Marisol is the VP of Talent Acquisition at a 1,200-person logistics company that fills roughly 4,000 hourly and corporate roles a year. Two years ago she rolled out an AI resume-ranking tool to manage the volume. It worked, until a rejected candidate posted on LinkedIn asking why an algorithm had screened her out of a warehouse-operations role she was qualified for. The post drew a few hundred comments before it faded, but it taught Marisol something no compliance memo had: regulation is one force reshaping hiring, and societal expectation is the other, and the second one moves faster than any statute. Candidates, advocates, and investors now hold an opinion about how she uses AI, and that opinion shapes whether the best people apply. This lesson is the playbook she built afterward.

What Candidates Now Expect

The candidate who posted on LinkedIn was not asking Marisol to abandon AI. She was asking three reasonable questions: was an automated tool used, what did it evaluate, and could a human review the result. Those three questions now sit at the center of candidate expectations, and they map almost exactly onto what regulators have begun to require. That overlap is the most useful thing on this page, because it means the work of meeting candidate expectations and the work of meeting legal obligations are largely the same work, done once.

Transparency is the first expectation. Top candidates increasingly assume that some part of the funnel is automated, and they want to be told. Marisol learned that a single sentence on the application page, stating that an automated tool helps screen resumes and that candidates may request human review, did more for trust than any glossy careers page. The placement matters as much as the wording: disclosure that appears before someone applies is information, while disclosure that appears in a rejection email is an excuse. Candidates do not punish you for using AI. They punish you for hiding it.

Fairness is the second. Candidates expect that the tool evaluates skills and experience, not proxies for protected characteristics. A resume ranker that quietly rewards graduation year, zip code, or a specific employer can encode age, race, or class bias without anyone intending it, which is what makes proxies dangerous: none of them is a protected characteristic, and each of them stands in for one. When Marisol audited her tool, she found it was scoring continuous employment heavily, which penalized candidates who had taken parental or caregiving leave. That is the kind of finding candidates and advocates surface publicly when employers do not surface it first.

The third expectation is recourse. Candidates want a path back to a human. A process that ends in a silent algorithmic rejection feels like a closed door. A process that offers human review, even if few candidates use it, feels fair. Marisol added a one-click request-review option and found that only about 3 percent of screened-out candidates used it, but the option itself changed how the process was perceived. That low take-up rate is worth planning around rather than being surprised by, because it means the operational cost of offering recourse is usually far smaller than the reputational cost of refusing it. What the option does require is a named reviewer, a stated turnaround, and a real second look rather than a form reply, since a review path that returns the same answer without evidence of a human having read anything is worse than no path at all.

A Worked Example: Marisol and NYC Local Law 144

Marisol's company has a corporate office in New York City, which means a concrete legal floor sits underneath these expectations. New York City Local Law 144 governs automated employment decision tools, or AEDTs, used to screen candidates for positions in the city. It requires two things that turn candidate expectations into obligations. First, the tool must undergo an independent bias audit within one year before use. The audit calculates selection rates and scoring rates across sex and race or ethnicity categories and reports impact ratios. Second, the employer must publish a summary of the most recent audit and notify candidates at least ten business days before the tool is used, telling them an AEDT will be used and what characteristics it assesses.

Notice how closely the two obligations track the three candidate questions. The published audit summary answers what the tool evaluates and how it performs. The advance notice answers whether an automated tool is being used, and it does so early enough to be information rather than an apology. The law does not by itself supply the third answer, the path back to a human, which is why Marisol treats the review option as her own addition rather than a compliance item.

Here is the audit math Marisol's vendor ran for one corporate role. Out of applicants, 500 men and 400 women were scored by the tool. The tool advanced 150 men, a selection rate of 30 percent, and 90 women, a selection rate of 22.5 percent. The impact ratio is the lower rate divided by the higher rate: 22.5 divided by 30, which equals 0.75. Work through each step yourself rather than reading the final figure, because the intermediate rates are where the story is. The raw advance counts, 150 against 90, look like a gap explained by the larger male applicant pool. It is only once both are expressed as rates against their own group that the difference survives, and that is exactly what the impact ratio is designed to expose.

