Foreword by Kyle Lagunas

Founder & Principal, Kyle & Co.

After a decade advising HR and Talent leaders on how to adopt technology responsibly, I've seen excitement around AI quickly give way to concern, especially around bias and fairness.

As AI tools embed deeper into hiring and workforce decisions, we face a defining moment: will we carry forward old inequalities, or use AI to build something better?

New and forthcoming legislation makes this choice all the more urgent. Pending court cases signal that AI risk is no longer theoretical. For HR and TA leaders, and technology vendors, bias is now a legal and reputational issue.

But we must resist the temptation to simply run away from the "bias boogeyman." Instead, we need to lean in, and find real answers to the real risks we face.

This report brings a number of interesting points together to crystallize this critical conversation. It offers a grounded view of where AI is impacting TA decisions today and moves us past assumptions and toward evidence.

While bias is real, it is also measurable, manageable, and, thankfully, mitigatable.

Kyle Lagunas, Founder & Principal, Kyle & Co

Introduction

Headlines are dominating the news. Allegations are playing out in court. Candidate perception is at an all-time low. The debate around AI bias in hiring has never been louder.

It has also never been less informed by data.

Across 150+ AI bias audits and more than one million test samples, Warden AI's 2025 State of AI Bias in Talent Acquisition report shows something different from the headlines: 85% of audited AI systems meet accepted fairness thresholds. On average, AI hiring tools deliver up to 45% fairer outcomes for racial minorities and 39% fairer outcomes for women than the human-led processes they replace.

The risk is real. It's just not where most people are looking.

This article unpacks what 150+ bias audits actually reveal about AI fairness, the regulatory landscape, and where the next wave of liability is forming.

Key Takeaways

  • Most AI hiring systems pass bias audits. 85% of AI systems audited meet the four-fifths rule for disparate impact, and 95% pass counterfactual consistency testing. The category-wide narrative that AI hiring tools are systematically biased is not what the audit data shows.
  • AI is measurably fairer than humans on average. Bias audits comparing AI-powered selection against human-only decisions show AI systems delivering up to 45% fairer outcomes for racial minorities and 39% fairer outcomes for women, against a human baseline that has not changed materially in decades.
  • The risk is vendor-specific, not category-wide. Fairness scores vary by up to 40% between systems. 15% of audited tools fail at least one demographic threshold. Vendor selection, not AI adoption itself, is now the dominant legal and reputational risk in HR.
  • Bias audits are a legal requirement in NYC, and the de facto standard everywhere else. Only NYC Local Law 144 mandates an independent bias audit by name. Illinois HB 3773 and California's ADMT and FEHA regulations create discrimination liability that bias audits are the strongest evidentiary defense against. Colorado's framework was rewritten in May 2026. SB 26-189 repealed the Colorado AI Act, and pivots to disclosure and human-review obligations, but the underlying federal and state discrimination liability for AI in employment remains.

What Is an AI Bias Audit?

An AI bias audit is a structured, statistical evaluation of an algorithmic decision system. Its purpose is to determine whether the system produces materially different outcomes for protected groups.

In hiring and talent acquisition, a bias audit is the standard mechanism for proving that an AI tool does not produce a disparate impact based on race, ethnicity, sex, age, disability, or other protected characteristics.

A defensible bias audit has three components.

Independent execution. The audit is conducted by an impartial third party, not by the vendor that built the tool, and not by the employer's internal data science team. Independence is not a stylistic choice. NYC Local Law 144 explicitly requires it, and broader regulatory expectations under the EEOC's Uniform Guidelines on Employee Selection Procedures (1978) point in the same direction.

Group-level and individual-level testing. Group-level bias is measured through disparate impact analysis: the four-fifths rule, formalized by the EEOC in the 1978 Uniform Guidelines on Employee Selection Procedures. (The 1978 guidelines remain in force in 2026, though federal enforcement of disparate-impact theory has been significantly deprioritized since April 2025; see the regulatory section below.) Individual-level bias is measured through counterfactual consistency: swapping protected attributes (name, gender markers, ethnic signals) in otherwise identical profiles to detect whether the AI's judgment changes.

Warden AI's two bias tests: disparate impact analysis (four-fifths rule, ≥80% parity) and counterfactual consistency (≥97.5%).
Warden AI's two bias tests: disparate impact analysis (four-fifths rule, ≥80% parity)
and counterfactual consistency (≥97.5%).

