The asymmetry
The conventional account of artificial intelligence regulation and small organizations is that compliance burdens fall hardest on those least able to bear them, and that thresholds and exemptions exist to correct the imbalance. The account is half right, and the half it gets wrong is the half that matters.
Small employers and nonprofits are, in fact, exempted from a good deal of the emerging apparatus. They are exempted almost entirely from the wrong part. The exemptions run to the disclosure, assessment, and documentation regimes, which is to say the parts of the framework that would have compelled an organization to look closely at the automated tools it is already using. They do not run to the underlying employment discrimination statutes, which apply at fifteen employees and carry a private right of action, individualized theories of liability, and no requirement that the plaintiff prove the employer was sophisticated.
An organization excused from the process that would have found the problem and fully exposed to the consequence of not having found it.
The net effect is an organization excused from the process that would have found the problem and fully exposed to the consequence of not having found it. Novara Consulting Group’s position is that this asymmetry, rather than cost, is the defining governance risk for organizations under roughly two hundred employees, and that the standard advice to small employers, which is to wait until a threshold is crossed, is close to the worst available strategy.
What small organizations are actually exempt from
The threshold structure is real and worth mapping, with the caveat that most of these instruments are recent, several are not yet in force, and one is still in rulemaking, so applicability should be confirmed against the operative text rather than against summaries including this one.
Colorado’s Senate Bill 24-205, signed in May 2024 and scheduled to take effect February 1, 2026, imposes duties on developers and deployers of high-risk systems used in consequential decisions including employment, and carries a conditional exemption for deployers with fewer than fifty full-time employees. The California Consumer Privacy Act reaches businesses meeting its coverage tests, principally annual gross revenue above twenty-five million dollars or the handling of substantial volumes of consumer data, and its definition of a covered business turns on operation for profit, which places most nonprofits outside it altogether. The California Privacy Protection Agency has advanced proposed regulations on automated decision-making technology into formal rulemaking, and those rules would carry the same coverage thresholds if adopted as drafted. At the federal level, the Uniform Guidelines on Employee Selection Procedures provide simplified recordkeeping for users with fewer than one hundred employees.
Read together, an organization of thirty people using an off-the-shelf applicant tracking system in most jurisdictions is under no obligation to conduct an impact assessment, publish a bias audit, provide a pre-use notice, or maintain the component-level impact records a larger employer must maintain. It will not be inspected. Nobody will ask.
What they are not exempt from
Title VII of the Civil Rights Act and the Americans with Disabilities Act apply to employers with fifteen or more employees. The Age Discrimination in Employment Act applies at twenty. These statutes contain no sophistication defense, no small-employer safe harbor for automated tools, and no provision reducing an employer’s obligations because it purchased rather than built the system that produced the decision.
The purchase does not transfer the liability either. The employer remains the party making the employment decision, and the developing case law suggests the vendor may be added as a defendant rather than substituted for one. In July 2024 the Northern District of California allowed claims against a screening software vendor to proceed on the theory that the vendor acted as an agent of the employers using its tools, which unsettles the assumption that responsibility can be allocated cleanly to whichever party wrote the code. That the tool came in a box, and that nobody at the organization understood it, is not a defense. It is an admission.
The disability theories deserve particular emphasis, because they are the ones a small organization is most likely to face and least equipped to defend. A failure-to-accommodate claim arises when a candidate asks for a modification to an assessment and does not receive it. A screen-out claim arises when a selection criterion tends to exclude an individual with a disability and the employer cannot show the criterion is job-related and consistent with business necessity. Neither requires comparative statistics across an applicant pool. Neither requires an expert to reconstruct a model. Both are proved on an individual record consisting of a request, a response, and an outcome, which is a record the employer creates and holds. The complaint filed in March 2025 with the Colorado Civil Rights Division and the EEOC (Equal Employment Opportunity Commission) on behalf of a Deaf and Indigenous employee, concerning an automated video interview and a denied captioning request, follows exactly this shape. Both companies deny the allegations, and the shape of the claim is instructive regardless of outcome.
These claims are inexpensive to bring, and their cost to defend does not scale down with the size of the defendant. The EEOC’s 2023 consent decree with iTutorGroup, resolving allegations that software was configured to reject applicants above specified ages, settled at $365,000. That figure is survivable for a large employer. It is existential for most nonprofits.
Why the small organization is structurally more exposed
Size does not merely fail to protect. It actively worsens the position, for four reasons that compound.
The first is configuration. A small organization runs the vendor’s defaults. It did not select the screening criteria, did not set the thresholds, and frequently does not know which features of its applicant tracking system are scoring candidates, because several were enabled at implementation and never reviewed. When the question arrives asking who configured the criteria and on what basis, the honest answer is that nobody at the organization did.
The second is leverage. The controls that actually protect an employer are contractual: score retention, version identification, reproduction of a historical decision, access to validation evidence, cooperation in an investigation. These are negotiated at acquisition, and a thirty-person nonprofit signing a standard order form has no realistic ability to negotiate them. The single most effective defense is the one small organizations are least able to obtain.
