Multi-state retail chain: documenting AI hiring across three US regimes

Context

A national specialty retailer with 1,500 corporate employees and roughly 8,000 store associates across 30 states. The company hires at high volume — 5,000 to 6,000 new associates per year — predominantly in hourly retail roles.

Two AI hiring tools were in production: Workday Recruiting for applicant tracking, scoring, and shortlist generation; Paradox for candidate engagement and pre-screening conversations. The buyer was the Chief People Officer. The trigger was the January 2026 effective dates for the Colorado AI Act and Illinois HB 3773 — the company has stores in both, and the General Counsel had read the statutes.

What we found

The retailer’s posture was, in some respects, ahead of typical mid-market: they had a NYC LL 144 bias audit from each of the prior two years, an applicant-tracking system that supported jurisdiction-tagged audit trails, and an HR analytics team comfortable with selection-rate work.

What they did not have:

• A unified posture on candidate notice. NYC LL 144 had a notice; Illinois HB 3773 required a notice in different language; Colorado SB 24-205 required a more elaborate disclosure. The notices were each being drafted on a one-off basis with no shared template.
• An appeals workflow. Colorado’s appeals requirement was new to the company. There was no defined process for a candidate to request human review of an adverse AI-influenced decision.
• Paradox-specific bias audit. The LL 144 audits had covered the Workday scoring outputs but not the Paradox conversational front end, on the (defensible-but-not-airtight) theory that Paradox did not produce simplified outputs that substantially assisted employment decisions.

What we built

We scoped the engagement to cover both tools and all three regimes, plus federal disparate-impact analysis. Deliverables:

• Conformity file structured around the Annex IV framework (used as a superset; the US regimes do not require Annex IV format) so the file would also map cleanly to a future EU AI Act in-scope hire.
• Unified candidate notice templates, one for each regime, derived from a shared core notice with jurisdiction-specific append clauses.
• Appeals workflow for Colorado that integrated with the existing Workday ticketing system: a candidate can request human review; the request routes to a designated HR reviewer; the decision is logged with reasoning.
• Bias audit framework that brought Paradox into scope. We worked with the LL 144 auditor of record to extend the audit’s methodology to cover the Paradox front end’s contribution to shortlist composition.
• Remediation roadmap for the ZIP-code-proxy risk under Illinois HB 3773. Discovery surfaced that one Workday-derived feature was effectively a ZIP-code proxy; the roadmap defined the technical remediation timeline with the vendor.

Outcome

The retailer entered the January 2026 effective dates with a unified documentation posture across the three regimes. The General Counsel moved from a defensive footing to an offensive one: the documentation posture became a procurement differentiator with two enterprise customers that asked about AI hiring practices during contract renewal.

The notice templates were adopted as the standard for all future state AI laws as they take effect.

What we’d do differently

The Paradox bias-audit extension surfaced a methodological question we had not seen before: what does a bias audit even mean for a conversational AI that does not produce a numeric score? We resolved it by auditing the output of the Paradox-to-Workday handoff (the candidates Paradox advanced to Workday review) rather than the conversations themselves. Were we engaging this client again, we would propose this methodology at kickoff rather than discovering it mid-engagement.