Public disclosure. Audit summaries, including the date, the data source, and the impact ratios, must be published where candidates can access them. Transparency is the regulatory mechanism that makes the audit useful to anyone other than the company that commissioned it.

What separates a bias audit from generic "AI fairness" work is measurability. Audits produce numbers. Those numbers can be compared across systems, vendors, and time. That is what allows a hiring leader, a regulator, or a candidate to make a decision based on evidence rather than vendor marketing.

Buyers are asking more questions about AI bias, and it's becoming a key factor in procurement decisions. — Jung-Kyu McCann, Chief Legal Officer, Greenhouse Software

What HR Leaders Actually Think About AI Bias

Three out of four talent acquisition teams now use AI or automated systems in some form. The pressure to adopt is strong. So is the friction.

75% of talent acquisition teams use AI or automated systems; 25% don't.
75% of talent acquisition teams use AI or automated systems; 25% don't.

In Warden AI's survey of 100+ tech vendors and practitioners, 75% of HR leaders named bias as a top concern when evaluating AI tools, second only to data privacy. The concern is structural, not anecdotal. AI in hiring sits at the intersection of three high-stakes conditions: it automates a previously human-led decision, it operates at scale, and it touches a protected class on every interaction.

HR leaders' top AI concerns, ranked: data privacy #1, bias and fairness #2, transparency #3, regulatory compliance #4.
HR leaders' top AI concerns, ranked: data privacy #1, bias and fairness #2, transparency #3, regulatory compliance #4.

AI adoption in HR is still in its early innings. The case law is already moving. Mobley v. Workday cleared the collective-action threshold, establishing that AI hiring claims can scale to class-wide litigation, and that vendors, not just employers, may carry liability for algorithmic discrimination. The case has repriced how HR technology buyers think about vendor risk.

The litigation theory has now expanded beyond disparate impact. Kistler et al. v. Eightfold AI Inc., filed in January 2026 and since removed to federal court, alleges that an AI hiring platform aggregating third-party data and scoring candidates on a 0–5 scale functions as a consumer reporting agency under the federal Fair Credit Reporting Act (FCRA). The plaintiffs argue this triggers disclosure, consent, and dispute-rights obligations Eightfold did not satisfy. The case puts the entire category of AI scoring platforms inside FCRA's compliance perimeter, pending the court's ruling.

Two cases. Two legal theories. Same underlying signal: as AI adoption in HR accelerates, vendor-level legal exposure is structurally repricing, not as one-off events, but as a category-wide reset. Mobley tests AI hiring under disparate-impact discrimination law. Kistler tests it under consumer-protection law, a theory unaffected by the 2025 federal enforcement shifts on disparate impact.

Media mentions of Mobley v. Workday climbed from 2023 and spiked after collective-action status in 2025.
Media mentions of Mobley v. Workday climbed from 2023 and spiked after collective-action
status in 2025.


Procurement is changing in response. According to the same survey, 50% of HR buyers now run formal evaluations of AI systems before purchase. Only 17% still rely primarily on vendor reputation. Responsible AI is no longer a slide in the trust-and-safety section of a vendor pitch. It is a procurement gate.

HR buyers and AI risk: 35% always weigh it; 46% see Responsible AI as a differentiator; 50% run formal evaluations.
HR buyers and AI risk: 35% always weigh it; 46% see Responsible AI as a differentiator;
50% run formal evaluations.


The academic literature is catching up to the commercial concern. Over the past three years, the number of peer-reviewed and working-paper studies examining bias in HR AI models has more than quadrupled, from roughly 10 studies in mid-2022 to mid-2023 to more than 40 studies in mid-2024 to mid-2025. The vast majority identified bias of some form, reflecting both the increased availability of foundation models for academic study and the maturing methodologies for testing fairness.

AI-bias studies in HR more than quadrupled: ~10 (2022–23), ~21 (2023–24), ~43 (2024–25); most found bias.
AI-bias studies in HR more than quadrupled: ~10 (2022–23), ~21 (2023–24), ~43 (2024–25);
most found bias.
Just like people, some AIs are fair and some are not, so it's important that you pick the right ones to work with. — Sarah Smart, Managing Partner, HorizonHuman (former Head of TA Product, JPMorgan Chase)

What Bias Audits Reveal About AI Hiring Tools

A note on methodology before the findings. Much of the academic literature on AI bias relies on simplified experimental setups: swapping candidate names, forcing the AI to choose between two near-identical profiles, ranking a small candidate pool, or directly prompting the model to compare candidates without a structured evaluation framework. These setups raise awareness but often exaggerate bias relative to how AI is actually deployed in production hiring workflows, where systems score candidates individually against defined criteria.

