Where we are, and what this session is not
In a1 you sorted your function's week into drafting and deciding, named one thing you would forbid outright, and drafted the paragraph you will be asked for. You also listed the four things you own personally: the boundary, the audit, the record and the notice. Three of those four are shaped by rules written by someone other than you, which is what tonight is about.
Now the hard honesty framing, and it matters more than anything else on this page. This session hands you a map, not an opinion. It tells you which obligations exist, roughly what they demand, and which questions to route to whom. It does not tell you what is lawful for Kestrel, or for you. And the map changes: one date on it has already moved once, by sixteen months, after the legislation was passed. A course page - this one included - is never a compliance source. Its job is to stop you being surprised.
This is education for HR professionals, not legal advice, and obligations vary by jurisdiction. Every date and threshold here was correct on 31 July 2026. Verify the current position with your own counsel before acting on any of it.
What is live now, and what is arriving 8 min live
Most executive conversations about AI and employment law are about the EU AI Act, which is understandable and slightly the wrong way round. The Act's employment obligations are not yet in force. New York City's are, and have been for years. If your candidates sit in NYC, the thing that can cost you money today is the one nobody in the room has read.
LiveNYC Local Law 144 - the three duties, in plain words4 min▶
Local Law 144 of 2021 covers automated employment decision tools. It has been in effect since 1 January 2023 and enforced by the Department of Consumer and Worker Protection since 5 July 2023. Where such a tool is used on a candidate, three duties attach.
| Duty | What it actually means |
|---|---|
| An independent annual bias audit | Not a vendor self-assessment, and not a one-off at purchase. Independent, and repeated every year. |
| A public summary of the audit results | Published, readable by anyone, including the candidate who did not get the job and the journalist who did. |
| At least 10 business days' notice to candidates | Before the tool is used on them. Two working weeks of lead time, which makes this a process design question and not a footer. |
Penalties start at $500 per violation and rise to $1,500 per day for continuing violations. Three details that catch leaders out:
- The obligation sits on the employer, not only the vendor. "Our supplier handles compliance" is a procurement sentence. It is not a defence, and it is not what the law asks of you.
- Ten business days is not ten days. Build it into the funnel timeline before you promise a hiring manager a shortlist by Friday.
- "Public" means public. If you would not be comfortable with the audit summary being read aloud, that discomfort is information about the tool, not about the rule.
The two-week problem. A talent team discovered their assessment platform counted as an automated employment decision tool for a set of NYC roles. The audit was arrangeable. The public summary was awkward but writeable. The thing that actually broke was the ten business days: their process sent the assessment link within four hours of application, because fast response was the metric the team was measured on. Compliance did not need a new tool. It needed the funnel redesigned, which took longer and involved more arguments than the audit did.
LiveEU AI Act - employment as a named high-risk use4 min▶
Under Annex III point 4, AI used for recruitment or selection - including placing targeted job ads, filtering applications and evaluating candidates - and AI used for performance evaluation, task allocation, monitoring, promotion and termination is classed as high-risk. Note how wide that is: it starts before anyone has applied. A tool choosing who sees your advert is in scope.
The obligations that attach to a high-risk system cover risk management, data governance, technical documentation, record-keeping, transparency, human oversight, and accuracy and robustness. Read as a CHRO rather than as a lawyer, that list says: be able to describe what the system does, on what data, with what checks, keep the evidence, tell people, and make sure a person can genuinely overrule it.
On timing. As of mid-2026, the Digital Omnibus agreement postponed the Annex III high-risk obligations from 2 August 2026 to 2 December 2027. Systems already in use before that date are out of scope unless they are significantly changed in design; public authorities have until 2 August 2030. This has already moved once - check the current position rather than trusting this page.
Self-studyWhy the map is not the whole territory2 min read▶
Two regimes are named on this page because they are the clearest and most cited. They are not the complete set. Other US states and cities have introduced or are considering automated-decision rules in hiring; existing discrimination law applies to AI-assisted decisions in most jurisdictions without needing any new statute; and sector regulators sometimes have views of their own. Nothing here surveys your specific footprint.
The practical version for a CHRO: know which jurisdictions your candidates and employees actually sit in, ask counsel what follows from that list, and re-ask when the footprint changes. Demo 1 builds you the list. Getting the list right is the part you can do; getting the legal conclusion right is the part you route.
