Do I Need an AI Audit? A Plain-English Guide for Business Owners

If your business uses artificial intelligence to make or influence decisions about people — who gets hired, who gets approved for a loan, who sees which ads, who gets a lease — you almost certainly need an AI audit. Multiple U.S. laws now mandate third-party audits for AI systems used in employment, housing, lending, and insurance. Even if no single law explicitly covers your exact use case today, federal regulators including the FTC and EEOC are actively enforcing existing statutes against biased or deceptive AI. The question is no longer whether AI regulation is coming. It is here.

What is an AI compliance audit?

An AI compliance audit is a structured, independent evaluation of how your artificial intelligence systems make decisions and whether those decisions comply with applicable laws. The auditor examines your AI tools for discriminatory outcomes (bias), transparency failures (are users told they are interacting with AI?), data handling practices, and overall legal compliance.

Think of it like a financial audit, but instead of reviewing your books, the auditor reviews your algorithms. They look at inputs, outputs, training data, and outcomes across protected categories like race, gender, age, and disability status.

There are several types of AI audits:

• Bias audits test whether your AI produces statistically different outcomes for protected groups. NYC Local Law 144 specifically requires this type.
• Risk assessments evaluate the potential harms of your AI system. Colorado’s AI Act requires these for high-risk systems.
• Compliance audits check whether your AI use meets specific regulatory requirements, including notice and disclosure obligations.
• Full-spectrum audits combine all of the above into a single comprehensive review.

Bottom line: An AI compliance audit is an independent review of your AI systems to determine whether they operate lawfully and fairly.

Which laws require AI audits in the United States?

There is no single federal AI audit law. Instead, a patchwork of state and local regulations, combined with federal agency enforcement actions, creates compliance obligations that vary by geography and use case. Here are the laws you need to know about.

NYC Local Law 144 — AI in hiring

New York City’s Local Law 144 has been in effect since July 5, 2023. It applies to any employer or employment agency using an automated employment decision tool (AEDT) to screen candidates or employees for hiring or promotion in New York City.

The law requires an annual bias audit conducted by an independent auditor. Results must be publicly posted on the employer’s website. Candidates must receive notice at least 10 business days before the tool is used on them. Penalties range from $500 for a first violation to $1,500 for subsequent violations, assessed per violation per day. A company screening 500 candidates without a valid audit could face six-figure exposure in a matter of weeks.

Colorado AI Act (SB 26-189) — automated decision disclosures

The Colorado AI Act was rewritten by SB 26-189 in 2026 and now takes effect on January 1, 2027. The narrowed law applies to businesses using “automated decision-making technology” in a “consequential decision” about a person, with notice and transparency obligations rather than the original high-risk duties.

Consequential decisions include:

• Employment and hiring
• Education enrollment and opportunities
• Financial and lending services
• Housing and rental decisions
• Insurance underwriting and pricing
• Healthcare services and coverage
• Government services access
• Legal services

The 2026 rewrite (SB 26-189) removed the original risk-assessment and impact-assessment duties; the focus is now consumer notice and transparency when automated decision-making technology is used. The law is enforced by the Colorado Attorney General, with no private right of action; enforcement is currently paused pending rulemaking. Check our Colorado AI Act compliance checklist to assess your readiness.

Illinois Biometric Information Privacy Act (BIPA)

BIPA is not an AI-specific law, but it has become one of the most consequential statutes for companies using AI with biometric data — facial recognition, fingerprint scanning, voiceprint analysis, and similar technologies. BIPA requires informed written consent before collecting biometric data and mandates a published data retention and destruction policy.

What makes BIPA especially dangerous is its private right of action. Individuals can sue directly, with statutory damages of $1,000 per negligent violation and $5,000 per intentional or reckless violation. Class action settlements under BIPA have exceeded $200 million. If your AI system processes biometric data from Illinois residents, a compliance audit is essential.

EEOC AI guidance — employment discrimination

The Equal Employment Opportunity Commission has made clear that existing anti-discrimination laws — Title VII of the Civil Rights Act, the Americans with Disabilities Act, and the Age Discrimination in Employment Act — apply fully to AI-driven employment decisions. An algorithm that produces a disparate impact on a protected group is illegal in the same way a human hiring manager’s discriminatory practices would be.

The EEOC has issued technical guidance stating that employers are liable for the AI tools they use, even if a third-party vendor built them. If your AI screening tool disproportionately filters out candidates of a particular race, gender, or age group, you can face an EEOC investigation and enforcement action. Conducting a bias audit is the most direct way to identify and remediate these risks before the EEOC does it for you.

FTC Section 5 — unfair or deceptive AI practices

The Federal Trade Commission uses its broad Section 5 authority to police AI practices it deems unfair or deceptive. The FTC has taken enforcement action against companies that made false claims about their AI capabilities, used AI in ways that discriminated against protected groups, and failed to disclose material AI-driven decisions to consumers.

The FTC does not require a specific audit format, but it has explicitly stated that companies are responsible for testing their AI systems for bias and accuracy. If the FTC investigates and finds that your AI system is producing discriminatory or deceptive outcomes that you never tested for, the lack of an audit works against you.

Chicago Protecting Renters Ordinance

If you operate in the Chicago rental market, the Protecting Renters Ordinance requires landlords and property managers to disclose their use of AI in tenant screening. Tenants must be notified before AI is used, and they have the right to request the specific criteria used in their evaluation. While the ordinance focuses on disclosure rather than a formal audit mandate, maintaining an audited, documented AI process is the only practical way to comply with tenant information requests and defend against discrimination claims.