Four academic techniques for eliciting AI bias — name swap, forced choice, pool ranking, direct prompting — and why each overstates real-world bias.
Four academic techniques for eliciting AI bias — name swap, forced choice, pool ranking, direct prompting — and why each overstates real-world bias.

Warden AI's bias audit data comes from production AI systems operating in real-world hiring workflows. The headline finding from 150+ AI bias audits is unambiguous: most audited systems are passing.

85% of audited AI hiring systems clear the four-fifths impact-ratio threshold; 95% pass counterfactual consistency.
85% of audited AI hiring systems clear the four-fifths impact-ratio threshold; 95% pass counterfactual consistency.

85% of audited AI hiring systems scored above the 0.8 impact ratio threshold across all tested demographic groups, the bar set by the EEOC's four-fifths rule. 95% scored above 97.5% on counterfactual consistency, meaning their outputs remained stable when protected attributes were swapped in otherwise identical profiles.

In aggregate, the AI systems used in hiring are more fair than the cultural narrative around them assumes. That finding aligns with what an increasing body of research from MIT, Stanford, and the National Bureau of Economic Research has begun to surface in peer-reviewed and working-paper form: AI hiring systems, when properly designed and continuously audited, can outperform human-only decision processes on measurable fairness metrics.

But that is not the end of the story. This is where the data gets more honest.

Bias varies up to 40% between vendors.

Spread of impact-ratio and consistency scores: most systems clear the thresholds, but performance varies widely.
Spread of impact-ratio and consistency scores: most systems clear the thresholds, but performance varies widely.

The industry average looks strong. The individual systems behind that average do not all perform equally. Some cluster near 1.0, near-perfect parity. Others fall well below the four-fifths threshold for at least one protected group. The variance between the best and worst systems exceeds 40%.

15% of audited AI tools failed at least one demographic threshold in our 2025 dataset. The failures are not random. They tend to cluster in tools that were trained primarily on historical hiring data: on the outputs of the very human bias that AI was meant to mitigate. Without intervention, models learn the patterns in their training data, including the discriminatory ones.

15% of audited AI hiring tools fell below the 0.8 impact-ratio threshold for at least one group.
15% of audited AI hiring tools fell below the 0.8 impact-ratio threshold for at least one group.

The practical implication: an enterprise's exposure to AI bias risk is determined far more by which AI tool it deploys than by whether it deploys AI at all. This is the central finding bias audits have surfaced. It is also the central reason vendor selection is now a legal decision, not a technical one.

What Bias Audits Show About AI vs. Human Decisions

There is a comparison most AI bias coverage omits. It is the comparison that most changes the conversation.

According to the U.S. Equal Employment Opportunity Commission's enforcement and litigation statistics, more than 99.9% of employment discrimination claims filed in the United States over the last five years relate to human decision-making, not AI. Roughly 100,000 employment discrimination claims are filed in the U.S. each year. Approximately 100 progress to lawsuits. Of those, only a small fraction involve algorithmic systems.

U.S. employment discrimination claims, 2020–2024: 371,850 human-related vs. 14 involving AI.
U.S. employment discrimination claims, 2020–2024: 371,850 human-related vs. 14 involving AI.

The dominant source of employment discrimination, by every available measure, remains human bias. That is the baseline AI is being compared against.

When Warden AI benchmarked AI-powered hiring outcomes against a synthesized human bias benchmark drawn from peer-reviewed academic and industry studies (including Bertrand and Mullainathan's seminal "Are Emily and Greg More Employable Than Lakisha and Jamal?" (2003), Quillian et al.'s 2017 meta-analysis of field experiments on racial discrimination in hiring, and Goldin and Rouse's 2000 Orchestrating Impartiality), the contrast was direct and substantial.

Peer-reviewed studies behind the human-bias benchmark, converted to impact ratios (Bertrand & Mullainathan, Quillian, Goldin & Rouse, others).
Peer-reviewed studies behind the human-bias benchmark, converted to impact ratios (Bertrand & Mullainathan, Quillian, Goldin & Rouse, others).