That 0.75 figure is the four-fifths rule in action, a benchmark drawn from EEOC enforcement practice. An impact ratio below 0.80, or four-fifths, signals potential adverse impact and demands investigation. Marisol's 0.75 result was below the line. It did not automatically prove illegal discrimination, but it was exactly the signal she needed: the tool was advancing women at three-quarters the rate of men, and she had to understand why before she could keep using it. The continuous-employment weighting she found in the audit was the likely culprit, and reweighting it brought the ratio above 0.80 on the next quarterly check. The lesson she drew is that Local Law 144 is not a ceiling. It is a structured way to deliver exactly what candidates already expect: an audited tool, a published result, and advance notice of what is being assessed.

Why Hiring Is a Brand Statement

Every candidate who passes through Marisol's funnel walks away with an impression, and at 4,000 hires a year against perhaps 40,000 applicants, that is tens of thousands of impressions annually. Candidates who experience a fair, transparent process tell peers and reapply for other roles. Candidates who experience a process that feels opaque or biased tell peers too, and they tell them louder.

The asymmetry matters. A smooth experience earns a quiet recommendation. A bad experience earns a public post, a review on an employer-rating site, and a story repeated in professional networks. Marisol began treating the rejection experience as carefully as the offer experience, because the rejected candidate is the larger group by far and the one most likely to shape the brand. Clear communication, a stated reason category, and the option for human review turned silent rejections into respectful ones. Note what a stated reason category is and is not: it is a truthful, general account of why an application did not advance, not a detailed critique that invites argument and creates a record nobody intended to write.

This is why the careers reputation of a company is increasingly tied to how it uses AI. A strong fairness practice is not just risk management. It is a recruiting advantage that compounds, because the candidates you treat well become the source pool for roles you have not posted yet. That compounding runs in both directions, which is the part leaders underestimate. A funnel that produces tens of thousands of poor impressions a year is not merely failing to build a pool; it is actively building the opposite, and no amount of employer-brand spend at the top of the funnel outruns what the bottom of it is doing.

Activist and Advocacy Pressure

Beyond individual candidates, organized advocacy groups now scrutinize hiring AI directly. Civil rights organizations, disability-rights advocates, and worker coalitions file complaints, publish research, and amplify candidate stories. The single LinkedIn post that worried Marisol was a preview of what a coordinated campaign could do, and the difference between the two is mostly a matter of whether anyone with an audience decides your case is worth building on.

What makes an employer attractive as an example is rarely the existence of a problem, since every automated screening process has questions attached to it. It is the inability to answer. An organization that cannot say which tools it uses, what each one assesses, or when any of them was last tested supplies the story with its most damaging element, which is the impression that nobody was watching. The resilient posture is therefore not to avoid scrutiny but to be ready for it, and readiness here is documentary rather than rhetorical.

Disability, Accommodation, and the ADA

Disability advocacy deserves particular attention because it intersects with the Americans with Disabilities Act. The ADA and EEOC guidance warn that automated tools can unlawfully screen out candidates with disabilities, for example a video-interview tool that scores speech patterns and disadvantages a candidate with a speech disability, or a gamified assessment that a candidate with limited motor function cannot complete. Advocates watch for exactly these failures, and the legal exposure is real: the employer, not just the vendor, carries ADA responsibility.

Read those two examples closely, because they share a structure worth generalizing. In each, the tool measures a behavior that is a genuine proxy for capability in most candidates and a pure artifact of disability in some, and it does so without ever asking. Nothing in the model is aimed at disability, and nothing in it can tell the difference either. That is why the fix is procedural rather than statistical. Marisol added a clear accommodation path beside any assessment, letting candidates request an alternative format before they were ever scored. The timing is the whole point: an accommodation offered after a score exists is a remedy for a decision that has already been made, while one offered beforehand prevents the decision from being made on the wrong basis. Place the request beside the assessment, describe what alternatives exist, and make asking cost nothing in terms of how the application is subsequently treated.

