AI hiring laws

Most AI hiring laws put the main duties on the employer using the tool, so for each one we set out what it asks, what Vettika provides today, and what you still need to do.

Read this first

This is a plain summary, not legal advice, and not a complete list. Laws change and their start dates move. Check the current text and get your own advice before you use Vettika to hire.

In every case below, you are the employer, or the agency hiring for one, and you make the decisions. Vettika is the tool. We hold no certifications: no SOC 2 report, no ISO certification and no independent bias audit yet. Our roadmap shows what we plan.

What Vettika gives you everywhere

These are in the product today, wherever you hire:

Candidates are told an AI asks the questions and scores the answers, and agree before they start.
People decide. A score never advances or rejects anyone by itself.
Every candidate for an interview gets the same questions and the same rubric.
Each score shows the quotes behind it, checked against the transcript, so a reviewer can disagree with evidence.
No video and no recording. We keep the transcript.
Candidates can type instead of speaking at any point.
Owners and admins can delete a candidate's data, and our data processing addendum sets out how we process data for you.
An audit log of workspace actions, and a record of which rubric scored each report.

What it asks: a lawful basis for processing candidates' data, clear information before you collect it, and respect for their rights to access, correct and erase it. Article 22 gives people the right not to be subject to a decision based solely on automated processing that significantly affects them, such as rejecting a job application, except in narrow cases and with safeguards like human review. A data protection impact assessment is often needed for this kind of evaluation.

What Vettika provides: no decision is made by AI alone, so a person on your team is always involved. We act as your processor under our data processing addendum, which covers security, subprocessors, breaches, deletion and transfers.

What you must do:

Choose and record your lawful basis, and tell candidates how their data is used, including that AI assesses their answers.
Make sure a person with real authority reviews each outcome, and doesn't just accept the score.
Carry out a data protection impact assessment where one is needed.
Answer candidates' requests to see, correct or delete their data. We'll help.
Put a transfer tool in place with us before sending EU data to the United States. Our DPA explains how.

EU: the AI Act

What it asks: AI systems used to recruit or select people, including to evaluate candidates, are high-risk under Annex III, point 4(a). Providers, who build the system, must meet requirements on risk management, data, documentation, logging, transparency, human oversight and accuracy, and pass a conformity assessment. Deployers, who use it, have their own duties under Article 26. Separately, the Act bans emotion recognition in the workplace.

When: Regulation (EU) 2026/1744 set the date these high-risk rules apply to Annex III systems at 2 December 2027. Other parts of the Act apply on other dates.

What Vettika provides: as the provider, we'll have duties of our own when the high-risk rules apply, and we haven't completed a conformity assessment yet. Today the product gives you human decisions, the same questions for everyone, scores tied to quotes, and a record of which rubric scored each report. It doesn't attempt emotion recognition.

What you must do as a deployer:

Use the system according to its instructions, and give oversight to people with the competence and authority to overrule it.
Make sure the questions and rubric you write are relevant to the job.
Monitor how it works for you, and keep the logs under your control.
Inform workers and their representatives where it's used at work, and tell candidates a high-risk AI system is used in decisions about them.

UK: UK GDPR and the Data (Use and Access) Act 2025

What it asks: the UK GDPR mirrors the EU rules on lawful basis, transparency and rights. The Data (Use and Access) Act 2025 changes the UK rules on automated decisions. Where a significant decision is made with no meaningful human involvement, people must be told, be able to make representations, get a person to step in and contest it. Check which parts of the Act are in force when you hire.

What Vettika provides: a person makes every decision, with the transcript and quoted evidence in front of them. Our DPA covers the UK, including the UK addendum for transfers.

What you must do: the same as for the EU GDPR above, and follow the Information Commissioner's Office guidance on automated decision-making.

New York City: Local Law 144

What it asks: employers and employment agencies may use an automated employment decision tool to screen candidates for jobs in the city only if it had a bias audit by an independent auditor within the year before use, a summary of the results is public, and candidates got notice at least 10 business days before use. The notice must say which job qualifications and characteristics the tool assesses, and explain how to ask for an alternative selection process or an accommodation.

What Vettika provides: no independent bias audit of Vettika has been done, so you can't rely on one from us. Adverse-impact reporting and an independent audit are on our roadmap.

What you must do: work out with your own adviser whether the law covers your use. If it does, don't use the service for New York City jobs until the audit, publication and notice requirements are met.

Illinois: AI Video Interview Act and HB 3773

The Artificial Intelligence Video Interview Act covers employers who ask applicants to record video interviews and use AI to analyze them. It requires notice, an explanation of how the AI works, consent, limits on sharing the videos, and deletion on request. There's no video in a Vettika interview, so it may not apply, but check with your adviser.

HB 3773 (Public Act 103-0804) amended the Illinois Human Rights Act from 1 January 2026. It makes it a civil rights violation for an employer to use AI in hiring decisions in a way that discriminates against protected classes, or to use zip codes as a stand-in for them, and requires employers to give notice when they use AI for these decisions.

What Vettika provides: the same rubric for everyone, scores tied to what was said, and people who decide. We don't use zip codes or addresses in scoring.

What you must do: give Illinois candidates and employees the notice the law requires, and check your questions and outcomes for discriminatory effect.

Colorado: the Colorado AI Act (SB 24-205)

What it asks: developers and deployers of high-risk AI systems that make, or are a substantial factor in making, consequential decisions, including employment decisions, must use reasonable care to protect people from algorithmic discrimination. Deployers need a risk management policy, impact assessments, notices to the people affected, and a way to explain and appeal an adverse decision.

When: SB 25B-004 moved the start of these requirements to 30 June 2026. Check whether they've been changed again before you rely on a date.

What Vettika provides: the facts about how the system works, on this page and our AI transparency page, to help with your assessment, and human decisions on every candidate.

What you must do: decide with your adviser whether your use is covered, and if it is, put the policy, assessment, notices and appeal route in place.

California: CCPA and CPRA

What it asks: businesses covered by the California Consumer Privacy Act must give job applicants a notice at collection and honour their rights to know, correct and delete their data. Rules from the California Privacy Protection Agency on automated decisionmaking technology took effect in 2026 and cover significant decisions about employment, including pre-use notices and rights to opt out or appeal and to access information. Some duties have later compliance dates. California's civil rights rules also cover automated decision systems in employment.

What Vettika provides: we act as your service provider under our data processing addendum, and help you answer applicants' requests.

What you must do: check whether you're a covered business, give the notices, and check which automated decisionmaking duties apply to you and from when.

Nigeria: Nigeria Data Protection Act 2023

What it asks: a lawful basis for processing, clear information for the people concerned, data protection impact assessments for high-risk processing, rules on transfers out of Nigeria, and the rights of data subjects. Section 37 gives people the right not to be subject to a decision based solely on automated processing that significantly affects them, with exceptions and safeguards. The Nigeria Data Protection Commission enforces the Act and may require some controllers to register with it.

What Vettika provides: no decision is made by AI alone, and our data processing addendum sets out how we process data for you. Data is processed in the United States and the other places on our subprocessors page.

What you must do: choose your lawful basis, tell candidates how AI is used, check whether you need an impact assessment or to register with the Commission, and make sure the transfer to the United States is allowed for your case.

Everywhere else

Other places have their own rules, and more are coming. Wherever you hire, a few habits cover most of them: tell candidates an AI is involved before they start, offer another way to be assessed, keep a person in every decision, check outcomes across groups, and keep only the data you need.

Candidates who want an adjustment or a route without AI can read our page on asking for another way.

Questions about how the product works for your compliance: support@vettika.com.

Sources

Last updated November 4, 2026