Building an AEDT Feature Register Across Your HR SaaS Stack: Auditing Silent AI Toggles

Why Vendor-Level Inventories Miss Eleven Active AI Features

Asking procurement for a list of "AI vendors" produces a dangerously empty spreadsheet. Compliance lives at the individual toggle level inside the HR software you bought five years ago.

Picture a 280-person software company with remote staff in Chicago, Los Angeles, Denver, and Brooklyn. General Counsel sends HR a one-line email ahead of 2027 privacy readiness: "Please send a list of any AI or automated employment decision tools we use." The HR manager checks accounts payable, sees no standalone video-scoring startup, and replies: "None—just Greenhouse, LinkedIn Recruiter, Workday, and Zoom."

Open the admin consoles of those four "ordinary" platforms for ninety minutes and count what is actually switched on. LinkedIn Recruiter is running AI-assisted candidate discovery and generative InMail ranking. Greenhouse has automated application-rule routing, resume parsing, and an optional candidate-match integration enabled by a former TA contractor. Workday Skills Cloud is inferring employee skill profiles and recommending internal promotion slates. Zoom AI Companion is summarizing candidate interviews for hiring managers. Without signing a single new contract, that company is running nine to eleven computational features across hiring, promotion, and evaluation.

Regulators have caught on to passive non-compliance. On December 2, 2025, New York State Comptroller Thomas P. DiNapoli published a sharp audit (Report 2024-N-4) of NYC's Department of Consumer and Worker Protection (DCWP). Where DCWP had reviewed 32 companies and flagged just 1 violation, state auditors inspecting those exact same 32 companies uncovered at least 17 instances of potential Local Law 144 non-compliance—triggering heightened pressure for real penalty enforcement ($500 for a first violation and $500 to $1,500 per day for subsequent violations under N.Y.C. Admin. Code § 20-872).

Four Different Legal Definitions of an "Automated" HR Tool

A feature that is exempt in New York City is frequently regulated in California and Illinois. Never apply NYC's narrow "substantially assist or replace" test as your nationwide yardstick.

Regulatory translation across people operations requires separating four distinct statutory thresholds by exact statutory text:

1. NYC Local Law 144 (Narrowest Trigger — High Procedural Burden): Under N.Y.C. Admin. Code § 20-870 and DCWP rules (6 RCNY § 5-300), a computational tool is an AEDT only if its simplified output (score, tag, classification, or rank) is used to "substantially assist or replace discretionary decision making"—meaning you rely solely on the score, weight it more than any other criterion, or use it to overrule human conclusions. When triggered for an NYC role, you must complete an annual independent bias audit, publish summary statistics on your website, and deliver candidate/employee notice at least 10 business days before use.
2. Illinois HB 3773 / 775 ILCS 5/2-102(L) (Broad GenAI Trigger — Live Since Jan. 1, 2026): Covers any employer with one or more Illinois employees. Defines "artificial intelligence" broadly—explicitly including generative AI—that generates predictions, content, recommendations, or decisions. Employers must (a) provide notice to applicants and employees when AI is used with respect to recruitment, hiring, promotion, renewal, training selection, discharge, discipline, or tenure; (b) never use ZIP codes as a proxy for protected classes; and (c) avoid discriminatory effects. Note the exact regulatory posture: although the Illinois Department of Human Rights (IDHR) temporarily paused/withdrew its proposed Subpart J notice formatting rules for further revision, the underlying statute in 775 ILCS 5/2-102(L) is actively enforceable right now.
3. California FEHA ADS Rules & CPPA ADMT (Dual Layer — Live Retention + Jan. 1, 2027 Notice): Under 2 CCR § 11008.1 (effective October 1, 2025, 5+ employees), an "Automated-Decision System" reaches any computational process that makes or facilitates human decision-making—catching resume rankers and screening filters even when a recruiter reads every shortlisted file—and mandates four-year record retention under 2 CCR § 11013(c). Layer Two arrives January 1, 2027 under CPPA's CCPA ADMT regulations (pre-use notice, access, and opt-out/appeal where ADMT substantially replaces human judgment), followed July 1, 2027 by CA SB 947 for disciplinary/termination corroboration.
4. Colorado SB 26-189 & EU AI Act Annex III(4) (Material Influence / High-Risk): Effective January 1, 2027 (having replaced SB 24-205 in May 2026), Colorado SB 26-189 covers ADMT outputs that materially influence consequential employment decisions, requiring disclosures, data correction, and meaningful human reconsideration of adverse outcomes. In Europe, Regulation (EU) 2024/1689 Annex III(4) classifies CV filtering, interview evaluation, performance monitoring, and promotion/termination AI as high-risk.

