AI Compliance Checklist

Inventory all AI tools used in hiring

List every tool that uses ML, AI, or statistical modeling to screen, rank, or score candidates. Check ATS, CRM, and HR platforms.

Identify which tools qualify as AEDTs

Use the AEDT Scope Checker or consult legal counsel. Basic keyword search and scheduling are excluded.

Document tool vendors and contracts

Record vendor name, contract terms, and any compliance documentation the vendor provides.

Identify candidate jurisdictions

Determine which candidates reside in NYC, EU, or Colorado — this determines which laws apply.

Create AI governance policy

Document who is responsible for AI compliance, how decisions are made, and how risks are managed.

Review vendor contracts for compliance

Ensure vendor contracts allocate compliance responsibilities. Vendor audits do not replace employer obligations.

Train hiring teams on AI compliance

Ensure recruiters and hiring managers understand AEDT use, candidate notice, and human review requirements.

Set quarterly compliance review

Review AI inventory, audit status, and regulatory updates every quarter.

Commission independent bias audit

Hire a qualified independent auditor. Must be completed within 12 months before AEDT use. Cost: $5K–$30K.

Provide 10-business-day candidate notice

Notify candidates at least 10 business days before AEDT use. Include AEDT statement, job categories, and alternative process instructions.

Publish audit summary publicly

Post on a publicly accessible web page (no login). Include auditor name, date, selection rates, impact ratios. Keep for 6 months after audit expires.

Set annual audit renewal reminder

Bias audits expire after 12 months. Set a calendar reminder 60 days before expiration to start renewal.

Document human review process

If humans review AEDT outputs, document the review process to demonstrate meaningful oversight.

Classify AI system risk level

Determine if your AI is prohibited, high-risk, limited risk, or minimal risk under the EU AI Act.

Implement risk management system

Document risks throughout the AI lifecycle. Required for high-risk AI under Article 8.

Prepare technical documentation

Document system design, training data, model architecture. Required for high-risk AI under Article 11.

Implement record-keeping (logging)

Log all AI decisions for audit trails. Required for high-risk AI under Article 12.

Establish human oversight procedures

Ensure humans can monitor and override AI outputs. Required for high-risk AI under Article 14.

Plan conformity assessment

Determine if third-party or self-assessment is required. Obtain CE marking before deployment.

Implement Article 50 transparency

Inform individuals when they interact with AI. Required by August 2, 2026.