For a few years the pitch for AI in hiring was simple: it is faster. Point it at the pile, get a ranked list, move on. That pitch is running into a new question, and it is not coming from candidates. It is coming from regulators, and increasingly from your own legal team.
The question is no longer just how fast your screening is. It is whether you can defend it. If a rejected candidate, an auditor, or a court asks why one person was screened out and another was not, "the model scored them lower" is not an answer that holds up.
The rules already arrived
This is not a someday problem. Two of the biggest hiring markets in the world already regulate automated hiring, and more are following.
New York City: bias audits, since 2023
NYC Local Law 144 has been in force since July 2023. If you use an automated employment decision tool to screen or rank candidates, you must commission an independent bias audit of it every year, publish a summary of the results, and tell candidates the tool is being used [1]. A state review in late 2025 found enforcement has been weak so far, but the obligations, and the penalties for ignoring them, are on the books [2].
The EU: high-risk, from August 2026
The EU AI Act classifies AI used to recruit, screen, and evaluate candidates as high risk. From 2 August 2026, those systems are expected to meet a serious set of obligations: documented risk management, data governance, human oversight, transparency to candidates, and logs kept for at least six months [3]. One honest caveat: a proposed EU package may push the high-risk deadline later, so treat the date as firm intent rather than a certainty, and the direction as settled either way.
What defensible actually means
Strip away the legal language and the different rules ask for roughly the same things. A hiring decision you can defend is one where you can show:
- The criteria were set in advance. You decided what the role needs before you judged anyone, so the bar did not move to fit a preferred candidate.
- Everyone was measured the same way. The same questions, the same rubric, the same standard, applied consistently.
- There is evidence behind each decision. Not just a score, but the reasoning and the specific facts that produced it.
- A human stayed accountable. The tool supports the decision; a person owns it and can override it.
- There is a record. The whole thing is logged, so any decision can be reviewed and explained later.
“I mapped the root cause to a slow query, added an index, and cut the page load from nine seconds to under one.”
The black box is the liability
Now look at the common way AI gets used in hiring. You point a model at a pile of applications, ask it to score them for a role, and act on the ranking. It is fast, and it is exactly what these rules are built to catch.
You cannot audit "it scored 72" for adverse impact, because you do not know what drove it. You cannot explain a rejection to a candidate, because there is no reasoning to show. And you cannot keep a meaningful record, because there is nothing underneath the number. Speed bought you a faster decision and a bigger liability at the same time.
Structured, evidence-based scoring is the defensible kind
The fix is the same idea that makes hiring fairer in the first place: structure. When you score every candidate against the same criteria you defined up front, and the system shows the reasoning and the exact evidence behind each score, you produce the record these rules ask for as a byproduct. Reading every candidate against one consistent rubric is also what reduces bias rather than hiding it, which is the thing an audit is actually checking for [4].
We have made this case for the two places it matters most: giving every applicant the same structured interview, and applying the same discipline to the resume. Defensibility is not a separate compliance feature bolted on top. It is what structured, evidence-based screening produces on its own.
And it stays defensible because the human stays in charge. You define the criteria and the rubric. Sage scores against them and lays out the evidence, the reasoning, and the exact quotes behind every score. Then you decide. Sage does not invent its own standards and does not choose who gets hired. It gives a recruiter everything needed to make the call, and to defend it.
The point
Defensible hiring is not a tax on speed. A structured, evidence-backed process is faster than reading every application by hand, fairer than a gut call, and it happens to produce exactly the documented, auditable record regulators are now asking for. The teams that treated explainability as a nice-to-have are the ones scrambling. The ones who built on structure already have the answer.
Hiring you can actually defend
Sage scores every candidate against the criteria you define and lays out the evidence behind every score, then you make the call. You get the audit trail and human oversight these rules ask for. Book a demo and start a free trial.
Book a demoReferences
- 1.NYC Department of Consumer and Worker Protection (2023). Automated Employment Decision Tools (Local Law 144): frequently asked questions. City of New York. Link
- 2.DLA Piper (2026). Critical audit of NYC AI hiring law signals increased risk for employers. DLA Piper. Link
- 3.EU Artificial Intelligence Act (2024). What the Act means for staffing and recruitment (high-risk AI systems). artificialintelligenceact.eu. Link
- 4.Kuncel, N. R., Klieger, D. M., Connelly, B. S., & Ones, D. S. (2013). Mechanical versus clinical data combination in selection and admissions decisions: A meta-analysis. Journal of Applied Psychology. Link
Frequently asked questions
What is NYC Local Law 144?
It is a New York City law, in force since July 2023, that governs automated employment decision tools. If you use one to screen or rank candidates, you must have it independently audited for bias every year, publish a summary of the results, and notify candidates that it is in use. It is one of the first laws to regulate AI hiring directly.
Does the EU AI Act apply to recruitment?
Yes. The EU AI Act classifies AI used for recruitment, candidate screening, and employee evaluation as high risk. From August 2026, those systems are expected to meet obligations including risk management, human oversight, transparency, and record keeping, though a proposed EU package may shift the exact deadline. The high-risk classification itself is settled.
What makes an AI hiring decision defensible?
Five things: the criteria were set before anyone was judged, every candidate was measured the same way, there is evidence and reasoning behind each decision rather than just a score, a human stayed accountable for the outcome, and the whole thing was logged so it can be reviewed later. A bare score from a black box fails all five.
Is using AI to screen candidates legal?
In most places, yes, but increasingly with conditions. Jurisdictions like New York City require bias audits and candidate notice, and the EU treats hiring AI as high risk with its own obligations. The trend is not toward banning it but toward requiring that it be transparent, audited, and defensible. This is general information, not legal advice.
How do you make AI hiring compliant?
Use it in a structured, transparent way. Score every candidate against the same criteria defined in advance, make the system show the reasoning and evidence behind each score, keep a human accountable for decisions, and retain the record. That produces the audit trail and explainability these rules require, instead of a number you cannot defend.
Muhammad writes about hiring, the evidence behind better decisions, and building AirbaseHQ.
LinkedInThis article is for general information only and is not legal, financial, or professional advice. Laws and regulations vary by location and change over time, and statistics and research are drawn from third-party sources that may be updated or revised. For decisions that affect your organization, check the specifics with a qualified professional.