Build One Law Inventory Before an AI Hiring Tool Goes Live

Start with one resume-ranking service. An applicant uploads a resume for a remote sales role, the service converts experience and skills into a score, and the applicant-tracking system closes applications below a configured threshold before a recruiter sees them.

That workflow is more useful than an enterprise list labeled “AI tools.” The same vendor might also supply a scheduling chatbot, which proposes interview times but never ranks applicants. Treating both features as equally high risk wastes review time, while recording only the vendor name hides the consequential use: a score helped decide who remained eligible for work.

The inventory row for that score should answer four operational questions. Whose law could apply? What decision does the score influence? Which notice or assessment must happen before use?

What can the applicant do after an adverse result?

Make the row smaller than the product

Use one row for each combination of system, use and jurisdiction. If the resume ranker supports Colorado jobs and New York City jobs, create separate rows even when the model, vendor contract and recruiter interface are identical. Legal triggers and evidence requirements differ.

The stable identifier belongs to the workflow, not the marketing name. Call the example the hiring-score row and record the vendor, model or service version, configuration owner, deployment date and connected systems beneath it. A vendor can rename a product without changing the decision path; a customer can also change a threshold or enable automatic rejection without buying a new product.

Describe the mechanism in verbs. The service parses resumes, produces a score, sorts applicants and sends low-scoring records to an automated disposition rule. Record the inputs it receives, the output a recruiter sees, whether the output can change eligibility, and where a person can intervene. “AI-assisted recruiting” is too vague to classify.

A practical record also needs the affected population and relevant location facts: applicant residence, job location, employer location and where the system is used. Do not reduce jurisdiction to an IP address. Remote work, travel and stale profile data can make location inference unreliable, so the fallback should route uncertain cases to the more protective configured path or to manual review.

Classify the decision before classifying the technology

State and local rules generally care more about what the system helps decide than whether its supplier calls it artificial intelligence. Employment, housing, insurance, lending, education and access to essential services recur because errors in those domains can deny an opportunity with legal or similarly significant effects.

Colorado’s enacted Artificial Intelligence Act, scheduled to take effect in February 2026, illustrates the structure. It covers a high-risk AI system that makes, or is a substantial factor in making, a consequential decision in specified domains, including employment and housing. The statute requires developers and deployers to use “reasonable care to protect consumers from any known or reasonably foreseeable risks of algorithmic discrimination.” It also assigns deployers duties around risk management, impact assessments, notices and certain post-decision information.

The Colorado attorney general enforces the act; the statute does not create a general private right of action.

For the hiring-score row, ask whether the score can alter the outcome, rather than whether a recruiter can theoretically override it. Automatic rejection is an obvious signal. A ranked slate can also matter when recruiters review only the first page, even though the interface contains an override button.

New York City’s Local Law 144 is narrower and local rather than statewide. It regulates certain automated employment decision tools used to substantially assist or replace discretionary decision-making for hiring or promotion. Covered use requires a recent independent bias audit, publication of specified audit information and advance notice to affected candidates or employees. Its audit and notice controls should therefore attach to the New York City row, not become unsupported claims that every customer using the vendor has satisfied the law.

Illinois provides another reason to classify the feature. Its Artificial Intelligence Video Interview Act focuses on AI analysis of applicant-submitted video interviews, with notice, an explanation of how the system works and what characteristics it evaluates, consent, sharing limits and a deletion process. A text-only resume ranker does not become a video-interview system merely because both features sit inside the same recruiting suite. Separate Illinois employment provisions may still matter, including amendments to the Illinois Human Rights Act governing employer use of AI that took effect in January 2026.

Turn each requirement into a control and a receipt

A citation is not a control. For every applicable requirement, name the event that triggers work, the system that performs it, the owner who checks it and the evidence retained afterward.

The hiring-score row might link a pre-use notice to the application flow. The control should specify which applicants receive it, the language version, when it appears, what happens if delivery fails and which log proves that the notice displayed. A policy document saying applicants “may be notified” will not show that a particular workflow sent notice before the tool was used.

Do the same for impact assessments and audits, while keeping the terms distinct. An impact assessment is the deployer’s documented evaluation of a system’s purpose, risks, safeguards and foreseeable effects. A bias audit under New York City’s rule is a defined independent evaluation with required calculations and publication duties. One document should not be relabeled to satisfy both without checking each requirement.

Appeals need an executable path. Under Colorado’s framework, a deployer using a high-risk system for a consequential decision must provide specified information after an adverse decision, including the principal reason or reasons and information about the AI system’s contribution, while offering opportunities to correct incorrect personal data and appeal for human review when technically feasible. The inventory should point to the appeal form, case queue, response owner and model inputs preserved for review.

