Is AI résumé screening legal? A small-business compliance guide.

The federal baseline: the law watches the outcome, not the tool

No federal statute mentions résumé screening software. What applies is the same body of law that has governed hiring tests since the 1970s. Title VII of the Civil Rights Act prohibits discrimination on the basis of race, color, religion, sex, and national origin. The Age Discrimination in Employment Act (ADEA) protects applicants aged 40 and over. The Americans with Disabilities Act (ADA) protects applicants with disabilities and requires reasonable accommodation in the application process.

Each of these reaches two kinds of harm. Disparate treatment is intentional: screening out candidates because of a protected trait. Disparate impact is unintentional: a neutral-looking selection procedure that screens out a protected group at a materially higher rate and cannot be justified as job-related and consistent with business necessity. The Uniform Guidelines on Employee Selection Procedures, still the reference point for enforcement, treat a selection rate for one group below four-fifths of the rate for the highest group as evidence of adverse impact.

The practical point for a small business: if a tool ranks, scores, or rejects candidates and that output has a disparate impact, the employer is responsible for it. Buying the software does not transfer the liability. The EEOC said as much in technical assistance issued in 2022 (ADA) and 2023 (Title VII). Those documents were withdrawn from the agency’s site in early 2025 after a change in administration, but the statutes they interpreted have not changed, and private plaintiffs do not need EEOC guidance to bring a claim.

The ADA problem is specific

Disability claims deserve their own paragraph because the risk is different in kind. A screening tool that penalises an employment gap, a non-linear career, or an unusual résumé format can screen out someone whose gap was medical leave or whose format reflects assistive technology. That is not a statistical question; a single applicant can bring it. The ADA also requires that applicants be told how to request an accommodation to the process, which means your posting or application flow should say so before the tool runs.

New York City: Local Law 144

Enforced since July 2023, Local Law 144 applies to any “automated employment decision tool” used to substantially assist or replace discretionary decision-making about candidates for jobs in New York City. There is no small-employer carve-out. If the law applies, you need three things: an independent bias audit conducted within the past year, a public summary of that audit’s results, and notice to candidates at least ten business days before the tool is used, including what job qualifications it assesses and how to request an alternative process.

The definition matters. A tool that produces a score, a ranking, or a rejection is squarely inside it. A tool that extracts facts from a résumé and leaves the judgment to a person is, on the statute’s own terms, a harder fit; but that reading has not been tested in court, and an employer with New York City roles should get a view from counsel rather than rely on a vendor’s interpretation, including ours.

Illinois: two laws, one of them new this year

The Artificial Intelligence Video Interview Act has applied since 2020. It is narrow: if you use AI to analyse a recorded video interview, you must tell the applicant beforehand, explain how the AI works and what it evaluates, obtain consent, restrict who sees the video, and delete it within 30 days of a request. A 2022 amendment adds demographic reporting for employers that rely solely on AI to decide who advances to an in-person interview.

The broader change is HB 3773, which amended the Illinois Human Rights Act effective 1 January 2026. It makes it a civil rights violation for an employer to use AI in recruitment, hiring, promotion, discipline, or discharge in a way that has a discriminatory effect on a protected class, and it bars the use of zip codes as a proxy for one. It also requires notice to applicants and employees when AI is used for those purposes. The Illinois Department of Human Rights is writing the rules on what that notice must contain; until they are final, a plain written notice in the posting and the application flow is the conservative course.

Colorado: the AI Act, now effective June 2026

Colorado’s SB 24-205 was the first comprehensive state AI statute. Its effective date was pushed from February to 30 June 2026 in a 2025 special session, and further amendment is possible, so check the current text. As enacted, it treats any AI system that is a substantial factor in an employment decision as “high-risk.” Deployers must use reasonable care to avoid algorithmic discrimination, keep a risk-management programme, complete impact assessments, notify candidates that an AI system is in use, and, on an adverse decision, explain the reason and offer a chance to correct the data or appeal to a human. Deployers with fewer than 50 employees are exempt from some of the programme and assessment duties if they do not train the system on their own data and use it as the developer intended, but the notice and anti-discrimination duties still apply.

Mobley v. Workday: the vendor is not a shield

Derek Mobley alleged that he applied to more than a hundred jobs at companies using Workday’s screening tools and was rejected by each, and that the tools had a disparate impact on the basis of age, race, and disability. In July 2024 the federal court in the Northern District of California allowed the disparate-impact claims to proceed, accepting the theory that a vendor whose software performs a function the employer would otherwise perform can be liable as the employer’s agent. In May 2025 it conditionally certified a nationwide ADEA collective of applicants aged 40 and over going back to 2020.

Nothing has been decided on the merits, and the facts alleged concern tools that recommended and rejected candidates. But two lessons already stand. Vendors can be sued directly, so the good ones now care about what their tools do. And employers who bought those tools are the other party in every one of the underlying rejections.

What “the AI reads, your team decides” means for compliance

Every rule above turns on the same question: does the tool make or substantially shape the decision? Scores and rankings do; they are the thing the bias audit examines and the thing a disparate-impact claim measures. This is why Hireware Screen returns facts and structural flags, never a score. It extracts skills, work history, years of experience, education, and stated work authorization, checks five structural flags with the evidence for each, and marks whether a résumé meets the required criteria you defined. It does not order the pile and it does not reject anyone. A person does that, with the evidence in front of them.

Two caveats, stated plainly. A meets-required check is only as defensible as the criteria you set; “ten years of experience” for a role that needs three is an age-impact problem whoever applies it. And keeping a human on the decision reduces your exposure; it does not remove your duty to notify candidates where a state or city requires it. The flags, in particular, deserve human reading: an employment gap is a fact worth asking about, not a reason to decline.

A practical checklist

1. 1

   Notice

   Tell candidates, in the posting and the application flow, that software assists with screening, what it looks at, and how to request an accommodation or an alternative process. Required in NYC, Illinois, and Colorado; sensible everywhere.

2. 2

   Human review

   A named person reviews every advance and every decline. The tool informs; it does not decide. Write this down as policy so it survives staff turnover.

3. 3

   Audit trail

   Keep the criteria you set, the output the tool produced for each résumé, and who made the call. If a question arrives two years later, you want to reconstruct the decision, not remember it.

4. 4

   Retention

   Federal rules require keeping application records for at least a year (longer for federal contractors). Set a retention period, apply it, and make sure the tool’s export and deletion behaviour match it.

5. 5

   No protected-class inference

   Confirm the tool does not infer age, race, sex, disability, or their proxies (graduation year, zip code, name) and does not use them in any check. Ask the vendor in writing.

6. 6

   Criteria review

   Before each search, check that every required criterion is job-related and set at the level the role actually needs.

When to involve counsel

Get an employment lawyer’s view before you start if any of the following is true: you hire for roles located in New York City, Illinois, or Colorado; you are a federal contractor; you plan to use any tool that scores, ranks, or auto-rejects; you hire at a volume where selection-rate statistics become meaningful (roughly a few hundred applicants a year for a single role type); or a candidate has already asked how their application was evaluated. The cost of an hour of advice is small against the cost of restructuring a process after a charge is filed.

For everyone else, the checklist above, applied consistently, puts a small business in a better position than most large ones. If you want to see how a read-but-never-decide screen fits into a complete search, how it works walks through the seven-day process, and pricing sets out the three ways to engage.