Average impact ratio: AI selection 0.94 (above the 0.8 threshold) vs. human selection 0.67 (below it).
Average impact ratio: AI selection 0.94 (above the 0.8 threshold) vs. human selection 0.67 (below it).

AI-powered selection delivered an average impact ratio of 0.94, within the four-fifths fairness threshold. Human-led decisions, benchmarked from the same body of academic research, scored 0.67, well below the threshold.

The breakdown by demographic group is sharper.

Impact ratio by race/ethnicity: AI scores 0.94–0.97; humans 0.67–0.72 for Black, Hispanic, and Asian candidates.
Impact ratio by race/ethnicity: AI scores 0.94–0.97; humans 0.67–0.72 for Black, Hispanic, and Asian candidates.

For racial minorities (Black, Hispanic, and Asian candidates), AI systems delivered up to 45% fairer treatment than human-led processes, measured by impact ratio. For women, AI systems delivered up to 39% fairer outcomes than the human baseline.

Impact ratio by sex: women score 0.99 with AI vs. 0.71 human-led; men 0.98 vs. 1.00.
Impact ratio by sex: women score 0.99 with AI vs. 0.71 human-led; men 0.98 vs. 1.00.

These results are not a vindication of AI without oversight. They are evidence that AI, when audited, can raise the floor on workplace fairness rather than lower it. The risk of AI is not that it is uniquely biased. The risk is that, deployed without bias audits, an AI system can scale a hidden bias to a volume no human recruiter ever could.

We are right to worry about AI bias, but we should not forget that the baseline — human-only judgment — is far from bias-free. — Hung Lee, Curator, Recruiting Brainfood

The Regulatory Landscape for AI Bias Audits in 2026

In 2023, NYC Local Law 144 made independent bias audits a legal requirement for AI used in hiring decisions in New York City. It remains the only U.S. regulation to mandate the bias audit by name. In 2026, two additional state-level regimes (Illinois HB 3773 and California's CCPA and FEHA regulations) created liability for algorithmic discrimination that, in practice, has made the bias audit the strongest evidentiary defense available to employers and vendors. Colorado was on the same trajectory: SB 24-205, the Colorado AI Act, was set to introduce a duty-of-care and risk-assessment regime in February 2026. That framework was repealed and replaced in May 2026 by SB 26-189, which shifts Colorado to a disclosure-and-human-review model effective January 2027.

Key HR AI regulations compared — NYC LL144, Colorado AI Law, EU AI Act, ISO 42001 — by region, date, and who they cover.
Key HR AI regulations compared — NYC LL144, Colorado AI Law, EU AI Act, ISO 42001 — by region, date, and who they cover.

The regulatory landscape has continued to evolve since the 2025 report, in both directions. Illinois HB 3773 (effective January 2026) and California's ADMT and FEHA regulations (effective January 2026) have expanded U.S. AI employment regulation. Colorado moved the other way: SB 24-205 was repealed and replaced by SB 26-189 in May 2026 before it took effect, shifting the state from a duty-of-care/risk-assessment regime to a disclosure-and-human-review model effective January 2027. The article that follows reflects the current state of each regime.

NYC Local Law 144

Effective July 5, 2023, NYC Local Law 144 was the first U.S. regulation specifically targeting AI hiring tools. It requires any "automated employment decision tool" (AEDT) used for hiring or promotion in New York City to undergo an annual independent bias audit, with results published on the employer's public website. Candidate notification is also mandatory.

The New York City Department of Consumer and Worker Protection (DCWP) enforces the law, with fines ranging from $500 to $1,500 per violation per day. The ACLU AEDT Tracking Repository shows the number of published bias audits has grown from zero in mid-2023 to more than 50 by mid-2025.

The December 2025 Comptroller audit: enforcement was "ineffective." In December 2025, the New York State Comptroller's office released a critical audit of DCWP's enforcement of Local Law 144 covering activities from July 2023 through June 2025. The audit concluded that current enforcement is "ineffective" and identified three structural deficiencies:

  • Broken complaint intake. 75% of test calls to the NYC 311 hotline regarding AEDT issues were improperly routed and never reached the DCWP. Filing instructions on the agency's website were unclear.
  • Superficial compliance review. The DCWP reviewed 32 publicly posted bias audits and identified only one non-compliance issue. The Comptroller's office reviewed the same 32 audits and identified at least 17 potential non-compliance issues, a 17-to-1 discrepancy the audit characterized as evidence of systemically inadequate review.
  • Failure to use available expertise. The DCWP did not use its own formal Enforcement Workbook or consult the NYC Office of Technology and Innovation when assessing potential violations.

