Sort, Don't Rank: The Line AI Hiring Law Is Drawing

If you use — or build — software that suggests which job candidates deserve attention, the ground moved under you this year, in opposite directions at once. Federal enforcement of AI hiring rules retreated; state law and private litigation surged into the gap. And beneath the churn, every serious legal regime is converging on the same technical distinction, one most hiring-tech vendors haven't noticed they're on the wrong side of: the difference between ranking people with a model and sorting them by stated criteria.

Automated employment decision tools (AEDTs) are software systems — AI models, algorithms, statistical scoring — that make or substantially assist decisions about who gets hired, promoted, or even seen. Regulators increasingly treat the "substantially assist" part as the operative phrase: a tool that decides which candidates a human looks at is making an employment decision, whoever clicks the button.

Washington Retreated — the Risk Didn't

In January 2025, the EEOC quietly removed its AI hiring guidance as part of the new administration's rollback of prior AI policy. In April, an executive order directed agencies to deprioritize disparate-impact liability "in all contexts to the maximum degree possible," and by September 30 the EEOC had stopped investigating discrimination claims based solely on disparate impact.

It would be easy to read that as the all-clear. It's closer to the opposite. Title VII, the ADEA, and the ADA are statutes, not guidance — private plaintiffs can enforce them regardless of agency appetite, and the biggest AI hiring case in the country is doing exactly that.

The Courts Kept Moving

Mobley v. Workday began as one rejected applicant's claim that an algorithmic screening system discriminated by race, age, and disability. It is now a nationwide collective action under the ADEA, with court-authorized notice to applicants screened by Workday's tools since 2020 and roughly 14,000 people opted in by early 2026.

Two of its rulings matter more than the eventual verdict. First, the court held that a software vendor can be liable as an agent of the employers it screens for — the "we just make the tool" defense failed. Second, a March 2026 ruling rejected the argument that the ADEA doesn't cover job applicants. The intentional-discrimination claims were dismissed; what survived is disparate impact — the theory that an algorithm can discriminate at scale without anyone intending it to. That is precisely the theory federal agencies just deprioritized, proceeding anyway, against a vendor, in a collective of thousands.

The States Filled the Void

Illinois is now arguably the strictest AI-hiring jurisdiction in America. As of January 1, 2026, HB 3773 amends the Illinois Human Rights Act to prohibit employers from using AI across the full sweep of employment decisions — recruitment, hiring, promotion, discipline, discharge — where that use has the effect of discriminating against a protected class. Intent is not a defense. The law also bans using zip code as a proxy for protected classes, and requires notice to applicants whenever AI merely influences a covered decision. The Department of Human Rights is drafting enforcement rules now.

California got there three months earlier. The Civil Rights Council's automated-decision system regulations took effect October 1, 2025, and define an ADS as any computational process that "makes a decision or facilitates human decision making" about employment — language broad enough to cover every candidate-suggestion and match-scoring feature on the market. Notably, anti-bias testing counts as a defense, and its absence counts as evidence against you, with ADS records retained for four years.

New York City's Local Law 144 remains the template: annual independent bias audits and candidate notice for AEDTs used in hiring. Colorado spent 2025-26 delaying, litigating, and finally repealing and replacing its AI Act with a narrower automated-decision framework effective 2027 — churn that says less about direction than it seems, since the replacement still centers on notices, adverse-decision explanations, and human review. And in the EU, hiring AI is a designated high-risk category under the AI Act, with employment-specific obligations recently deferred to late 2027 but not diluted.

Five regimes, five vocabularies, one direction of travel.

The Line Every Regime Draws

Look at what these laws actually regulate and a pattern emerges. Bias audits presume there's a score to audit. Adverse-decision explanations presume the tool made a judgment someone must explain. Illinois' zip-code rule bans a proxy — a variable that smuggles protected traits into a model that never asks for them directly.

All of it points at the same object: the learned, opaque fit score. A model trained to predict "good candidate" absorbs whatever correlates with its training data — and resume prose is saturated with proxies. Graduation years encode age. Names encode race and gender, as decades of callback studies quantify. An embedding doesn't need to see a zip code to reconstruct one from a school name, a sorority mention, a phrasing pattern. Rank candidates by a model's similarity judgment and you have built exactly the machine these five regimes were written to catch — an unauditable gatekeeper making decisions no one can inspect, at a scale no biased human ever managed.

Now consider the alternative shape: a tool that filters on the recruiter's stated criteria — must know Kubernetes, must be authorized to work in the US — and orders results by arithmetic on those same criteria, ties broken by recency. Every input is named. Every output is explainable in one sentence. There is no model to audit because there is no model; the "audit" is reading the query. When a regulator asks why did the tool surface these ten people, the answer is the recruiter's own search, verbatim.

That's the line: sort is not rank. Sorting by criteria the human supplied keeps judgment — and accountability — with the human. Ranking by learned fit moves judgment into the tool, and with it, under every regime above, the liability.

Where We Drew It

This distinction isn't academic for us — it's load-bearing architecture. QueryQuarry's candidate search deliberately ships no fit score: recruiters' own AI assistants do the judging, with full context of the role, while the platform only filters on stated criteria and orders by how many of the recruiter's own terms match. The profile schema withholds the proxy inputs entirely — no names, no graduation years, no employment dates, no photos — so the discrimination the callback studies measure has nothing to grip. We built it that way because it's right; it turns out to also be what compliance looks like in 2026.

The vendors selling "AI that finds your best candidates" are selling the regulated object — a fit judgment nobody can explain, now with strict liability attached in Illinois, audit duties in New York, four-year paper trails in California, and a vendor-liability precedent working through federal court. The pitch was never as good as it sounded. Now it comes with discovery obligations.