The Legal AI 'Automated Decision System' Disclosure Problem

How Emerging ADS Laws Are Creating Compliance Gaps for Law Firms Using AI in Staffing, Performance Review, and Work Allocation

Research Briefing | The Legal Stack | October 12, 2026

Executive Summary

A quietly developing class of automated decision system (ADS) laws now imposes disclosure, impact assessment, and opt-out obligations on employers that use algorithmic tools to make or substantially influence consequential employment decisions. Law firms and legal departments deploying AI to assign matters, score associate performance, or screen lateral candidates almost certainly qualify as covered employers in at least one relevant jurisdiction — yet most have not conducted a self-assessment under any of these frameworks. The gap between legal exposure and institutional awareness is substantial, and enforcement posture is tightening.

The Regulatory Landscape

New York City Local Law 144 (Effective July 5, 2023)

New York City Local Law 144 is the most directly enforceable ADS employment statute currently on the books in the United States. It applies to employers and employment agencies that use an automated employment decision tool (AEDT) to "substantially assist or replace" discretionary decision-making in hiring or promotion decisions affecting candidates or employees in New York City. Covered employers must, before using such a tool: (1) commission an independent bias audit conducted by an independent auditor no more than one year prior to use; (2) publish a summary of that audit and the distribution date of the tool on the employer's website; and (3) provide advance notice to candidates or employees residing in New York City that an AEDT will be used, including the characteristics or categories of characteristics the tool assesses.

The law is enforced by the New York City Department of Consumer and Worker Protection (DCWP). Civil penalties run up to $500 for a first violation and $500–$1,500 for each subsequent violation, with each day of non-compliance constituting a separate violation and each failure to provide required notice constituting a separate basis for penalty calculation. The DCWP issued final rules in April 2023 and enforcement commenced July 5, 2023.

Critically, Local Law 144 is not limited to tech companies or large corporations. Any employer with workers in New York City — including law firms with New York offices using AI-assisted associate review or lateral screening platforms — is potentially covered if those tools meet the statutory definition of an AEDT.

The Colorado AI Act: From SB 205 to SB 26-189

Colorado's legislative approach has been more turbulent. The original Colorado AI Act (SB 205, signed May 2024) established a broad framework imposing duties on "developers" and "deployers" of high-risk AI systems — defined to include systems that make or substantially facilitate consequential decisions in employment contexts including hiring, firing, pay, and performance evaluation. SB 205 was originally scheduled to take effect on February 1, 2026, a date later postponed to June 30, 2026.

As confirmed in the verified record, SB 205 never took effect. It was replaced by SB 26-189, signed in May 2026 and effective January 1, 2027. SB 26-189 imposes transparency and disclosure obligations — including pre-use consumer notices, public disclosure of covered AI use, and the right of affected individuals to receive an explanation and to appeal an adverse decision — but removes mandatory impact assessments, risk management programs, and the duty of care that existed under SB 24-205 — but modifies certain definitions and timelines. Law firms with operations or employees in Colorado should treat January 1, 2027 as the operative compliance deadline for the revised framework.

California: CPPA Draft Automated Decision Technology Regulations

The California Privacy Protection Agency (CPPA) has been developing automated decision technology (ADT) regulations under the California Consumer Privacy Act as amended by Proposition 24. The draft regulations, which have undergone multiple revision cycles, would require businesses subject to the CCPA to provide pre-use notice when ADT is used to make or facilitate certain significant decisions about consumers — a category that the draft expansively defines to include employment-related decisions affecting California residents. Covered businesses would also be subject to opt-out rights and, for certain high-risk processing, mandatory impact assessments.

The CPPA finalized its ADMT regulations in 2025 (Board approval on July 24, 2025; effective January 1, 2026), with ADMT requirements applying from January 1, 2027. However, California's Civil Rights Council did finalize automated-decision-system regulations under the Fair Employment and Housing Act (FEHA), effective October 1, 2025, addressing AI tools used in employment decisions. Those regulations — adopted under the California Civil Rights Department's authority — are operative now and apply to employers using automated systems in recruiting, hiring, promotion, and performance evaluation in California. Law firms with California employees are already within scope of that framework.

EU AI Act: Article 6 and Annex III High-Risk Classification

Under the EU AI Act, AI systems used for employment purposes — specifically recruitment, selection, promotion, task allocation, monitoring of performance and behavior, and termination — are classified as high-risk under Annex III, point 4. Providers and deployers of such systems face obligations including conformity assessments, technical documentation, human oversight requirements, transparency to affected workers, and registration in the EU AI Act database.