In its response, the DCWP agreed to implement the majority of the Comptroller's recommendations, including strengthened complaint routing, cross-divisional staff training, formal written policies and procedures, and an enhanced enforcement approach that may include direct interviews with employers and live demonstrations of AEDT tools in use. Employment-law analyses from DLA Piper and other major firms in early 2026 framed the audit as a roadmap for how the DCWP is now expected to identify non-compliant companies. Employers subject to Local Law 144 should anticipate a new phase of stringent enforcement, including more frequent investigations and the prospect of higher cumulative penalties at up to $1,500 per violation per day.

Published NYC bias-audit disclosures rose from zero in July 2023 to ~55 by May 2025.
Published NYC bias-audit disclosures rose from zero in July 2023 to ~55 by May 2025.

Colorado: Recent Changes to State AI Law — SB 24-205 vs. SB 26-189

Colorado has been the most actively re-litigated state in U.S. AI regulation. The state passed, debated, and materially revised its AI employment framework before either version took effect. For employers and vendors, the spotlight is on what changed between the original Colorado Artificial Intelligence Act (SB 24-205) and the successor SB 26-189, and what each implies for AI used in employment decisions.

SB 24-205, the original Colorado AI Act. Passed in May 2024 and originally scheduled to take effect February 1, 2026. The framework imposed a duty of "reasonable care to avoid algorithmic discrimination" on developers and deployers of high-risk AI systems, including those used in consequential decisions like employment. Compliance obligations included documented risk management programs, annual impact assessments functionally aligned with a bias audit, and developer disclosure requirements to deployers. SB 24-205 was the first U.S. state-level law to comprehensively regulate AI in employment under a duty-of-care model.

SB 26-189, the successor. Passed May 12, 2026 by bipartisan margins (Senate 34-1; House 57-6); effective January 1, 2027. The successor shifts Colorado from duty-of-care to disclosure. Deployers must provide clear, conspicuous notice to applicants and employees when "automated decision-making technology" (ADMT) is used in a consequential decision. Individuals subject to an adverse algorithmic decision have a right to request human review. Developer obligations include technical documentation, material-update notices to deployers, and three-year record retention. The duty of care, risk management program, and impact-assessment requirements from SB 24-205 are not carried into the successor.

What changed, side-by-side. SB 24-205 was a duty-of-care regime with risk-assessment obligations that functionally mirrored a bias audit. SB 26-189 is a disclosure-and-human-review regime with documentation obligations but no statutory bias-testing requirement. Both apply to consequential decisions including employment. Both apply to developers and deployers. The shift is in what compliance looks like to prove the system is fair, to disclose that the system exists, and offer a human alternative.

What it means for HR and TA leaders. Under SB 26-189, Colorado no longer requires bias-audit-style risk assessments as a matter of state AI law. But the underlying discrimination liability for AI used in employment, under Title VII, the Colorado Anti-Discrimination Act, and private rights of action, has not changed. An independent bias audit remains the most defensible response to that liability. The Colorado evolution is a signal to watch: state AI law in 2026 is volatile, and the gap between what is required by statute and what is defensible in litigation has widened.

Illinois HB 3773 (Illinois Human Rights Act Amendment)

Effective January 1, 2026, Illinois HB 3773 amends the Illinois Human Rights Act to explicitly prohibit the use of AI in employment that has a discriminatory effect on protected classes. Employers must notify employees and applicants when AI is used in covered employment decisions, and bias testing (in practice, an independent bias audit) has become the de facto evidentiary standard for demonstrating compliance.

California: CCPA ADMT and FEHA Automated Decision Systems

California has moved on two fronts. Under the California Consumer Privacy Act (CCPA), the California Privacy Protection Agency has finalized regulations on Automated Decision-Making Technology (ADMT), granting consumers (including job applicants) rights to access, opt out, and receive meaningful information about AI used in significant decisions. The regulations were filed with the California Secretary of State on September 22, 2025, take effect January 1, 2026, with ADMT-specific risk-assessment requirements phasing in beginning April 1, 2027.