Bottom line: At least six major regulatory frameworks in the U.S. create AI compliance obligations, and the trend is sharply toward more regulation, not less.

What types of AI systems need auditing?

Not every AI application carries the same legal risk. A chatbot that recommends restaurant pairings operates in a different regulatory universe than an AI system that decides who gets a job interview. Here is how to think about which systems need attention.

High-risk AI systems (audit strongly recommended or required)

• Hiring and recruitment tools: Resume screeners, candidate ranking systems, video interview analysis, automated scheduling based on candidate scoring
• Lending and credit decisions: AI-powered credit scoring, loan approval automation, risk pricing models
• Housing and tenant screening: Automated tenant scoring, rental application processing, eviction risk models
• Insurance underwriting: Automated risk assessment, claims processing, pricing algorithms
• Healthcare decisions: Diagnostic assistance, treatment recommendation engines, coverage determination tools
• Biometric systems: Facial recognition, voice analysis, fingerprint processing, emotion detection

Medium-risk AI systems (audit recommended)

• Customer service chatbots that make decisions about refunds, account access, or service eligibility
• Content moderation systems that affect user access to platforms
• Pricing algorithms that vary prices based on user characteristics
• Advertising targeting systems for housing, employment, or credit (already regulated by HUD and FTC)

Lower-risk AI systems (audit optional but prudent)

• Internal productivity tools and content generation
• Spell-check, grammar, and translation tools
• Inventory management and demand forecasting
• Search and recommendation engines for products (non-discriminatory categories)

Bottom line: If your AI system makes decisions about people’s access to employment, housing, credit, insurance, or healthcare, it falls into the high-risk category and likely requires an audit under current law.

How do I know if my business needs an AI audit?

Use the checklist below to do a quick self-assessment. These questions map directly to the regulatory triggers discussed above.

If you answered “yes” to three or more, you have meaningful compliance exposure. If you answered “yes” to questions 1 and 2 together, you are almost certainly subject to a specific audit mandate under Local Law 144 or the Colorado AI Act.

Even one “yes” to questions 5, 8, or 10 suggests significant legal risk. A single BIPA class action or EEOC investigation can cost more than years of proactive auditing.

Not sure where you stand? Run a free preliminary assessment through RunAIAudit to get a personalized risk profile in minutes.

Bottom line: If your AI touches consequential decisions about people and you have never audited it, you are operating with unquantified legal risk.

What happens if I don’t get an AI audit?

The consequences of non-compliance range from daily fines to multi-million-dollar class action settlements. Here is what you are risking.

Direct financial penalties

• NYC LL144: $500–$1,500 per violation, per day. Using an unaudited hiring tool on 100 candidates could generate $50,000–$150,000 in fines in a single day.
• Illinois BIPA: $1,000–$5,000 per violation. Class actions have produced settlements exceeding $200 million (Facebook settled for $650 million; Google settled for $100 million).
• FTC enforcement: The FTC has ordered companies to delete both the AI models and the data used to train them — an outcome far more costly than any fine.

Litigation exposure

Beyond regulatory fines, unaudited AI systems create plaintiff-friendly litigation targets. Employment discrimination lawsuits increasingly cite AI bias. Housing discrimination claims reference algorithmic tenant screening. The absence of an audit means you cannot demonstrate due diligence, which weakens your legal defense significantly.

Reputational damage

Enforcement actions and settlements are public. A single headline about your company’s biased AI hiring tool can damage your employer brand, your customer relationships, and your ability to recruit. Proactive auditing is a fraction of the cost of crisis communications and brand rehabilitation.

Operational disruption

Regulators can order you to stop using the offending AI system entirely while you remediate. If your hiring pipeline, underwriting engine, or customer service infrastructure depends on that system, a cease-and-desist order means operational disruption at the worst possible time.

Bottom line: The cost of non-compliance — fines, lawsuits, reputational harm, and forced operational changes — almost always exceeds the cost of an audit by orders of magnitude.

How much does an AI compliance audit cost?

Cost is the most common reason businesses delay auditing, but the range is wide, and affordable options exist. Here is an honest breakdown of what AI audits cost in 2026.

Law firms: A traditional AI compliance review from a law firm typically runs $5,000 to $50,000 or more, depending on scope. Large firms with dedicated AI practice groups charge at the top of this range. You get a detailed legal memo and defensibility in litigation, but the timeline is often 8–16 weeks.

Enterprise audit platforms: Large-scale audit tools designed for Fortune 500 companies charge $30,000 or more per year in licensing fees, often plus implementation and consulting costs. These are built for organizations with dozens of AI systems and dedicated compliance teams.

RunAIAudit: Our platform was built specifically for small and mid-size businesses that need rigorous, legally defensible auditing without the enterprise price tag. Plans start at $89, and you get a complete compliance assessment, bias testing, and documentation that meets the requirements of Local Law 144, the Colorado AI Act, and other applicable regulations. See our full cost comparison guide for detailed breakdowns.

Bottom line: AI compliance audits range from $89 to $50,000+, but affordable options like RunAIAudit make it possible for any size business to get audited at a fraction of traditional costs.

How does the RunAIAudit process work?

We designed RunAIAudit to eliminate the complexity that keeps businesses from getting audited. The process has three steps.

Start your AI compliance audit now and know exactly where you stand before the next regulatory deadline.

Bottom line: RunAIAudit takes you from uncertainty to documented compliance in three steps, starting at $89, with reports delivered in days.