The four-fifths rule, worked by hand 7 min live
Under every audit, every impact review and every uncomfortable conversation with a regulator, there is one small piece of division. The EEOC Uniform Guidelines four-fifths rule: take the lower group's selection rate, divide by the higher group's, and if the result is below 0.80 that is evidence of adverse impact. You do not need to compute it yourself. You do need to be un-bluffable about it, because it is the number that will be quoted at you.
| Group | Applicants | Shortlisted | Selection rate | Ratio to highest |
|---|---|---|---|---|
| Group A | 12 | 9 | 9 ÷ 12 = 75% | 75% ÷ 75% = 1.00 |
| Group B | 12 | 3 | 3 ÷ 12 = 25% | 25% ÷ 75% = 0.33 |
| Threshold | 0.80 | |||
0.33 against a threshold of 0.80. That is not a marginal result, and it came from a slate of twenty-four people with twelve shortlist places - a completely ordinary week for one role at Kestrel. Nobody wrote a discriminatory rule to produce it. This exact scenario is what the HR track's b4 simulator puts in front of your recruiters, live, with a shortlist that looks entirely reasonable until the division is done.
LiveWhat the ratio is, and four things it is not4 min▶
What it is: a screening signal. A cheap, standard, widely understood test that says "look here" and starts an investigation.
- It is not a verdict. A ratio below 0.80 does not establish that anything unlawful happened. It establishes that there is a difference in selection rates worth explaining, and that somebody is now entitled to ask you to explain it.
- Passing is not a defence. A ratio of 0.85 does not make a process lawful, fair, or well designed. It means this particular test did not flag. Treating 0.80 as a target rather than a floor is how organisations end up managing to the metric instead of to the process.
- It is volatile on small numbers. On a twelve-place shortlist, one seat can swing the ratio dramatically. That is an argument for computing it on the aggregate of a hiring wave as well as on each slate, not an argument for ignoring it when the numbers are small.
- It is not a substitute for looking at the criteria. The ratio tells you an outcome differs. It cannot tell you why. The why is almost always an undefined criterion doing quiet work - which is a4's whole session.
The number that ended the meeting. A head of talent presented a hiring-wave review and was asked, mildly, what the selection rates were. She did not have them - not because anyone was hiding anything, but because the applicant tracking system reported on offers and time-to-fill, and nobody had ever asked it for rates by stage. It took eleven days to produce the figures. The eleven days were the finding. If you cannot compute the number in an afternoon, you cannot answer the question when it is asked in the room.
Self-studyWhere to run it, and on what2 min read▶
- Run it per stage, not just at offer. Application to screen, screen to interview, interview to offer, offer to accept. A process can look balanced at the end because two stages cancelled each other out, which is not the same as being balanced.
- Run it on the aggregate too. One role is a small sample. A 120-role wave is not, and that is where a pattern becomes visible instead of arguable.
- Decide who sees it before you compute it. This is sensitive data about your own process, and the worst version of this is a number that circulates without anyone owning what happens next. a3 covers who commissions and who receives.
- Do not build the analysis in a chat window with real records in it. Rail 3 from the HR track applies to leaders too: people data is not prompt fodder.
The data layer, and what you must recognise and route 6 min live
Underneath the AI-specific rules sits ordinary data protection law, which was already governing everything your function touches. GDPR in Europe and the Singapore PDPA both govern candidate and employee data: lawful basis, minimisation, retention, and limits on decisions taken without meaningful human involvement. You do not need to be able to argue these. You need to recognise the four shapes and know where to send them, and a5 is the session that goes properly into it.
LiveThe four shapes to recognise and route3 min▶
- Lawful basis. Why are we allowed to hold this at all? In an employment context, "the candidate gave it to us" and "we have consent" are both weaker answers than people assume, because consent from someone who wants a job from you is not freely given in the way the word implies. Route this one, do not improvise it.
- Minimisation. Are we collecting more than the decision needs? Diversity monitoring data, assessment recordings, and anything captured "in case it is useful later" are the usual suspects. The best time to notice is before the wave, not during the subject access request.
- Retention. How long do we keep rejected candidates' records, and does anyone actually delete them? The honest answer in most organisations is "forever, in three systems and a spreadsheet". Note the tension with record-keeping obligations - you need evidence of decisions and you need to not hoard personal data, and reconciling those two is a real conversation, not a contradiction to be ignored.
- Decisions without meaningful human involvement. Both regimes care about this and it maps exactly onto a1's rail: a named person decides, could have decided otherwise, and wrote down why. If your process cannot evidence that, this is not primarily an AI problem.
Self-studyWhere the depth lives1 min read▶
a3 turns the audit and notice duties into vendor contracts and internal governance. a4 goes properly into proxies, the four-fifths arithmetic on real slates, and what explainability means in a hiring context. a5 is the full people-data session: monitoring, employee trust, retention, and the difference between what you may do and what you should. The HR track's b1 sets the never-list your teams work to, and b4 makes the arithmetic visceral. None of them is legal advice either.