Building the File Before Anyone Asks for It

Marisol assembled an audit trail covering four things: which tools are in use, what each one evaluates, when each was last bias-tested, and what accommodation paths exist. That list is short enough to maintain and complete enough to answer most of what a journalist, an advocate, a regulator, or an internal executive will ask on a bad day. An organization that can answer an advocate's questions in a day rather than a month is far harder to make an example of, because the story that was going to be about an unaccountable system becomes a story about a company that knew what its systems did.

Keep the file current rather than assembling it under pressure, and give each entry an owner and a date. The date is what turns the file from a description into evidence, since "last bias-tested" with no date attached tells a reader only that someone once intended to test it. Strong fairness practices are the best defense against activist pressure precisely because they remove the thing campaigns are built around. Reconstructing all of this during a live inquiry is possible, and it takes exactly the weeks you do not have while the question sits unanswered in public.

Investor and Stakeholder Expectations

The pressure does not stop at candidates and advocates. Investors increasingly treat responsible AI as part of governance, the G in ESG. When Marisol's company went through a funding round, the diligence questionnaire asked whether automated hiring tools were audited for bias and whether the company had an AI governance policy. Responsible AI had become a value signal, and a missing answer was a flag.

What is instructive is how little those questions asked for. Neither one required a sophisticated program; both required that something exist and be describable. A company with audited tools and a written policy answers in two lines. A company without them either says so, which invites follow-up, or writes something aspirational, which invites a harder follow-up later. The same two questions tend to appear in customer security reviews and enterprise procurement, so the artifact that satisfies an investor usually satisfies several other requesters, which is a reason to write it properly once.

Cross-Border Obligations: GDPR and the EU AI Act

Geography widens the obligations further. Marisol's company recruits in Europe, which brings two frameworks into play. Under the GDPR, candidates have rights regarding automated decision-making, including the right not to be subject to a decision based solely on automated processing where it produces significant effects, and the right to meaningful information about the logic involved. In practice this reinforces the human-review path Marisol already built, and it raises the standard for it: a review path that exists on the page but never results in a human actually reconsidering an outcome does not satisfy a rule about decisions based solely on automated processing.

The EU AI Act goes further still, classifying AI systems used for recruitment and candidate evaluation as high-risk, which carries obligations around risk management, data governance, transparency, and human oversight. A tool that is merely convenient in one market can be a high-risk system in another. Marisol designed her governance to the stricter standard so she would not have to maintain two playbooks, and the reasoning is operational as much as ethical. Two standards means two disclosure texts, two review workflows, and a recruiter somewhere deciding which set of rules a given applicant falls under, which is precisely the kind of judgment call that produces the incident you are trying to avoid.

Designing for Where Expectations Are Heading

The clearest pattern across candidates, advocates, investors, and regulators is that expectations only ratchet upward. What is a leading practice this year becomes the baseline next year. Transparency is moving from differentiator to default. Bias auditing is moving from a New York City rule to a widely expected norm. Candidate audit rights and accommodation paths are following the same path, and the direction of travel has been consistent enough that betting against it is a strange bet to make.

Marisol's design principle is to govern to the standard she expects in three years, not the one required today. That means assuming candidates will be told whenever AI is used, assuming every screening tool will need a current bias audit, and assuming a human-review path will be expected everywhere, not only where a statute compels it. Building to the future standard is cheaper than retrofitting under pressure, and it is the difference between leading the conversation about fair hiring and being made an example in it. The economics are worth stating plainly: a disclosure sentence and a review workflow designed calmly cost a few weeks of someone's attention, while the same two things designed during a public incident cost that plus legal time, executive time, and whatever the story does to your applicant flow.

Anti-Patterns

Disclosure that arrives too late to be disclosure. The careers site says nothing, and the first mention of automated screening reaches the candidate in the rejection notice, or in a policy page nobody reads before applying. It happens because legal review of application-page copy is slow and because nobody wants to depress the top of the funnel. What goes wrong is that the same sentence which reads as openness before an application reads as a confession afterward, and a candidate who learns how they were screened only after being screened out has been given a grievance rather than information. The counter is a plain sentence on the application page itself, stating that an automated tool assists screening and that human review can be requested, placed where it is seen before anyone invests effort.

