Tool Inventory and AEDT Classification

One dated table, not a document. Five columns carry the inventory and four carry the classification, and a line that cannot be filled in is the finding rather than a gap to come back to.

Fill it in this order. The inventory comes first and the legal question comes second, because you cannot ask which rules reach a tool until you can name the tools. Starting at the legal end produces a memo about statutes and no list.

Pass one: the inventory

One line per tool. Not one per vendor, and not one per contract: a suite that both sorts applications and drafts outreach is two lines.

Three rules for filling it:

• Procurement is not the test. None of the definitions below turn on whether you bought the thing. A sorting or matching feature that shipped switched on inside software you already owned is a line on this table, and it is the line most often missing.
• Name the output, not the capability. "AI-assisted" is not an output. An ordered list of applicants, a numeric result, a tag, a pass or fail flag: those are outputs, and the classification in pass two turns on which one it is.
• Name a person in column four, not a team. The column asks who reads the output before a candidate is rejected. If the honest answer is nobody, write nobody. That answer is the reason this sheet exists.

Pass two: classify each line

Add four columns and work along each row.

Simplified output means the tool emits a score, a tag, a classification or an ordering rather than prose a person must still interpret.

Substantially assists means the output is relied on without a person independently reaching the same conclusion from the underlying material.

The regimes to test each line against, and none of them is a paraphrase here:

• New York City: A bias audit within the prior year, a public summary of its results, and notice to the candidate 10 business days before the tool is used. NYC Admin. Code 20-870 et seq., effective January 1, 2023.
• Illinois, on discriminatory effect: Artificial intelligence with a discriminatory effect, and zip codes used as a proxy, are civil rights violations; an employer must also notify the employee that AI is used. 775 ILCS 5/2-102(L), effective January 1, 2026.
• Illinois, on recorded video interviews: Before an Illinois video interview is analysed by artificial intelligence, notify the applicant, explain what it evaluates, and obtain consent; an applicant who has not consented may not be evaluated. 820 ILCS 42, effective January 1, 2020.
• California: An automated-decision system that makes or facilitates a decision about an employment benefit is subject to FEHA, and using a vendor does not put the employer outside it. 2 CCR 11008, 11008.1, effective October 1, 2025.
• Maryland, on facial templates: No facial recognition service may create a facial template during an applicant's interview unless the applicant signs a waiver stating four things in plain language. Md. Code Lab. & Empl. 3-717, effective October 1, 2020.
• Texas, and note that its standard runs the other way from Illinois: Developing or deploying an artificial intelligence system with the intent to unlawfully discriminate against a protected class is prohibited; disparate impact alone is not sufficient to show that intent. Tex. Bus. & Com. Code 552.056, effective January 1, 2026.
• The federal floor that reaches a tool no state rule names: Once a complaining party shows a particular practice causes disparate impact, demonstrate that it is job related for the position in question and consistent with business necessity. 42 U.S.C. 2000e-2(k), effective November 21, 1991.

Two more are worth knowing about precisely because they do NOT reach anything on your table, and a reader who searches will find both cited as though they do.

• A Colorado automated-decision act appears in most roundups. It was repealed and replaced before it ever applied to anyone, and the replacement does not take effect until a later date ⁵. Nothing on this table is reached by it today.
• A federal technical-assistance document on adverse impact in software is widely cited and was removed from the agency's own site in January 2025. It survives only as an archived capture, and no primary shows a replacement ⁴.

Neither is inlined here as a duty, because neither carries one. The rule this sheet follows is that a live duty arrives from the store and a retired one arrives as a citation with its status attached.

Pass three: the three things that have to exist

An inventory alone is not compliance with anything. Where pass two puts a regime against a line, three artifacts follow, and the third is the one nobody assigns.

1. The dated inventory itself, with the date it was taken and who took it.
2. A notice and a retained record for each use a regime reaches, kept for the period that regime sets.
3. One named person who can switch a use off. Not a committee and not a role, a person.

What a posted bias audit does not prove

A vendor's published summary is evidence about the vendor's data, not about your use. Before it counts on your line, ask for four things: the date, the auditor named, whether your own data was supplied, and which of your stages the audited configuration matches. A vendor audit against a configuration you do not run is evidence about a different tool.

Exit checks

What this sheet does not do

• It does not tell you whether a use is lawful. It records what you run, where it runs, and which regimes reach it, and it applies no law to your facts.
• It does not decide the classification for you. The tests are stated so you can apply them and write down the answer, including the answer that a line falls outside all of them.
• It does not evaluate a candidate, and nothing on it describes a person.
• It is not evidence of an audit. It is the list an auditor, an insurer or a regulator would start from, and the list you would otherwise assemble under time pressure.