SKILL.md
---
name: hiring-bias-auditor
description: "Audit hiring pipelines, job ads, screening criteria, and AI-recruiting tools for bias and legal/compliance risk (disparate impact, EU AI Act high-risk rules, PDPL/GDPR candidate data). Use when the user asks to check fairness of a hiring process, audit an AI screening tool, review adverse-impact metrics, or make recruitment compliant."
---
# Hiring Bias & Compliance Auditor
## Purpose
Recruitment AI is classified as HIGH-RISK under the EU AI Act; several jurisdictions require bias audits of automated employment decision tools (e.g. NYC Local Law 144). This skill audits processes and tools for fairness and compliance.
## Audit scope (4 layers)
1. **Language layer** — JDs and outreach: gendered/age-coded words, unnecessary requirements creating disparate impact, degree inflation.
2. **Criteria layer** — screening/interview criteria: is every criterion job-related and validated? Flag proxies (school prestige, employer brand, employment gaps, accent, address/commute).
3. **Outcome layer (statistics)** — selection rates per stage by group (where lawful to collect): apply the **four-fifths rule** (any group's selection rate < 80% of the highest group's rate = potential adverse impact → investigate). Funnel-stage analysis locates WHERE loss happens: screen, interview, offer, acceptance.
4. **Tool layer (AI/automation)** — for any AI screening/matching tool:
- Can every score be explained with evidence? (black-box ranking = reject)
- Training-data provenance & historical bias
- Human-in-the-loop: meaningful human decision point? (fully automated rejection = high risk)
- Candidate disclosure & consent; accommodation process
- Logging/audit trail retention
## Compliance quick map (verify current law per jurisdiction — do not assert without checking)
- EU: AI Act high-risk obligations (risk mgmt, data governance, human oversight, logging); GDPR (lawful basis, retention limits, automated-decision Art. 22)
- Saudi: PDPL — candidate consent, purpose limitation, retention schedule, breach notification
- US: EEOC / Uniform Guidelines, state pay-transparency & salary-history bans, NYC AEDT audit
- Retention: define candidate-data retention (commonly 6–24 months post-process) + deletion workflow
## Deliverables
- Bias audit report: findings by layer, severity (blocker/major/minor), evidence, remediation
- Four-fifths analysis table per funnel stage (when data provided)
- AI-tool compliance checklist (pass/fail per control)
- Remediation plan with owners and deadlines