Treating Local Law 144 as the ceiling. The bias audit is commissioned, the summary is published, the ten-business-day notice goes out, and the file is closed for the year. It happens because a statute is a finite, checkable thing and expectations are not. What goes wrong is that the law's requirements are narrower than what candidates and advocates already expect: the audit is point-in-time, it covers the categories the law names, and it says nothing about a path back to a human. An employer fully compliant in New York can still be the subject of an entirely fair complaint about a tool used elsewhere in the same funnel. The counter is Marisol's framing, that the law is a structured way to deliver what candidates want, and that everything it does not reach is still yours to answer for.

Reading the impact ratio as a verdict rather than a signal. The audit returns a number, and the organization either relaxes because it cleared 0.80 or concludes that a figure below it proves discrimination. It happens because a single number with a bright line attached is easier to act on than a finding that requires interpretation. What goes wrong runs both ways: a result under the line is treated as a legal conclusion rather than as the prompt to investigate that it is, while a result over the line ends inquiry into a tool that may still be scoring proxies nobody has examined. The counter is the discipline Marisol applied to her own 0.75, which was to treat it as the signal that sent her looking for the mechanism, and to keep looking on a quarterly cadence after the reweighting brought the number back above the threshold.

Accommodation as a remedy instead of an option. The assessment runs, the candidate scores poorly because the format was the barrier rather than the capability, and accommodation is offered only if they know to ask afterward. It happens because accommodation is filed mentally alongside appeals, which are things that happen after decisions. What goes wrong is that the score already exists and now has to be explained away, the candidate has already had the experience of failing, and the employer, who carries the ADA responsibility rather than the vendor, has a documented adverse outcome produced by a format it chose. The counter is to place the request for an alternative format beside the assessment, before scoring, and to make asking cost nothing.

Running two standards because two markets allow it. The strict disclosure, review, and oversight practices apply to European applicants; a lighter process applies everywhere else. It happens because meeting the strictest requirement everywhere looks like paying for compliance you do not owe. What goes wrong is that someone has to decide which regime each applicant falls under, at speed, in an ATS, and the cost of maintaining two disclosure texts and two review workflows quietly exceeds the cost of running one good one. The reputational asymmetry finishes the argument: nobody has ever been praised for applying weaker fairness practices in the jurisdictions that permitted it.

Practice

• Answer the three questions from a candidate's seat. Apply to one of your own open roles and record, at each step, whether you could tell that an automated tool was involved, what it evaluated, and how you would reach a human. Then fix the earliest point at which the answer was unavailable, since that is where the candidate's impression forms.
• Write the disclosure sentence and place it. Draft one sentence stating that an automated tool assists screening and that human review may be requested. Decide where it sits so it is seen before effort is invested, and get it reviewed by whoever owns legal language, so the version that ships is the one you wrote rather than the one that survives an argument later.
• Recompute your own impact ratio by hand. Take one role and one tool. Count applicants and advances for each group, express each as a selection rate, then divide the lower rate by the higher one. Compare the raw counts with the rates and note which of the two would have prompted you to investigate, because that difference is the argument for computing ratios at all.
• Hunt for proxies in your scoring. List every feature your tool is known to weight, and for each one ask what it stands in for. Give particular attention to continuous employment, graduation year, zip code, and named employers. Where you cannot get the list from the vendor, record that you asked and what you were told, because the absence is itself a finding.
• Design the recourse path end to end. Specify how a candidate requests review, who performs it, within what turnaround, what the reviewer actually sees, and what the candidate receives. Then pressure-test it against a low take-up rate and a spike, because both are survivable and only one is planned for.
• Build the four-line readiness file. Which tools are in use, what each evaluates, when each was last bias-tested with the date attached, and what accommodation paths exist. Name an owner per line, then ask that owner to answer an advocate's likely question from the file alone, and time how long it takes.

Reflection

• If a rejected candidate posted about your process tomorrow, which of their three questions could you answer publicly within a day?
• Which feature in your screening is doing the most work, and what does it stand in for?
• Where in your funnel does a candidate first learn that an automated tool is involved, and is that before or after they have invested effort?
• Are you running one standard across your markets, and if not, who decides which one an applicant falls under?