Inventory your exposure ★ 12 min · on paper
You cannot map obligations onto a process you have not listed. This takes twelve minutes to draft badly and about a week to finish properly, and the draft is the point - it tells you what you do not know.
List every tool that touches hiring or promotion. Include the ones nobody calls AI: applicant tracking filters, ranking or matching features, assessment platforms, scheduling tools that deprioritise, CV parsers, anything a vendor added in an update. If a hiring manager uses a general chat assistant to compare candidates, that is on the list too.
Beside each, mark whether it substantially assists or replaces a decision about a named individual, or only drafts a document. This is the line that matters, and it is a judgement - write your reasoning down, because it is the reasoning you will be asked for.
List the jurisdictions your candidates and employees actually sit in. Not where your headquarters is - where the people are. Kestrel scaling to 600 across three countries is three sets of rules, not one.
For anything marked "substantially assists", ask which of the three LL144 duties you could evidence today: an independent audit within the last twelve months, a published summary, and ten business days' notice actually reaching candidates. Mark each yes, no, or unknown.
Count the "unknown"s. That count, not the "no"s, is the number to take to a3. A "no" is a gap with an owner. An "unknown" is a gap without one.
Nine tools, not three. An HR director expected the inventory to have three rows: the ATS, the assessment platform, and the sourcing tool. It finished with nine. The additions were a CV parser bundled into the ATS, a "recommended candidates" panel enabled by default, a scheduling tool that quietly ordered slots by an internal score, two chat assistants used unofficially by hiring managers, and a job-advert platform that optimises who is shown the ad - which is squarely inside Annex III's targeted-advertising language. None of it was rogue. All of it was invisible until somebody wrote a list.
Write four questions and send them ★ 10 min · then actually send them
Three questions go to every vendor whose tool you marked "substantially assists". One goes to your own team. All four are deliberately short, because a short question is hard to answer evasively and easy to notice when it is not answered at all.
Send the three vendor questions this quarter, in writing, to every relevant supplier. Written questions and written answers are half the record layer you are trying to build.
Note who answers instantly, who answers with marketing material, and who goes quiet. That distribution tells you more about your risk than any of the answers do.
Send the internal question to your talent operations lead with a date attached, and see how long the answer takes to arrive.
Bring both sets of answers to a3, where they become contract language and a governance model rather than an email thread.
Question two is the one that works. A talent team sent all three. Every vendor answered question one within a day, two attached something. Only one answered question two with actual numbers - and that vendor's numbers included a stage ratio of 0.71 with a written note on what they had changed since. The team's instinct was that this was the worst response. It was the only honest one, and it was the vendor they kept. Question two is not there to catch anybody out. It is there to find out who is measuring.
Before session 3 ◐ 35-45 min total
- Finish the inventory. Every tool, every jurisdiction, every "unknown" counted. Nine rows is a normal answer; three usually means the list is not finished.
- Send the three vendor questions. In writing, with a date you expect an answer by. Track who goes quiet.
- Ask your team for the selection rates on the last five roles, by stage. What you are testing is not the ratios - it is how many days it takes to produce them.
- Take one page of this session to your DPO or counsel and ask a single question: given where our candidates sit, which of these applies to us, and what have I missed? Bring their answer to a3.
- Re-check the two dates on this page yourself. It is a five-minute task and it is the habit the whole session is arguing for.
Official sources covered
Taught from public regulation and standard guidance. The normative text of the AI Act, the full text of Local Law 144, certification content, and any actual legal position stay with their owners. This course is education for HR professionals, not legal advice, and obligations vary by jurisdiction. This session covers:
Three questions before you go 🎯 ◐ 90 seconds
1 · Group A: 12 applicants, 9 shortlisted. Group B: 12 applicants, 3 shortlisted. What is the ratio, and what does it establish?
25% divided by 75% is 0.33, well under 0.80. It is evidence of adverse impact and it means somebody is entitled to ask you to explain the difference. It is not a finding of unlawfulness, and passing the test would not have been a defence either.
2 · A vendor tells you their platform "fully complies with LL144, so you are covered". What is the problem?
A vendor can help you meet the duties. It cannot hold them for you. The notice in particular is yours: it has to reach your candidates, ahead of your process, on your timeline.
3 · What is the accurate statement about the EU AI Act's employment obligations, as taught here?
Postponed, not removed. Systems in use before the date are out of scope unless significantly changed in design, and public authorities have until 2 Aug 2030. As of mid-2026 - and since this has already moved once, check the current position rather than trusting this page.