In parallel, the California Civil Rights Council has issued regulations under the Fair Employment and Housing Act (FEHA) extending discrimination liability to "automated decision systems" used in employment. As analyzed by Harvard Business Review in its coverage of AI fairness in hiring, California's approach is among the most comprehensive in the United States.

HR leaders face a patchwork of regulations across regions. Turning this into day-to-day governance is now the differentiator. — Martyn Redstone, Head of Responsible AI & Industry Engagement, Warden AI

The Federal Shift on Disparate Impact: Why It Makes Bias Audits More Important, Not Less

In April 2025, President Trump signed Executive Order 14281, Restoring Equality of Opportunity and Meritocracy, directing federal agencies to deprioritize enforcement of statutes and regulations that include disparate-impact liability. On September 30, 2025, the EEOC ceased investigating discrimination claims based solely on disparate impact, limiting Commission enforcement to disparate-treatment (intentional discrimination) cases.

The 1978 Uniform Guidelines on Employee Selection Procedures, including the four-fifths rule, remain in force. Griggs v. Duke Power (1971), the Supreme Court precedent establishing disparate-impact liability under Title VII, remains good law and continues to govern private litigation. But the federal enforcement posture has materially shifted.

The practical effect for HR leaders is bifurcation. Federal enforcement has softened. State, local, and private enforcement has not. NYC Local Law 144 is entering a stricter enforcement phase in 2026. The December 2025 Comptroller audit found prior DCWP enforcement "ineffective" (see the NYC section above), and the agency has committed to a more proactive enforcement posture in response. Illinois HB 3773 took effect January 2026. California's ADMT and FEHA regulations are in active rulemaking and enforcement. Colorado's framework was rewritten in May 2026. SB 26-189 replaced SB 24-205 with a disclosure-and-human-review model effective January 2027, removing the bias-audit-aligned risk-management requirements but not the underlying discrimination liability. Private Title VII plaintiffs can still pursue disparate-impact claims.

AI bias audits are more important in 2026, not less. The risk has shifted away from federal action and toward state regulators and private plaintiffs. Both continue to rely on the four-fifths rule as the operative standard.

Standards and frameworks behind the regulations

Underneath the laws, three reference frameworks shape what regulators expect.

  • The EEOC's Uniform Guidelines on Employee Selection Procedures (1978): origin of the four-fifths rule. Still on the books in 2026, though federal enforcement of disparate-impact theory has been deprioritized; the rule remains operative through NYC Local Law 144, state AI hiring laws, and private Title VII litigation.
  • The NIST AI Risk Management Framework (AI RMF 1.0): published by the U.S. National Institute of Standards and Technology, the framework most U.S. regulators reference when defining "responsible AI."
  • ISO/IEC 42001:2023: the first international management-system standard for AI, increasingly cited by procurement teams and auditors as the global anchor for AI governance.

Additionally, where AI is used in background checks or pre-employment screening involving consumer data, the Fair Credit Reporting Act (FCRA) continues to apply, a point the FTC and EEOC have reinforced in joint guidance. Kistler v. Eightfold AI, filed January 2026 and now in federal court, is the first major test of whether AI hiring platforms that aggregate third-party data and score candidates qualify as "consumer reporting agencies" under FCRA. A win for the plaintiffs would extend FCRA's disclosure, consent, and dispute-rights obligations to a large swath of AI hiring technology, independent of any disparate-impact analysis.

Vendor compliance by regulation: NYC LL144 38%, EU AI Act 26%, Colorado SB205 25%, ISO 42001 20%.
Vendor compliance by regulation: NYC LL144 38%, EU AI Act 26%, Colorado SB205 25%,
ISO 42001 20%.

Compliance has lagged regulation. In Warden AI's survey, only 38% of HR vendors report full compliance with NYC LL 144, the oldest of the four regimes. For the newer Colorado, Illinois, and California rules, full compliance hovers in the 20–26% range.

Where Vendors Stand on Bias Audits and Responsible AI

The vendor side of the market is maturing, unevenly.

Vendor AI governance foundations: 64% define AI principles, 76% document a policy, 73.5% name an owner.
Vendor AI governance foundations: 64% define AI principles, 76% document a policy, 73.5% name an owner.

Most HR technology vendors now have the foundations of an AI governance program. 64% have defined AI principles. 76% have documented an AI governance policy. 73.5% have named an owner for AI governance. These are leading indicators that responsible AI is being taken seriously across the ecosystem.

The harder question is what those foundations produce in practice.