Glossary

• Automated employment decision tool (AEDT). The category of system, defined by New York City Local Law 144, that computationally screens or scores candidates. The law's bias-audit, publication, and notice obligations attach to this category rather than to AI in general.
• Independent bias audit. Under Local Law 144, an audit conducted within one year before use, calculating selection rates and scoring rates across sex and race or ethnicity categories and reporting impact ratios. Point-in-time by nature, which is why it is a floor rather than a monitoring program.
• Candidate notice. The requirement to tell candidates at least ten business days before an AEDT is used, stating that it will be used and what characteristics it assesses.
• Selection rate. The share of a group's applicants who advance. The unit that makes groups of different sizes comparable, and the reason raw advance counts mislead.
• Impact ratio. The lower selection rate divided by the higher one. In Marisol's audit, 22.5 percent divided by 30 percent gives 0.75.
• Four-fifths rule. The benchmark drawn from EEOC enforcement practice under which an impact ratio below 0.80 signals potential adverse impact and demands investigation. It does not automatically prove illegal discrimination; it establishes that you must understand the cause before continuing to use the tool.
• Proxy variable. A feature that is not a protected characteristic but stands in for one, such as graduation year for age, zip code for race or class, or continuous employment for caregiving history. Proxies encode bias without anyone intending it, which is why they must be hunted rather than waited for.
• Recourse. The candidate's path back to a human. Requires a named reviewer, a stated turnaround, and a genuine second look. Take-up is typically low, which makes the option cheap to offer and expensive to withhold.
• Accommodation path. The option to request an alternative assessment format, offered beside the assessment and before scoring rather than as a remedy afterward. ADA responsibility for a tool that screens out candidates with disabilities sits with the employer, not only the vendor.
• Readiness file. The maintained record of which tools are in use, what each evaluates, when each was last bias-tested, and what accommodation paths exist, with an owner and a date on every line. What allows an organization to answer scrutiny in a day rather than a month.
• Solely automated decision. The GDPR concept covering decisions made without meaningful human involvement that produce significant effects, alongside a right to meaningful information about the logic involved. It raises the bar on a review path from existing to actually operating.
• High-risk AI system. The EU AI Act classification covering AI used for recruitment and candidate evaluation, carrying obligations around risk management, data governance, transparency, and human oversight.

Related Lessons

• Regulatory Landscape: GDPR, AI Act, Executive Orders, and Emerging Standards covers the statutory side of the pressure described here in far more detail.
• Transparency and Disclosure: Telling Candidates About AI Use develops the disclosure sentence, its placement, and what candidates should be told at each stage.
• Accessibility and Inclusion: Ensuring AI Processes Work for All goes deeper on assessment formats, accommodation, and the failure modes that create ADA exposure.
• Fairness Metrics: Defining and Measuring Bias in Outcomes explains selection rates, impact ratios, and what each measure can and cannot establish.
• Understanding Candidate Experience: What Matters in Hiring develops the rejection experience and why it carries most of the brand weight.
• Ethical Guidelines: Values-Driven Principles for AI in Talent is where the commitments this lesson assumes get written down as policy.

Closing

Marisol did not build any of this because a regulator arrived. She built it because a single candidate asked a reasonable question in public and she could not answer it quickly. Everything that followed, the disclosure sentence, the audited tool, the reweighted score, the review option, the accommodation path, and the four-line readiness file, exists to make that question answerable on any given Tuesday.

The parts that will be tempting to defer are the ones with no deadline attached. The disclosure sentence, because it depresses nothing measurable and legal review is slow. The proxy hunt, because it may find something inconvenient in a tool you already bought. The accommodation path, because nobody has requested one yet. And the readiness file, because it is only ever needed on a day you did not plan for. Each of those is cheap to build in a calm quarter and expensive to build in a loud week, which is the entire argument for governing to the standard you expect in three years rather than the one required today.