If your stack also feeds telemetry into workforce reductions, cross-check your inventory against our AI layoff selection audit guide.

How to Run a 10-Business-Day Stack Audit Without External Consultants

You can build a complete, regulator-ready AEDT register in two workweeks using system admin exports and a structured vendor questionnaire. Inspect actual toggle states rather than marketing brochures.

Execute this four-step audit cadence across AI and changing work:

• Days 1–3 — Pull Super-Admin Feature Toggles: Sit on a 45-minute screen-share with your ATS, HRIS, sourcing, assessment, and collaboration admins. Screenshot every "AI," "Labs," "Beta," "Smart Match," "Copilot," or "Skills Inference" toggle page. Turn off any unowned experimental toggle immediately—in our audits, 30% to 40% of active AI toggles were enabled by default during a vendor upgrade and nobody in HR actually uses them.
• Days 4–6 — Send the Mandatory Vendor Technical Questionnaire: Require each SaaS account rep to confirm in writing (a) whether the feature uses machine learning, statistical weighting, or generative models, (b) whether geographic ZIP codes or postal distance feed any ranking weight (barred as a proxy under 775 ILCS 5/2-102(L)), and (c) how raw inputs and outputs can be exported for California's four-year retention mandate.
• Days 7–8 — Consolidate Candidate & Employee Notices: Rather than maintaining five brittle state micro-notices, embed a clean, accurate feature-level AI disclosure on your careers portal, application confirmation screen, interview invite template, and employee handbook—adding NYC's 10-business-day lead time and bias-audit link wherever NYC Local Law 144 actually triggers.
• Days 9–10 — Wire Change-Control Gates into SaaS Renewals: Configure your enterprise admin tenants to default all new vendor AI releases to OFF (Opt-In Only) until HR and Legal sign off on a row in your register.

Copy-Ready AEDT Register Schema & Vendor Audit Demand

Paste Part A into a shared governance sheet for counsel and auditors, and email Part B to every HR SaaS customer-success manager during quarterly release reviews.

PART A — HR SAAS AUTOMATED DECISION & AI FEATURE REGISTER (COLUMNS A–L)
Col A: Feature_ID (e.g., AEDT-004)
Col B: Vendor_Platform (e.g., Greenhouse / Workday / LinkedIn Recruiter / Zoom)
Col C: Exact_Subfeature_Name & Toggle_Status (ON / OFF — Verified Date + Screenshot Link)
Col D: Computational_Method (Deterministic Rule | Statistical/ML Score | Generative LLM Summary)
Col E: Employment_Decision_Touched (Sourcing | Screening | Interview | Pay | Evaluation | Promo | Exit)
Col F: Human_Weighting_Role (Advisory Context Only | Material Influence | Substantial Replacement)
Col G: Scope_Flags (NYC_LL144 [Y/N] | IL_HB3773 [Y/N] | CA_FEHA_ADS [Y/N] | CA_CPPA_ADMT [Y/N] | CO_SB26_189 [Y/N] | EU_AnnexIII [Y/N])
Col H: ZIP_Code_or_Distance_Input_Verified_Disabled (Confirmed [Y/N] + Vendor Doc Ref)
Col I: Notice_Channel_Live (Careers Page | App Modal | 10-Day NYC Notice | Employee Handbook)
Col J: Bias_Audit_or_Disparate_Impact_Test_Date (URL if NYC LL144; Privileged Study Date if Internal)
Col K: Accommodation_ & _Human_Reconsideration_Owner (Role + SLA)
Col L: 4_Year_Record_Retention_Archive_Location (CA 2 CCR § 11013(c) Compliant Bucket)

--------------------------------------------------------------------------------
PART B — QUARTERLY VENDOR SILENT-AI DISCLOSURE REQUEST

Subject: Mandatory Regulatory Disclosure — Active AI / Automated Features on Tenant [Account ID]

Please confirm in writing within 5 business days for our compliance register under 775 ILCS 5/2-102(L), 2 CCR § 11008.1, N.Y.C. Admin. Code § 20-870, and Colo. SB 26-189:
1. List every ML, statistical ranking, skills-inference, or generative AI sub-feature currently enabled on our tenant, and confirm how to default future release toggles to OPT-IN ONLY.
2. Confirm whether any ranking, matching, or filtering model ingests candidate ZIP code, postal code, or commute radius, and how to hard-disable geographic inputs.
3. Provide technical instructions to export and retain all feature inputs, scoring criteria, and outputs for at least 4 years from each personnel action under 2 CCR § 11013(c).

Governance Ownership Across HR Ops, Recruiting, and Legal

An AI register decays within ninety days if vendors auto-enable new release features every quarter. Assign permanent quarterly sign-off across three operational seats.