Screening
Your ATS Knockout Questions May Already Be Regulated AI
An ATS filter can count as AI under at least one state's hiring law with no AI product bought: none of the definitions turn on procurement. Illinois reaches any machine-based system that infers from its input how to generate predictions, recommendations or decisions, and California reaches any computational process that makes or facilitates an employment decision, so a resume-ranking feature your vendor enabled by default sits inside both. New York City's test is narrower, and a knockout rule you wrote can sit outside it while staying inside federal selection law.
The takeThe question teams ask first is which law applies. The move that settles more, and costs nothing, is an inventory: every place in the funnel where software orders, filters, hides or excludes a candidate, vendor features included. Most teams cannot produce that list on request, which is exactly why they feel confident about scope. A classification resting on an unwritten inventory is not a legal position. It is a guess that has not been tested yet, and it fails the first time somebody asks for the list.
Where Olive fits
Open a role and see what the work shows
No inventory of screening software tells you whether a candidate works well with AI, so Olive assesses the person instead: a 40-to-60-minute occupational assignment done with an AI assistant, returned as six findings with a timestamped excerpt behind each one. The candidate is granted the identical report, free, on every tier.
Rank your shortlistWhich laws reach a tool you never bought?
All the ones that matter here, because none of them are written around a transaction. Illinois defines artificial intelligence as a machine-based system that, for explicit or implicit objectives, infers from the input it receives how to generate outputs such as predictions, content, recommendations or decisions 1. California defines an automated-decision system as a computational process that makes or facilitates a decision about an employment benefit 2. Neither definition mentions a vendor.
Both then name the thing you already run. California's rules give examples, and one of them is screening resumes for particular terms or patterns; the same regulation treats an agent acting for the employer, a vendor operating the system included, as an employer under the Act 2. Illinois, effective January 1, 2026, makes it a civil rights violation to use AI that has the effect of discriminating on a protected basis, bars zip codes as a proxy, and adds a duty to notify employees that AI is being used 1.
Read those two together and the procurement question dissolves. What matters is what the software does to a person and what a person then does with the output. A feature that arrived in a release note does that just as thoroughly as one that arrived with a contract, and it does it under the same definition.
One caution about Illinois: the statute delegates the timing, circumstances and means of notice to Department of Human Rights rulemaking, so the practical shape of that duty is not in the bill you can read today.
Start with an inventory, not with a legal question
Because you cannot classify what you have not listed, and the list is almost never what the contracts say it is. Give someone two hours and a login. Have them walk the funnel screen by screen, from the application form to the offer, and write down every point where software puts candidates in an order, hides some of them, tags them, or ends the application without a person reading it.
Six places that reliably turn something up:
1. The application form itself. Required fields, eligibility questions, and any answer that closes the application immediately. 2. Knockout and screening rules. Written by your team, and often written years ago by someone who has left. Whether knockout questions still filter anything useful is a separate question worth asking at the same time. 3. Search and matching. Keyword search over the candidate database, similarity to a past hire, a fit percentage on the card. 4. Sorting and default views. The order the queue opens in is a decision about who gets seen while attention is fresh. 5. Vendor features enabled by default. Summaries, recommended candidates, auto-tagging, silver-medalist suggestions. 6. Anything downstream that feeds back. Scheduling tools, assessment integrations, and sourcing add-ons that write a rating into the record.
Write one line per item: what it produces, and what a recruiter does with that output in practice rather than in policy. That second half is where classification actually happens, and it is why the same product can be in scope at one employer and out at another.
If the walk turns up a keyword filter nobody has revisited, it is worth knowing that the filter is probably not doing what it used to. What replaces a keyword filter once every resume matches it is the practical version of that problem.
Is a hand-written knockout rule outside all of this?
Under New York City's rule, usually yes. Under federal selection law, no. Local Law 144 reaches an automated employment decision tool, which the city describes as software that uses machine learning, statistical modelling, data analytics or artificial intelligence, helps an employer make an employment decision, and substantially assists or replaces discretionary decision-making 3. A deterministic rule a person wrote generally uses none of those techniques, so the audit and notice duties do not attach.
That is a real and useful narrowness, and it is also the trap. The Uniform Guidelines define a selection procedure as any measure, combination of measures, or procedure used as a basis for any employment decision, covering the full range of assessment techniques through informal or casual interviews and unscored application forms 4. A knockout question is squarely inside that. Where a selection procedure produces adverse impact, the validation burden follows, and no city classification changes it.
So a rule can be simultaneously outside the city audit regime, inside California's ADS definition because it is a computational process facilitating an employment decision, and inside the federal Guidelines as a selection procedure. Those three answers are not in conflict. They are three different questions that teams routinely collapse into one.
The exposure sits with the innocuous-looking screen rather than the conspicuous one. A vendor's AI feature comes with a sales process, a security review and someone's name on it. A five-year-old requirement of a bachelor's degree in the knockout section has none of that, applies to everyone, and has never been validated against the job. For a fuller reading of the city test itself, how to tell whether a tool counts as an AEDT works through the three conditions.
Write the classification down before anyone asks for it
One short paragraph per item in the inventory, dated and signed by a named person. What the tool produces, what a human does with it, which definitions you concluded it falls inside and outside, and why. That document is among the first things requested in an inquiry or a complaint, and a conclusion assembled afterwards reads exactly like one assembled afterwards.
