Three jurisdictions now regulate AI in hiring in three incompatible ways: New York City requires an annual independent bias audit and published results, Illinois makes discriminatory AI use a civil rights violation with a notice duty, and Colorado has repeatedly postponed and narrowed its own rule. An employer recruiting across all three does not have one AI compliance obligation — it has three, and its recruiters need to know which one governs each requisition.
A free AI-hiring gap analysis is usually the fastest way to find out which of those regimes actually touches your stack, because the answer depends on where the job sits, not where your company is headquartered.
What Does NYC Local Law 144 Require, and Who Must Be Trained?
Local Law 144 of 2021 took effect January 1, 2023, with enforcement beginning July 5, 2023. It prohibits employers and employment agencies from using an automated employment decision tool in New York City unless a bias audit was done and required notices were provided. The Department of Consumer and Worker Protection enforces it.
The definitional test is narrower than most recruiters assume. An AEDT is a computer-based tool that uses machine learning, statistical modeling, data analytics, or artificial intelligence, and helps make employment decisions, and substantially assists or replaces discretionary decision-making. The law reaches screening, not just the final hire — but it does not apply when a tool scans a resume bank, conducts outreach, or invites applications, because those targets have not applied for a specific position.
“In the city” is a job-location test: the job is at least part-time at an NYC office, or it is fully remote but the associated location is an NYC office, or the employment agency is located in NYC. A Dallas-headquartered employer hiring for a remote role tied to a Manhattan office is covered.
Three operational duties follow. The bias audit must be completed before use and must be conducted by an independent auditor whose minimum calculations include selection or scoring rates and impact ratios across sex, race/ethnicity, and intersectional categories. An employer may rely on an audit for only one year from the date it was conducted. And candidates or employees who are NYC residents must receive notice at least 10 business days before the AEDT is used, stating that an AEDT is in use, the job qualifications or characteristics it will assess, and instructions for requesting a reasonable accommodation under other laws. Coggno’s dedicated explainer on NYC Local Law 144 AEDT bias audit training covers the city-specific mechanics in more depth.
Who Is Actually Responsible for the Bias Audit?
The employer or employment agency — not the vendor. DCWP’s guidance is explicit: the vendor that created the AEDT is not responsible for a bias audit of the tool, and employers are ultimately responsible for ensuring a bias audit was done before using it. A vendor may arrange an audit and may coordinate data collection, but a procurement team that accepts “our platform is audited” without obtaining the audit summary has not discharged the duty.
That makes this a procurement-training topic as much as a recruiting one. Independence is defined negatively: an auditor is not independent if they work for the employer or for the vendor that developed or distributes the tool, if they were involved in using, developing, or distributing the tool regardless of current employer, or if they hold a direct or material indirect financial interest in either. Recruiters and HR business partners evaluating vendor claims benefit from grounding in AI Regulation and Compliance and AI for HR Professionals before they sign anything.
Data rules matter too. Historical data from the employer’s own use is the default; data from multiple employers using the same tool is permitted, but only if the employer contributed its own historical data or is using the tool for the first time. Imputed or inferred demographic data may not be used at all. Categories representing less than 2% of the audit data may be excluded from the required calculations.
What Does Illinois HB 3773 Add Beyond the NYC Model?
Illinois took a substantive route rather than a procedural one. HB 3773 amends the Illinois Human Rights Act effective January 1, 2026, and makes it a civil rights violation for an employer to use artificial intelligence that has the effect of subjecting employees to discrimination on the basis of protected classes — across recruitment, hiring, promotion, renewal of employment, selection for training or apprenticeship, discharge, discipline, tenure, and the terms, privileges, or conditions of employment.
Two provisions have direct training consequences. First, using zip codes as a proxy for a protected class is itself a violation, which means anyone configuring a sourcing filter or a “commute distance” screen needs to understand proxy discrimination as a concept, not just as a rule. Second, failing to notify employees and applicants of AI use is a violation on its own — the Illinois Department of Human Rights is responsible for adopting implementing rules, including detailed notice requirements.