Vendor bias-evaluation depth: 75% test internally, 45% use third-party audits, 45% cover sex and race, only 5% go further.
Vendor bias-evaluation depth: 75% test internally, 45% use third-party audits, 45% cover sex and race, only 5% go further.

75% of HR technology vendors now conduct some form of internal bias testing. But only 45% engage an independent third party for a bias audit, the standard required under NYC LL 144 and increasingly expected under Colorado, Illinois, and California regulations. Only 5% of audits extend beyond sex and race/ethnicity to cover age, disability, or other protected categories. That gap has direct consequences. Age discrimination claims, including the EEOC's 2023 $365,000 settlement with iTutorGroup over algorithmic age discrimination in hiring, indicate that the protected classes left out of most audits are exactly the ones where claims are emerging.

Bias-audit coverage by protected group: sex and race/ethnicity 100%; age and disability 5%; religion/orientation 2%; national origin 1%.
Bias-audit coverage by protected group: sex and race/ethnicity 100%; age and disability 5%; religion/orientation 2%; national origin 1%.
Vendor transparency: 71% publish AI docs, 63% explain training data, 35% publish audit results, 15% offer opt-out.
Vendor transparency: 71% publish AI docs, 63% explain training data, 35% publish audit results, 15% offer opt-out.

Vendor-to-buyer transparency is improving. Vendor-to-end-user transparency is not. Only 40% of HR technology platforms clearly explain to candidates and employees that AI is being used in their evaluation. 20% mention it briefly. 40% do not disclose it at all.

Transparency to candidates: 40% clearly explain AI use, 20% mention it briefly, 40% don't disclose it.
Transparency to candidates: 40% clearly explain AI use, 20% mention it briefly, 40% don't disclose it.

That last data point is the one most likely to drive the next wave of enforcement. The EU AI Act, California's ADMT rules under CCPA, and Illinois HB 3773 all explicitly require disclosure to the individual subject of an AI decision. The vendor-side foundations are there. The user-side practice is not.

Strong governance frameworks build the confidence that enables rapid AI adoption. This is what turns innovation into execution. — Trent Cotton, Head of TA Insights, iCIMS

Only 20% of HR tech vendors follow all four responsible-AI practices: governance, public docs, public audits, regulatory prep.
Only 20% of HR tech vendors follow all four responsible-AI practices: governance, public docs, public audits, regulatory prep.

Only 20% of HR technology vendors meet the four practices that, taken together, represent the current standard for defensibility: documented AI governance, public Responsible AI documentation, publicly shared audit results, and active regulatory preparation. That 20% is where the buyer-side advantage now sits.

"The best way to mitigate risk is to design and deploy AI responsibly from day one." — Sultan Saidov, Co-founder and President, Beamery

What This Means for HR and TA Leaders Through 2027

This is what the data actually says.

AI in hiring is not a uniformly biased category. Most audited systems pass fairness thresholds. The systems that pass are, on average, fairer than the human processes they replace. The systems that fail tend to fail predictably, and they can be identified before deployment through an independent bias audit.

The risk has shifted. It is no longer "is AI biased?" That was a category-level question with a mixed answer. It is now "is this AI system, deployed in this workflow, audited and defensible against these regulatory standards?" That is a vendor-level question with a binary answer.

That is a different procurement conversation than HR has been running. And it is a different liability calculus than most general counsel offices have priced in.

Systems that shape people's careers must be subject to meaningful accountability. The question is not whether to use AI in hiring. It is whether the AI used in hiring can be proven, on demand, to be fair.

Warden AI was founded on the belief that trust and oversight unlock innovation, particularly in HR, one of the highest-stakes arenas for AI. Continuous, independent bias audits are how that trust is built and maintained. Across 150+ audits, the data shows it can be done. Through 2026 and into 2027, with Colorado SB 26-189 taking effect January 1, California's ADMT risk-assessment requirements phasing in from April, and NYC LL 144 enforcement materially tightening, the question is no longer whether bias audits matter. It is who is doing them, and how defensibly.