Four things make the paragraph worth having:
- It names the actual output. Write what the screen produces in the words a recruiter would use: an ordered list with the bottom sixty hidden, a percentage on the card, a parsed contact block. Classification runs on that sentence.
- It describes what reviewers do. If they open the top of the list and stop, the output is doing the deciding whatever the process document says.
- It says what would change the answer. A vendor toggle, a workflow change, a new default. Set a calendar reminder against it.
- It records who signed and when. A dated position is a considered one. An undated one is a memory.
Two things worth doing alongside it. First, do not assume a vendor's own classification transfers to you: an employer that administers a selection procedure can be answerable for it even where an outside vendor built it, and can be answerable for the acts of agents including software vendors given authority to act on its behalf, which is how the EEOC read Title VII in guidance it issued in 2023 and removed in January 2025 5. Read that as the agency's position at the time rather than as current federal guidance, because it is no longer published.
Second, if the inventory turns up a scoring feature that has been running for a while, the useful next step is measurement rather than argument. How to run an adverse impact audit when the vendor holds the data covers what to ask for and what to do when the answer is no. Confirm any classification with counsel before you rely on it.
Common questions
Does it count as AI if the rule was written by a person?
It depends which definition you are applying. A deterministic rule someone wrote is generally not derived from machine learning or statistical modelling, so it usually falls outside New York City's automated employment decision tool test. California's definition is wider: a computational process that makes or facilitates an employment decision covers a rule as readily as a model. And the federal Uniform Guidelines never asked about technology at all, treating any measure used as a basis for an employment decision as a selection procedure. One tool, three answers, all of them capable of being correct at once.
Our ATS vendor says none of their features are regulated. Is that enough?
No. The duty sits with the employer using the tool, and the classification turns partly on how your team uses the output, which the vendor cannot see. Get the vendor's assessment in writing, because it is useful evidence and a useful thing to point at later, then write your own against your own workflow. Where a vendor is wrong about its own product, the EEOC's 2023 position was that an employer administering the selection procedure could still be liable; that guidance came down in January 2025 and no decided case has tested the point.
Do these laws apply if we hire outside New York, Illinois and California?
Some of them reach you anyway, because each rule has its own geographic trigger and none of them is where you are headquartered. New York City's turns on the job rather than the applicant: an office in the city at least part time, or a fully remote role whose associated location is a city office, with notice going to candidates who are city residents 3. Illinois binds employers operating in Illinois. California's rules sit inside FEHA, which covers employers with five or more employees. The federal Uniform Guidelines carry no geographic limit inside the United States. Design against the widest rule touching a role you actually post, and take the edge cases to counsel.
Where do resume parsers fall?
On either side, depending on what comes out. A parser that reads a file and fills form fields has concluded nothing about the person, so most definitions do not reach it. A parser that assigns a match category or a fit number, and whose output determines who is seen first or seen at all, produces exactly the kind of prediction or classification the rules describe. The same product can change classification when a customer switches a feature on, which is why the inventory has to record the configuration and not just the product name.
If a screen is in scope, does that mean we have to stop using it?
No. None of these regimes ban automated screening. New York City requires a bias audit within the prior year, a posted summary and advance notice to the candidate. Illinois prohibits use that has a discriminatory effect and requires notice. California's rules make an employer's anti-bias testing relevant evidence without mandating it. What changes is the paperwork, the notice and the record you can produce later, not whether the screen is permitted.
How long should the inventory take?
A first pass is an afternoon for one recruiting team on one system, and it does not need a lawyer in the room. What takes longer is the second half: watching what recruiters actually do with each output, which usually needs a few live sessions rather than a policy document. Redo it whenever the vendor ships a release affecting the hiring workflow, and make somebody the named owner of that check, because otherwise it happens once.
References
- 1. HB3773 Enrolled (Public Act 103-0804), amending the Illinois Human Rights Act ilga.gov Supports the Illinois definition of artificial intelligence as a machine-based system that infers outputs from its input, the effects standard, the zip-code proxy ban and the notice duty.
- 2. Final Unmodified Text of Proposed Employment Regulations Regarding Automated-Decision Systems (Attachment B), 2 CCR sections 11008, 11008.1 calcivilrights.ca.gov Supports the automated-decision system definition, the named example of screening resumes for terms or patterns, and the agent-as-employer clause.
- 3. Automated Employment Decision Tools: Frequently Asked Questions nyc.gov Supports the narrower New York City test and the audit, posted summary and advance notice duties that follow a positive classification.
- 4. 29 CFR Part 1607 - Uniform Guidelines on Employee Selection Procedures (1978), sections 1607.16(Q) and 1607.3(A) govinfo.gov Supports the claim that a hand-written knockout rule is a selection procedure under federal law, as are informal interviews and unscored application forms.
- 5. Select Issues: Assessing Adverse Impact in Software, Algorithms, and Artificial Intelligence Used in Employment Selection Procedures Under Title VII of the Civil Rights Act of 1964, Question 3 (archived capture, 2025-01-25) web.archive.org Supports the point that an employer administering a vendor-built selection procedure may still answer for it, quoted as the EEOC's 2023 position and noting the document was removed in January 2025.
5 sources, numbered by first appearance. How Olive sources claims
General guidance for hiring teams. What works at one company and one volume may not transfer to yours.
Olive assesses how a person works with AI. It does not detect AI-written documents, and it never produces a score, a ranking, or a match percentage for a person. Candidates read the same report the employer reads.