The Act's general prohibitions applied from February 2, 2025. GPAI model obligations applied from August 2, 2025. However, as confirmed in the verified record, the Annex III high-risk obligations — including those covering employment-context AI — are subject to a transitional deferral. Stand-alone Annex III systems face compliance obligations from December 2, 2027, following the 2026 Digital Omnibus amendment that extended the original August 2, 2026 deadline for all such systems. Law firms operating in the EU or deploying covered AI affecting EU workers will need to map their tools against Annex III point 4 in advance of these deadlines.

Notably, Annex III point 8 — which covers AI used by or for judicial authorities — is a distinct category from the employment-context point 4 and does not provide a carve-out for law firm internal HR uses of AI.

Where Law Firms Are Exposed

The specific workflows creating legal exposure are not exotic. They include AI-assisted matter assignment platforms that allocate work based on predicted associate performance or availability; AI-powered associate evaluation tools that aggregate billing data, client feedback scores, and peer review inputs into performance rankings; lateral screening tools that parse résumés and generate ranked candidate lists; and scheduling or workload-balancing systems that factor in historical productivity metrics.

Under Local Law 144's AEDT definition, the critical question is whether the tool "substantially assists or replaces" discretionary human judgment. A tool that generates a ranked list of associate candidates for a high-profile matter — even if a supervising partner nominally makes the final call — is likely within scope if the ranking is a material input to the decision. New York City's DCWP has indicated, through its rulemaking commentary, that tools whose output is routinely followed in practice may be treated as substantially replacing discretion regardless of formal decision-authority structures.

Under Colorado SB 26-189 and California's FEHA ADT rules, the deployer — the law firm itself — bears primary compliance responsibility even when the underlying algorithmic system is built and maintained by a third-party legal technology vendor. This means that a firm licensing a matter management or associate review platform cannot outsource its compliance obligations to the vendor. Impact assessments must be conducted by or on behalf of the deployer.

Why Law Firms Have Not Assessed Themselves as Covered

Several structural factors explain the compliance gap. First, most ADS regulatory conversations within law firms have been framed around client-facing AI use — hallucination risk, confidentiality obligations under ABA Formal Opinion 512 (issued July 29, 2024), and disclosure duties in litigation. Internal HR-facing AI has received far less professional responsibility and regulatory attention.

Second, the profession's self-regulatory framing has reinforced a blind spot: bar ethics opinions on AI — including ABA Formal Opinion 512 and the growing body of state bar guidance — focus on competence, candor, and confidentiality in legal representation. None directly addresses a law firm's obligations as an employer using AI, which falls under employment law and data protection frameworks rather than professional responsibility rules.

Third, many law firm procurement teams do not classify matter assignment or performance scoring tools as "AI systems" for internal governance purposes — particularly when those tools are embedded features of larger practice management or ELM platforms rather than standalone AI products. The regulatory definitions do not care about how the tool is commercially packaged.

Fourth, the relatively recent effective dates of the operative frameworks — Local Law 144's July 2023 commencement, California's FEHA ADS rules effective October 1, 2025, and Colorado SB 26-189's January 1, 2027 deadline — mean that the full compliance timeline is still unfolding. Firms that deferred assessment pending regulatory finalization now face tightening windows.

Enforcement Posture

New York City's DCWP has the most developed enforcement posture of any U.S. jurisdiction, having commenced Local Law 144 enforcement in July 2023. California's Civil Rights Department has broad investigative authority under FEHA, and the CPPA has made automated decision technology a stated enforcement priority even before its ADT rules are finalized. The Illinois Human Rights Act, as amended by HB 3773 (signed August 2024, effective January 1, 2026), further prohibits the use of AI in employment decisions in ways that result in discrimination on protected bases — creating overlapping exposure for firms with Illinois employees.

Compliance Priorities

Firms should immediately inventory AI-assisted tools used in any employment decision workflow, map those tools against the statutory definitions in each relevant jurisdiction, assess whether bias audits are required under Local Law 144 for New York-based employees, and evaluate whether vendor contracts allocate impact-assessment and disclosure obligations appropriately. The practical test is not whether the firm thinks of the tool as "AI" — it is whether the tool's output materially influences a consequential employment decision.

The professional-responsibility community has built substantial infrastructure around AI disclosure to courts and clients. The analogous infrastructure for AI disclosure to employees and job candidates barely exists in most large law firms. That asymmetry is becoming a regulatory liability.