Related Articles

Special Thanks to Our Contributors

This article draws on the State of AI Bias in Talent Acquisition 2025 report from Warden AI, which would not have been possible without the participation of 100+ talent technology vendors and practitioners who shared survey responses, audit data, and Responsible AI documentation. Special thanks to:

Beamery · Greenhouse · Popp · Classet · Endorsed · SquarePeg · Sense · Juicebox · ConverzAI · Kula · iCIMS · HeyMilo · Inploi · CodeSignal · Cielo · TechWolf · Fuel50 · Spark Hire · Colleva · Spotted Zebra · Alex · Tezi · Censia · JOBMA · Hackajob · Sapia · XOPA AI · Humanly · Findem

Logos of 32 talent-tech vendors and practitioners who contributed to Warden AI's 2025 State of AI Bias in Talent Acquisition report.
Logos of 32 talent-tech vendors and practitioners who contributed to
Warden AI's 2025 State of AI Bias in Talent Acquisition report.

Bias Audit FAQs

An AI bias audit is a structured, statistical evaluation of an algorithmic system used to determine whether it produces materially different outcomes for protected groups (defined under U.S. law as race, ethnicity, sex, age, disability, and others). In hiring, a bias audit typically measures disparate impact against the EEOC's four-fifths rule (1978) and counterfactual consistency: whether the AI's judgment changes when protected attributes are swapped in otherwise identical profiles. Under NYC Local Law 144, the audit must be conducted by an independent third party and published publicly.

On average, audited AI systems are measurably fairer than human-only decision processes. Warden AI's analysis of 150+ bias audits, benchmarked against peer-reviewed studies of human hiring decisions (including Bertrand and Mullainathan 2003 and Quillian et al. 2017), shows AI-powered selection achieving an average impact ratio of 0.94 versus 0.67 for human-led decisions. According to U.S. EEOC enforcement data, more than 99.9% of employment discrimination claims relate to human decision-making, not AI. The risk with AI is not that it is uniquely biased. The risk is that, deployed without an independent bias audit, an unfair system goes undetected and scales to a much larger population.

The four-fifths rule was codified by the EEOC in its 1978 Uniform Guidelines on Employee Selection Procedures. It holds that the selection rate for any protected group should be at least 80% of the selection rate for the most-selected group. The ratio between those rates is the impact ratio. A score of 0.8 or above is generally considered evidence that no disparate impact exists. The 1978 guidelines remain in force in 2026, but federal enforcement of disparate-impact theory was significantly deprioritized under Executive Order 14281 (April 2025), and the EEOC stopped investigating disparate-impact-only claims as of September 30, 2025. Despite that federal shift, the rule remains the operative standard for NYC Local Law 144 (which explicitly references it), state AI hiring laws in Colorado, Illinois, and California, and private Title VII disparate-impact litigation. It is the dominant statistical test used in AI bias audits.

Only one U.S. law currently mandates an independent bias audit by name: NYC Local Law 144 (effective July 2023). Two additional state regimes have made bias audits the de facto compliance standard for AI used in employment decisions: Illinois HB 3773 amending the Illinois Human Rights Act (effective January 2026) and California's ADMT regulations under the CCPA together with the Civil Rights Council's Automated Decision Systems regulations under FEHA. Each creates discrimination liability for AI in employment, with bias testing serving as the strongest evidentiary defense. Colorado's framework was significantly rewritten in May 2026: SB 26-189 repealed the Colorado AI Act (SB 24-205) before its effective date and replaced it with a disclosure-and-human-review framework effective January 2027, removing bias-audit-aligned risk-assessment requirements while leaving underlying discrimination liability under Title VII and the Colorado Anti-Discrimination Act unchanged. The EU AI Act is the most relevant international regime. Underneath the laws, the NIST AI Risk Management Framework and ISO/IEC 42001:2023 set the technical and governance expectations regulators draw from.

No, not for purposes of regulatory compliance. NYC Local Law 144 explicitly requires that the bias audit be conducted by an "independent auditor" with no financial interest in the tool or the employer. Colorado, Illinois, and California regulations either require or strongly imply third-party evaluation. Vendor self-assessments are valuable for internal R&D but are not legally defensible. The independent-audit requirement exists because the conflict of interest in self-assessment is structural, not personal.

Three practices, in order of impact. First, conduct an internal inventory of every AI system used in hiring or promotion decisions (including résumé screeners, sourcing tools, video assessments, and skills tests) and identify which qualify as "automated employment decision tools" under the relevant law. Second, require independent bias audits, on an annual cadence, for every system that qualifies. Third, build continuous monitoring into the workflow, not just point-in-time audits, to detect model drift and protected-class coverage gaps before they become enforcement actions. Warden AI's platform is built around this continuous-audit model.