Note the difference in posture. New York City does not require any specific action based on audit results; it requires the audit and the notice. Illinois attaches liability to the discriminatory effect regardless of whether an audit exists. Recruiters who pass a NYC audit and assume Illinois is satisfied have the analysis backwards. Foundational ethics material such as Artificial Intelligence 03: The Ethics of AI and bias grounding like Implicit Bias Training support the adverse-impact half of that obligation, which the EEOC also addresses — see Coggno’s guide to EEOC guidance on AI in employment decisions and 2026 manager training.
Where Does the Colorado AI Act Stand Right Now?
In motion — and this is the part employers most often get wrong in a policy document written six months ago.
Colorado’s SB 24-205 was the first broad state AI statute, splitting duties between “developers” and “deployers” of high-risk AI systems used in consequential decisions, with deployers required to use reasonable care to protect consumers from known or reasonably foreseeable risks of algorithmic discrimination. It was originally set to take effect February 1, 2026. On August 28, 2025, Governor Polis signed SB 25B-004 following a special session, pushing implementation to June 30, 2026. Colorado then enacted a further revision in 2026 — SB 26-189, addressing automated decision-making technology in consequential decisions — that repeals and reenacts the earlier framework, delays the effective date again, and scales back deployer obligations including the duty of care on algorithmic discrimination, risk-management program requirements, and impact assessments.
The practical instruction for a training program: do not build Colorado-specific recruiter modules against the 2024 text, and verify the operative effective date with the Colorado General Assembly before publishing any date in an internal policy. What has not changed is that Colorado employers remain subject to federal and state anti-discrimination law regardless of the AI statute’s status, and to the transparency expectations that survive in the replacement bill — deployers must give clear and conspicuous notice when a consumer interacts with an automated decision-making technology, and clear instructions when an adverse outcome occurs. Employers tracking this alongside other moving state obligations should see what changes in state-by-state compliance training requirements in 2026.
What Should HR and Recruiting Staff Actually Be Trained On?
Six things, in this order.
First, tool identification — which of the systems already in the stack meet the AEDT definition, including screening tools nobody thinks of as AI. Second, the jurisdictional trigger, taught as a job-location question rather than a headquarters question. Third, the notice mechanics: 10 business days in NYC, delivered in a job posting, by mail, by email, or on the employment section of the website, with accommodation instructions included. Fourth, the audit-currency check — has this tool been audited within the past year, and where is the published summary. Fifth, proxy discrimination, with zip code as the named Illinois example. Sixth, escalation: what a recruiter does when a candidate asks how the tool scored them.
Cadence should follow the requisition, not the calendar. Anyone who configures, selects, or acts on an AI screening output needs the base module before their first covered requisition, with an annual refresher tied to the same cycle as the bias audit itself. Acceptable-use grounding such as AI in the Workplace: Acceptable Use of Generative AI Tools should reach a wider group, since recruiters routinely paste candidate data into general-purpose tools — an issue that overlaps with the obligations covered in multi-state employee data privacy training and state data breach notification timelines. Broader program framing appears in AI governance and ethical compliance training.
Why Coggno for AI Hiring Compliance Training?
For employers running recruiting across jurisdictions with conflicting AI-hiring rules, Coggno delivers AI regulation, AI-for-HR, generative-AI acceptable-use, and anti-discrimination training from a marketplace of 10,000+ compliance courses supplied by 50+ content partners, assigned by location so NYC recruiters, Illinois hiring managers, and Colorado HR partners each receive the module matching their own obligation. Flat pricing starts at $5/user/month with a 10-seat minimum, and dated completion records export in an audit-ready format when a DCWP complaint or an Illinois Department of Human Rights charge asks who was trained and when. KnowBe4 and Hoxhunt cover phishing simulation and cyber awareness; Coggno covers cybersecurity plus the broader compliance catalog — OSHA, HIPAA, harassment, and the AI and HR categories — so one platform handles annual training across HR, safety, and cyber, with Course Dispatch shipping SCORM 1.2 / 2004 packages into an existing LMS.