Key Takeaways

• Candidates expect transparency, fairness, and recourse. Tell candidates when an automated tool is used, ensure it evaluates skills rather than proxies for protected characteristics, and offer a path to human review. Candidates do not punish honest AI use; they punish concealment.
• Disclosure only counts if it arrives before the application. The same sentence reads as openness on an application page and as a confession in a rejection notice. Placement is part of the disclosure.
• Local Law 144 turns expectations into obligations. For automated employment decision tools used in New York City, the law requires an independent bias audit within the prior year, a published audit summary, and candidate notice at least ten business days in advance. Treat it as a floor, not a ceiling.
• Use the four-fifths rule to read your audit, and read it as a signal. An impact ratio below 0.80, the lower selection rate divided by the higher, signals potential adverse impact. A 22.5 percent versus 30 percent advance rate gives 0.75, which is a clear prompt to investigate before continuing to use the tool, not a finding of discrimination in itself.
• Hunt proxies, because nobody intends them. Graduation year, zip code, named employers, and continuous employment can encode age, race, class, or caregiving history. Marisol's continuous-employment weighting penalized parental and caregiving leave and was the likely cause of her 0.75.
• Hiring is a brand statement at scale. Every applicant leaves with an impression, and rejected candidates outnumber hires. A respectful, transparent rejection protects the brand and preserves a future source pool; a silent algorithmic one invites public criticism.
• Strong fairness practices defend against activist pressure. Maintain a readiness file of which tools are used, what they assess, when they were last tested, and what accommodation paths exist, with dates and owners. What makes an employer an attractive example is not having a problem but being unable to answer.
• Offer accommodation before scoring, not after. Automated tools can screen out candidates with disabilities through formats that measure the disability rather than the capability, and ADA exposure sits with the employer, not only the vendor. An alternative format requested beside the assessment prevents the decision; one requested afterward only disputes it.
• Investors and cross-border rules raise the bar. Responsible AI is now a governance signal in ESG diligence. The GDPR grants rights around solely automated decisions and meaningful information about the logic involved, and the EU AI Act classifies hiring AI as high-risk, so design governance to the strictest standard you operate under and run one playbook.
• Govern to the future expectation. Expectations only ratchet upward. Build assuming disclosure, current bias audits, and human-review rights will be universal baselines, because building ahead is cheaper than retrofitting under public pressure.

Frequently Asked Questions

We do not hire in New York City or Europe. Does any of this apply to us? The legal obligations do not, and the expectations do. Candidates ask the same three questions regardless of jurisdiction, advocacy groups do not organize by statute, and investor diligence questionnaires are not geographically scoped. The practical answer is to separate the two layers explicitly: know which obligations bind you today, and treat the rest as the standard you are choosing to meet. That framing also survives expansion, since the alternative is discovering that a single new office or a single European applicant has quietly changed which rules apply to a process you designed without them in mind.

Our vendor ran the bias audit and says we are covered. Are we? A vendor-run audit is evidence, not a discharge. Under Local Law 144, the obligations to use an independently audited tool, publish a summary, and give candidates advance notice are the employer's, and the ADA exposure for a tool that screens out candidates with disabilities sits with the employer rather than only the vendor. So treat the audit as an input to your own file. Confirm the date, since the requirement is an audit within one year before use. Confirm what the audit covered, since it reports on the categories the law names and will not tell you whether a feature is acting as a proxy. And confirm the publication and notice steps have actually been performed, because those are the two that vendors do not do for you.

Will disclosing that we use AI reduce our applicant volume? Marisol's experience was the opposite of what the fear predicts: a single plain sentence on the application page did more for trust than any careers-page investment, and the review option was used by only about 3 percent of screened-out candidates. Top candidates increasingly assume some part of the funnel is automated, so disclosure mostly confirms what they already believe and answers the question they would otherwise carry into the process unresolved. The volume risk that is real is the one on the other side, where a funnel producing tens of thousands of opaque rejections a year steadily degrades the pool you will need for roles you have not posted yet.

How often should we re-audit if the law only requires it annually? The annual audit is the compliance obligation; the cadence you need to run the business is usually shorter. Marisol found her 0.75 in an audit, reweighted the feature responsible, and confirmed the ratio had cleared 0.80 on the next quarterly check rather than waiting a year to find out. That pattern is worth copying because it separates the two functions: the audit certifies the tool at a point in time and is what you publish, while your own periodic recomputation is what tells you whether the fix held and whether anything has drifted since. Any change to the tool, a new model version or a reconfiguration, is a reason to check regardless of where you are in the annual cycle.