 days if it produced an adverse decision about them, and give them a path to correct their data or request human review (Ropes & Gray). What it does add is one real tooth: any contract clause that tries to shift liability for an employer's own discriminatory use of the tool onto someone else is now void.

Put those two stories side by side. The flagship audit-based law isn't catching violations. The flagship assessment-based law got rewritten into a disclosure law before it ever took effect. Neither of those facts means AI hiring tools got safer in 2026. They mean the compliance floor that was supposed to force safety got lower, in two different states, by two different routes, in the same year adoption kept climbing — SHRM's 2026 State of AI in HR research puts recruiting as the single most common AI use case inside HR departments today, ahead of HR technology, learning and development, or employee experience, according to multiple outlets citing the report directly (RecruiterFlow).

The gap is being filled by courts, not regulators

None of this means the legal exposure disappeared. It moved. Mobley v. Workday is the clearest example. Filed in 2023, the suit alleges Workday's AI-driven applicant-screening tools produced discriminatory outcomes against Black, older, and disabled applicants across Workday's customer base — not one employer's hiring process, but the vendor's product itself. In 2024 and 2025, a federal judge allowed the case to proceed on a theory that had never really been tested at scale: that a vendor whose software screens out or advances candidates on an employer's behalf is acting as that employer's agent, which can bring the vendor within the definition of "employer" under Title VII, the ADEA, and the ADA — even though Workday never signs an offer letter or sits in an interview (Akin Gump). By mid-2025, the court had conditionally certified a nationwide collective of rejected applicants over 40; Workday has disclosed in filings that its tools processed roughly 1.1 billion applications in the relevant period, which gives a sense of the scale a single vendor-liability theory can reach (Maynard Nexsen). A June 2026 ruling reportedly let state civil-rights claims proceed against Workday even for applicants outside California, on the reasoning that the tool itself was built and maintained there — commentary on the order, not the order itself, so treat the geographic reach as reported rather than settled.

That case is still pending; there's no final verdict on liability. But it's already done something a bias-audit law never did: it put every vendor whose AI screens, scores, or ranks candidates on notice that "we just built the tool, the employer made the decision" is a contested legal position, not a safe harbor. Two smaller cases point the same direction. The EEOC's August 2023 consent decree with iTutorGroup — its first-ever AI hiring discrimination settlement — required a $365,000 payment after the agency found the company's screening software auto-rejected female applicants over 55 and male applicants over 60, demonstrated by a test case where an identical application was rejected with one birth date and accepted with a younger one the next day (Bloomberg Law). And in March 2025, a deaf Indigenous Intuit employee filed a complaint with the EEOC and Colorado's Civil Rights Division alleging that a HireVue-platform video interview for a promotion denied her requested human captioning and relied on automated captioning that misreads accented and non-white speech patterns — a Title VII claim built on the accessibility and accuracy of the underlying speech model, not a scoring algorithm. Both companies dispute the allegations; HireVue's CEO called the complaint "entirely without merit" and said Intuit hadn't used a HireVue AI-based assessment for that interview (HR Dive). Neither case is a vendor-liability theory like Mobley — they're ordinary discrimination claims that happen to run through an AI-mediated hiring step — but both show the same thing: enforcement is happening, it's just not coming from the agencies that wrote AI-specific hiring rules.

What recruiters actually say they want is not what "human review" usually means

Here's the part that should reassure hiring teams less than it sounds like it should. Surveys of recruiters and hiring managers in 2026 consistently find that most of them already want a human to hold final authority over AI-assisted hiring decisions, not full autonomy for the tool — one industry survey put the figure north of three-quarters of hiring teams saying final decisions should stay firmly in human hands. That instinct is correct, and most vendors already ship a "human review" screen. The problem is what that screen typically contains: a score, maybe a recommendation label, and a button. It rarely shows the reviewer what the AI actually evaluated, in enough detail that a human could meaningfully disagree with it rather than just ratify it.

A human who can see the record versus a human who sees a number and clicks "approve" is exactly what a court or an auditor will ask about if a rejected candidate ever challenges the outcome. A rubber stamp is not a safeguard; it's a signature on someone else's decision.

Where this leaves a hiring team today

Given all of the above, the practical takeaway for anyone running hiring through AI tools in 2026 isn't "wait for the law to tell you what's required," because the law is visibly in flux in both directions at once — tightening through litigation, loosening through legislative rewrites and weak enforcement, sometimes in the same state in the same year. The more durable approach is to build the process so it would hold up regardless of which regime eventually applies: distinct, inspectable stages instead of one AI call dressed up as a decision, and a default that routes uncertain cases to a person rather than auto-rejecting them.

That's also, as it happens, how NiceHire's own hiring pipeline is built, and we can say so with the same specificity we're asking everyone else in this piece to bring to their own claims: a candidate advances through separate stages — resume vetting, an AI screening interview, live human interviews — each gated independently rather than resolved in a single pass/fail AI judgment, and below the passing threshold on a stage, the default behavior routes a candidate to a human for pending review rather than auto-rejecting them; auto-reject exists as an opt-in setting an organization can turn on per stage, not the default a team has to notice and turn off. We also build every shipped AI screening greeting to disclose, in the candidate's own language, that they're talking to an AI, rather than letting a friendlier custom greeting quietly drop that disclosure. None of that is a claim that we hold an independent bias certification under any specific law, and we're not making one — "visible and inspectable" is a design choice we control directly; "audited and certified" is a claim only an independent auditor gets to make, and we'd rather say less than we can prove than more.

The honest summary of 2026 so far is this: the agencies and legislatures that were supposed to draw the line on acceptable AI hiring practice have, in two high-profile jurisdictions this year, drawn it fainter than before. That didn't make candidates less exposed to a badly built or badly audited AI hiring tool. It just means the protection they get is coming from somewhere other than the places everyone was watching.