Preservation matters because scores drift out of reach. A vendor may overwrite an output after a model update, while the applicant-tracking system retains only a generic rejection code. Capture the score, input references, configuration, model or service version, threshold, decision result and human actions at decision time, subject to retention and privacy limits. Without that receipt, a reviewer may know which product was licensed but not why the hiring-score row closed this application.

Keep profiling rights and sector rules in view

State consumer privacy laws add another layer. Several grant consumers a right to opt out of profiling, meaning automated processing used to evaluate or predict personal characteristics, when that profiling supports decisions producing legal or similarly significant effects. They may also require data protection assessments for covered processing.

Coverage is not uniform. Definitions, thresholds, exemptions and treatment of employment data vary, while laws covering insurers or financial institutions may defer to sector-specific regimes. The inventory therefore needs fields for the legal trigger and exemption analysis, not a single checkbox marked “privacy law applies.” Counsel should validate those conclusions; the operations team should retain the reason and review date.

Insurance deserves its own mapping. Colorado, for example, separately restricts insurers’ use of external consumer data, algorithms and predictive models when that use results in unfair discrimination, with regulatory requirements developed by insurance line. A model used to price or underwrite a policy should point to the insurance rule set as well as any generally applicable AI or privacy entry. Folding it into a generic “consumer scoring” row obscures the regulator, required testing and accountable business owner.

Put chatbots on a different track

The scheduling chatbot still belongs in the system catalog. It just should not inherit the hiring-score row’s risk classification unless it starts screening, recommending or changing access to interviews.

Give interaction systems a separate disclosure track. Some laws, including Utah’s Artificial Intelligence Policy Act and Colorado’s enacted framework, address disclosure when consumers interact with certain AI systems or generative AI, while imposing different conditions from consequential-decision rules. The operational control may be a visible label or a response to a consumer inquiry, not a bias audit and appeal queue.

Watch procurement language here. A chatbot that initially answers benefit questions can acquire decision power when a team connects it to an eligibility database or lets it cancel applications. The inventory owner should review changed permissions, integrations and fallback behavior before release, because the use changed even if the product name did not.

Operate the inventory as release infrastructure

Place a classification gate in procurement, but do not stop there. The engineering or product owner should update the row when inputs, thresholds, jurisdictions, model versions or automated actions change. Legal and compliance teams then review the affected requirements rather than repeating an enterprise-wide AI survey.

Keep enacted obligations separate from proposed or nonbinding material. Each citation needs a status field such as enacted and effective, enacted but not yet effective, proposed rule, agency guidance or enforcement action. Add the effective month, enforcing authority and next review date. A pending bill can justify design preparation, but it should not be represented to applicants or auditors as a current statutory duty.

The cost is mostly coordination and storage rather than model latency. Teams must maintain jurisdiction logic, notice templates, assessment records, appeal staffing and decision-time logs; stricter retention also increases privacy and security exposure. The fallback for an unclassified consequential workflow should be manual review or a paused launch, not a blanket declaration that every AI feature is high risk.

Return to the hiring-score row before release. It should show the actual rejection path, each jurisdictional variant, the notice receipt, the applicable audit or assessment, and the queue where an applicant can challenge bad data. If those links are missing, the organization has an AI list, not a working law inventory.

Questions people ask

Should every AI chatbot go into the law inventory?

Yes, as a cataloged system, but not automatically as a high-risk automated-decision tool. Record what the chatbot can read and change. A bot that schedules interviews may need an interaction disclosure; one that ranks candidates, withholds interview slots or closes applications needs review against employment decision rules.

Is a human approval button enough to avoid automated-decision rules?

Usually not by itself. Review how people use the output, whether they see alternatives, and whether the score determines which records reach them. A nominal override has little practical value when the workflow automatically rejects low scores or reviewers only examine a machine-ranked shortlist.

Can one vendor bias audit cover every jurisdiction?

Do not assume it can. An audit may use the wrong population, date range, selection definition or independence standard for a particular rule, and other laws may require a deployer impact assessment rather than a vendor audit. Map the document’s contents to each requirement before linking it as evidence.

What is the minimum evidence to keep for an appeal?

Preserve enough to reconstruct the decision: relevant input references, output, configuration, model or service version, threshold, resulting action and any human intervention. Link those records to the notice and appeal case, while applying the organization’s retention, access-control and deletion rules to avoid creating an uncontrolled personal-data archive.