The $5M Hiring Discrimination Wake-Up Call: A Practical AI Screening Compliance Checklist for Small Teams Without HR

The single most important control is also the cheapest: a person reviews the AI's output before any consequential decision, especially a rejection or a borderline call. Not a rubber stamp. An actual review where someone looks at what the tool suggested and decides whether they agree.

This matters because the compliance obligation does not transfer to your vendor. You are responsible for your use of the tool. If your ATS in Greenhouse or Ashby auto-rejects candidates on a score threshold and nobody looks, you have built a machine that makes hiring decisions without human judgment. That is exactly the fact pattern plaintiffs' lawyers look for.

Define your intervention points in writing. Rejections and borderline cases are the obvious ones. Then keep per-decision review notes: a short record of what the tool suggested and what the human reviewer decided. It takes seconds per candidate and it is your best evidence if anyone ever asks how a decision was made.

One more thing people forget: accessibility. Make sure your process works for candidates with disabilities. Failure here is a common litigation trigger, and it is easy to miss when your screening is a video interview tool or an online assessment.

You cannot defend a decision you cannot explain. For every candidate who gets screened out, you want a timestamped record of what happened: what the tool scored, what the human reviewer saw, and why the decision went the way it did.

Audit logs are the backbone here. Maintain timestamped records of AI actions, decisions, and human overrides. If your tool does not produce these natively, export what you can and keep it somewhere you control. A shared drive with a clear folder structure beats a vendor dashboard you might lose access to when you switch plans.

Retention is not optional. California FEHA expects you to retain data for at least four years, and other states have their own periods. Pick the longest applicable window and keep everything for that long. This includes disclosures, notices, and candidate communications, not just the scores.

Track tool updates too. Any significant change to your AI tool requires a new bias audit. If your vendor quietly swaps the model or changes the ranking logic, your old audit no longer describes the system you are using.

Vendors will tell you their tool is compliant. That is not the same as an independent audit, and it is not your defense. NYC Local Law 144 and Colorado SB 205 require audits by third parties, not the vendor themselves.

Ask for the independent bias audit report for each tool that screens, scores, ranks, or rejects candidates. Under most state laws and the EU AI Act, those are the high-risk uses. Then check the scope: does the audit cover your use case, your geographic market, and is it current, within the last year? A generic audit from two years ago covering a different hiring context tells you very little.

Bias audits are not cheap. They can run from $50,000 to $200,000 per system. That number stings for a small team, and it is a real reason to be deliberate about how many high-risk tools you actually need. But compare it to the cost of noncompliance: NYC Local Law 144 fines run $375 per day, per violation; Colorado CAIA goes up to $20,000 per violation; Utah UAIP is $2,500 per violation. Remediation to fix and retrain a biased algorithm starts around $100,000.

Also ask what data trained the model. Hidden bias can lurk in historical datasets, and you want to know what you are inheriting. Get the vendor contractually obligated to provide audit results and explainability, and put the liability question in writing. It stays with you, but the contract should at least make the vendor show their work.

Transparency is a legal requirement in several jurisdictions and a decent way to run a hiring process in all of them. NYC, Illinois, California, and Colorado all require you to notify applicants in advance if AI will be used in screening, ranking, or interviews.

Give candidates a plain-language summary of what the tool does and how it affects decisions. Not a link to the vendor's privacy policy. A short paragraph a normal person can read. Then offer a path to human review or an alternative assessment if they ask for it.

This is where a lot of small teams improvise, and it shows. Build the notice into your application flow once, in whatever system you use, and it stops being a per-role scramble. If you are on Workable, Lever, or Teamtailor, you can usually add it to the application confirmation. The point is that every candidate gets the same information, every time.

Good notices also improve your reply rates. Candidates who understand how they are being evaluated are less likely to drop out mid-process, and the ones who ask for human review are often the ones worth a closer look anyway.

Everything above produces paper. Put it in one place: audit reports, notices, vendor contracts, candidate communications, review notes, and the log of tool changes. When an audit or a demand letter shows up, you want to open one folder, not reconstruct six months of decisions from memory.

Calendar the renewals. Annual bias audits, plus a quarterly check on new state and local laws in every jurisdiction where you hire. Compliance is a moving target, and the states are not coordinating with each other.

This is also where a tool like Moments AI fits naturally for a small team. It turns a plain-words role brief into a shortlist with the evidence behind each score, writes first emails from your own mailbox, and books the intro call when a candidate says yes. The evidence trail is built into the workflow rather than bolted on afterward, which is the difference between a compliance file you maintain and one you reconstruct.

The era of plug-and-play AI hiring is over. Treat compliance as a core operational requirement, not an afterthought, and you get two things: protection against the $5 million scenario, and a hiring process that actually finds the candidates your competitors' biased filters throw away.