7 Steps to Prepare for AI Compliance in Hiring and Employment Decisions

By Bre Timko & Dave Schmidt

BLOG OVERVIEW: State and local AI laws governing hiring and selection procedures are already in effect with more on the way. Employers can take seven practical steps right now to build a scalable AI compliance strategy, from inventorying selection procedures and understanding bias audit requirements to conducting proactive audits and gathering validation evidence. While each law carries its own requirements, these foundational practices apply broadly across jurisdictions and can help organizations reduce risk, strengthen legal defensibility, and stay ahead of future regulatory changes.

With over a half dozen state and local artificial intelligence (AI) laws already in effect with several more in process, it can be overwhelming to disentangle the nuances of each law and plan an associated compliance strategy. While each law imposes its own legal obligations (see DCI’s State Legislation Tracker within DCI’s AI Toolkit for quick-hit information on each law’s status and requirements), there are steps employers can take now to prepare for AI compliance across jurisdictions.

It is important to note that when planning for compliance, there is always relevant context that must be considered, including which specific laws or regulations are relevant, the nature of the selection procedure,  and the manner in which it is used, and the broader organizational goals. While specific plans should be tailored to the specific situation, the recommendations below reflect foundational practices that will likely be applicable across multiple enacted and proposed state or local AI laws. Following these recommendations can help organizations build scalable, future-ready compliance frameworks and establish or strengthen governance for their AI-enabled selection procedures.

1. Involve the appropriate stakeholders early in the process. This typically includes legal counsel, talent acquisition, business decision-makers, AI designers or developers, and experts in selection practices and adverse impact analysis, such as Industrial/Organizational (I/O) Psychologists.
   
2. Take an inventory of all selection procedures currently in use, noting the jobs for which they are used and the jurisdictions in which they are administered. This process also provides an opportunity to catalog existing documentation for each selection procedure, making it easier to identify where documentation may be incomplete or missing.^[1] For selection procedures with limited documentation, recommendations 6 and 7 below become especially important.
3. Develop a thorough understanding of each selection procedure. It is important to understand foundational information about the selection procedure, such as the model development and training process, the data used by the model or algorithm(s), the features or components used and their relationship to job requirements or job outcomes, and how those features or components are scored to generate outputs used in the decision-making process. This information is critical not only for determining whether particular laws may be relevant to a selection procedure, but also for determining where guardrails may be insufficient or missing.
4. Familiarize yourself with the requirements of each applicable law. Despite variations among state and local AI laws, most require one or more of the following:  
   
   1. Adverse impact analyses (often referred to as a “bias audit^[2]” or an “impact assessment”)
   2. Candidate notices
   3. Production of a report to an authority or publication of results on a particular cadence (e.g., annually)
   4. Some laws also require job relatedness evidence or offer "safe harbor" provisions for organizations who identify and mitigate bias 
5. Determine if an independent auditor is needed. Certain laws mandate the use of an independent third-party auditor. Even absent such a requirement, organizations may elect to use an external auditor to preserve independence and add credibility to their goals around the responsible use of AI. When doing so, organizations should identify a qualified auditor and prepare the data and documentation necessary to support the audit. DCI has prepared a blog sharing our recommendations on how to choose an auditor wisely.
6. Consider conducting a proactive audit. Organizations may benefit from conducting a voluntary internal or third-party audit of their selection procedures before a specific law requires it. A proactive audit can include both a qualitative assessment (e.g., evaluating job relatedness, alignment with the Uniform Guidelines on Employee Selection Procedures, and potential sources of bias), as well as, where data permits, quantitative adverse impact analyses. The purpose of such an audit is to surface potential areas of risk early and provide an opportunity to address them before they become compliance or enforcement issues.
7. Consider gathering validation evidence or planning future validation work. Where validation evidence is limited, outdated, or unpersuasive, organizations should develop a plan to evaluate the effectiveness and job relatedness of their selection procedures. This may include conducting or updating job analyses, pursuing criterion-related or content-oriented validation studies, or engaging in research that evaluates whether a selection procedure works as intended, is transparent and explainable, and adds value to the selection process. Validation planning is particularly important where proactive or compliance-based auditing identifies potential concerns, as it can mitigate risks by strengthening legal defensibility and supporting ongoing compliance efforts.

While the steps above provide a practical starting point, organizations often benefit from a more comprehensive understanding of how AI regulation is evolving and how it intersects with selection science. We discuss these issues in greater depth in our book chapter, “Regulating Artificial Intelligence: The Evolving Landscape and Its Impact on Industrial-Organizational Psychology,” within Artificial Intelligence for I-O Psychologists. The chapter expands on the themes introduced here, including broader regulatory trends, emerging legal considerations, and the implications for practice.

As state and local AI regulation continues to evolve, organizations that take early, deliberate action will be best positioned to deploy AI responsibly, mitigate and manage potential risks, maintain operational continuity, and adapt to future legal and regulatory developments. While individual laws may differ in scope and application, building a strong compliance foundation now can reduce uncertainty and prevent reactive, last-minute efforts later.

DCI will continue to monitor legislative developments and provide practical, actionable guidance to help organizations navigate this rapidly evolving landscape. As always, stay tuned to DCI Blogs for the latest developments, and feel free to reach out with any questions about state and local AI laws or your compliance strategy.

[1] This determination of documentation availability is useful not only for ensuring legal compliance for AI-enabled selection procedures but also for traditional or long-standing selection procedures.

[2] Note that even though state AI laws often refer to adverse impact analyses as a “bias audit,” adverse impact is not the same as bias. Adverse impact is a legal concept that describes differences in selection or outcome rates across demographic groups, regardless of the cause. By contrast, bias refers to a systematic and unjustified distortion in prediction or measurement that unfairly disadvantages individuals or groups. A finding of adverse impact signals that further review is warranted, but it does not by itself establish that a practice is biased, unlawful, or unfair.