Table of Contents
A recruiter buys a tool that ranks applicants. Operations adds a model that flags claims. A manager uses an assistant to draft performance reviews. Each team may call it a productivity tool; a regulator will look at what the output actually influenced.
An AI compliance audit trail is the record that lets you reconstruct a system’s role in a decision: its input, output, version, human review, and the notice given to the affected person. For technology and operations leaders, the practical question is simple. Can you retrieve that record when a decision is challenged?
This is an operational guide, not legal advice. Counsel should determine which rules apply to each use.
AI Compliance Rules: Four Jurisdictions, Four Triggers
European Union
- The AI Act became generally applicable on August 2, 2026.
- The AI Omnibus amendment, in force since July 27, 2026, moved Annex III high-risk obligations, including employment and creditworthiness assessment, to December 2, 2027.
- What to check: Confirm whether you are a provider or deployer. The Act can apply outside the EU when a system’s output is used there.
Illinois
- Since January 1, 2026, Public Act 103-0804 (HB 3773) has prohibited specified discriminatory AI uses in employment.
- Employers must notify employees when AI is used for covered purposes.
- The Illinois Department of Human Rights temporarily withdrew its proposed notice rules in June 2026; the statute remains in force.
Colorado
- Senate Bill 26-189 replaced the 2024 Colorado AI Act (Senate Bill 24-205).
- From January 1, 2027, unless a pending court challenge delays it, the law covers automated tools that materially influence consequential decisions.
- It requires notices and at least three years of records.
- After an adverse outcome, a person may request meaningful human review and reconsideration, to the extent commercially reasonable.
New York City
- Local Law 144 requires an independent bias audit within one year before a covered hiring tool is used.
- A public summary of the audit results must be published.
- Candidates or employees must be notified 10 business days before use.
These are separate duties. A New York City bias audit does not satisfy the EU AI Act, and a human reviewer does not remove a notice obligation. The EU’s €35 million or 7% tier applies to prohibited practices, while many other breaches fall under a €15 million or 3% tier, subject to the Act’s conditions.
Build the AI Compliance Audit Trail Around the Decision
I start with one consequential workflow, such as hiring or lending, and trace it from intake to outcome. Where does software generate a score, ranking, recommendation, draft, or automatic action? Who receives the output, and can they meaningfully challenge it?
Record five fields for each AI use:
- System and vendor
- Decision influenced
- People and locations affected
- Accountable owner
- Evidence retained
Where relevant, add the model version, criteria, output, human review, and final outcome. Ask vendors for intended use, known limitations, audit material, and change notifications, then compare their answers with your actual workflow.
The inventory often exposes a gap: an applicant score whose weighting nobody can explain, or whose version nobody can recover six months later. Fixing it can involve the contract, integration, workflow, and retention settings, not just the notice.
Test the AI Compliance Audit Trail End to End
Have counsel map the applicable rules and dates. Then standardize review criteria, log the system output, record the human action, set access and retention rules, and deliver notices inside the actual user journey.
Run a disputed decision through the process. Can you retrieve the inputs, model version, reviewer action, and notice the person received? If not, the gap sits in the process, not the paperwork.
Make the Decision Trail Inspectable
At Pumex, we treat this as process and integration work. Most of the evidence lives between systems: an applicant tracking system, a CRM, an HR platform, and the model connecting them. Start with a clean map of those systems and their data, then make one decision trail inspectable before scaling automation.
If AI outputs already cross your CRM, HR, or custom systems, talk with Pumex about building an AI compliance audit trail that follows each decision through those systems.