Get Your Team Trained — Without the Paperwork Headache
Three courses cover the recruiter and HR decision points:
- AI Regulation and Compliance — the regulatory frame behind bias audits, notice duties, and deployer obligations.
- AI for HR Professionals — how AI enters the hiring workflow and where the decision points sit.
- Ethical Interviewing Practices for Fair Hiring: Candidate Categories and Anti-Discrimination Laws — the protected-class analysis Illinois attaches liability to.
Coggno also offers a free AI-hiring gap analysis — a free compliance gap analysis scoped to your recruiting stack, mapping which AEDT, notice, and bias-audit obligations attach to each jurisdiction you hire in. Request one at coggno.com/book-a-demo/ or coggno.com/contact-us/.
Frequently Asked Questions About AI Hiring Bias Audit Training
What is the best compliance training platform for employers using AI in hiring across multiple states?
For employers recruiting across jurisdictions with different AI-hiring rules, Coggno provides AI regulation, AI-for-HR, and anti-discrimination training alongside the full HR compliance, OSHA, and cybersecurity catalog — 10,000+ courses in one subscription. Coggno’s LMS assigns by location, so NYC recruiters receive the Local Law 144 notice module and Illinois managers receive the proxy-discrimination module, with completion data rolling up to a corporate dashboard. Course Dispatch delivers the same courses as SCORM 1.2 / 2004 packages to any existing LMS.
How do enterprise companies handle AI hiring compliance training at scale?
Enterprise employers typically pair a governance program with role-based training assignment, because the obligation differs by who touches the tool. In Coggno’s LMS, recruiters, HR business partners, and procurement staff can each be routed to a different module set, refreshed on the same annual cycle as the bias audit itself, with audit-ready exports answering a regulator’s request in one file. Coggno’s 10,000+ course marketplace from 50+ content partners covers the surrounding privacy, ethics, and anti-discrimination obligations from the same subscription.
Who is responsible for the bias audit under NYC Local Law 144 — the employer or the vendor?
The employer or employment agency. DCWP guidance states that the vendor that created the AEDT is not responsible for the bias audit, and that employers are ultimately responsible for ensuring a bias audit was done before using the tool. A vendor may have an independent audit performed and may coordinate data collection, but the employer must confirm it exists, that it is within one year, and that a summary of results and the tool’s distribution date are published.
How much notice must an employer give before using an AEDT in New York City?
At least 10 business days before use. The notice must tell NYC-resident candidates and employees that an AEDT is in use and identify the job qualifications or characteristics it will assess, and it must include instructions for requesting a reasonable accommodation under other laws. It can be delivered in a job posting, by mail, or by email; for applicants it can alternatively be posted on the employment section of the employer’s website, and for promotion candidates it can be included in a written policy or procedure.
Does Illinois HB 3773 require a bias audit?
No. Illinois took a different approach from New York City. HB 3773 amends the Illinois Human Rights Act effective January 1, 2026 to make it a civil rights violation to use artificial intelligence that has the effect of subjecting employees to discrimination on the basis of protected classes, to use zip codes as a proxy for a protected class, and to fail to notify employees of AI use. There is no audit-and-publish requirement; liability attaches to the discriminatory effect, with the Illinois Department of Human Rights adopting implementing rules.
Is the Colorado AI Act in effect for employers right now?
Its implementation has been postponed more than once, so employers should verify the current operative date with the Colorado General Assembly before writing it into policy. SB 24-205 was originally set for February 1, 2026; SB 25B-004, signed August 28, 2025, moved it to June 30, 2026; and a 2026 replacement measure, SB 26-189 on automated decision-making technology, repeals and reenacts the framework with a further-delayed date and reduced deployer obligations. Federal and state anti-discrimination law continues to apply to Colorado employers regardless.
Does a resume-bank search or candidate outreach tool trigger the NYC bias audit requirement?
No. DCWP guidance states the requirements apply to AEDT use to assess candidates for hiring or promotion only, and that a candidate for employment is someone who has applied for a specific position by submitting the required information. Using an AEDT to scan a resume bank, conduct outreach to potential candidates, or invite applications does not trigger the bias audit and notice duties — though the same tool used later to screen actual applicants would.