The third is the record. The federal recordkeeping obligations at 29 C.F.R. Part 1602 require preservation of application records and, once a charge is filed, preservation of everything relevant until final disposition. Reconstructing why a particular applicant was rejected eighteen months ago requires that the score, the inputs, and the system configuration in force at the time were retained. Small organizations rely on the vendor’s data practices, which typically discard scores after ranking, and they learn this at the moment they need the data.
The fourth is the absence of anyone whose job this is. Larger employers have counsel, a compliance function, and a privacy officer who will at least ask. A small organization has an executive director, an office manager who administers the applicant tracking system, and a board that has never discussed it.
The nonprofit case is worse
Nonprofits carry an additional exposure that has no corporate equivalent, and it is not legal.
An organization whose mission concerns disability, accessibility, equity, or workforce development, and which screens applicants through an automated assessment that penalizes atypical speech, interpreted communication, or nonstandard affect, has a mission-integrity problem that survives any legal outcome. It does not matter whether the claim is meritorious. The allegation alone is coherent in a way it would not be against a manufacturer, because the organization’s public position supplies the contradiction. Funders read those allegations. So do the communities the organization serves, and so do the staff who joined because of the mission.
This is not hypothetical reasoning applied to an unlikely scenario. Disability services organizations, community health centers, legal aid providers, and public agencies use the same commercial applicant tracking systems and the same automated video interview products as everyone else, generally on the entry-level tier, generally on defaults, and generally without anyone having examined what the assessment measures. The sector most likely to employ disabled people, and most credible when it speaks about doing so, is running the same unexamined screening infrastructure as the sector it criticizes.
The guidance that would have helped just disappeared
There is a further difficulty specific to this moment. Small organizations do not read regulations; they read plain-language guidance, and the plain-language guidance on this subject was removed in January 2025.
The EEOC took down its artificial intelligence materials, including the May 2022 technical assistance on the Americans with Disabilities Act and the use of software, algorithms, and artificial intelligence to assess job applicants and employees, along with its companion summary written for workers. The Department of Labor noted that the AI and Inclusive Hiring Framework published in September 2024, developed specifically to help employers deploy these tools without excluding disabled candidates, may no longer reflect current policy. Those documents were the accessible entry point for exactly the organizations described here.
The statutes did not change. What changed is that the free, readable explanation of what they require is gone, and the organizations that relied on it most are the ones with no budget to replace it with counsel.
What is actually achievable at this scale
The recommendation is not a compliance program. A thirty-person organization cannot operate one and should not try. The following is achievable in a few days of an existing staff member’s time and captures most of the available protection.
- Inventory what you are actually running. List every point in the hiring process where software evaluates, ranks, filters, or scores a candidate, including résumé parsing, knockout questions, assessment modules, and chat-based prescreening. Include features enabled by default at implementation. Most organizations doing this for the first time find at least one system nobody knew was scoring.
- Turn off what you cannot explain. If no one can state what a feature measures and why it matters to the job, the correct action is to disable it, not to document it. This option is available to small organizations and largely unavailable to large ones, and it is the single highest-yield step on this list.
- Ask the vendor five questions in writing. What does this feature score. Do you retain the score and the configuration, and for how long. Can you reproduce a specific decision from eighteen months ago. What validation evidence exists for what it measures. What accommodation pathway does the product support. Retain the answers. A refusal is also an answer and is worth keeping.
- Build the accommodation pathway before you need it. Name the person who decides, set a turnaround, ensure an alternative assessment exists that does not disadvantage the person who uses it, and state its availability on the assessment itself rather than on a careers page. This is the cheapest control in this document and it addresses the claim you are most likely to face.
- Keep the accommodation file. Every request, who decided, what was provided, what the outcome was. It will be produced if a charge is filed, and it should be reviewed by you first.
- When the contract renews, ask for retention and reproduction terms. You may not get them. Asking and being refused is materially better than not asking, both as a matter of governance and as a matter of what the record shows about what the organization knew.
Conclusion
The proposition that small organizations deserve access to the tools larger ones have is correct as far as it goes, and the technology has genuinely lowered the cost of capable hiring infrastructure. What has not been lowered is the standard against which the resulting decisions are judged, and what small organizations have been given is not a lighter standard but a lighter paper trail.
The exemptions are real, and they are exemptions from being asked. They are not exemptions from the answer. An organization of thirty people that cannot say what its screening tool measures is in the same legal position as an organization of thirty thousand that cannot, with fewer resources to resolve it and, if it is a mission-driven organization, considerably more to lose when the question is asked in public.
References
- American Civil Liberties Union, ACLU of Colorado, Public Justice, and Eisenberg & Baum LLP. Complaint filed with the Colorado Civil Rights Division and the U.S. Equal Employment Opportunity Commission, March 19, 2025.
- Americans with Disabilities Act of 1990, Title I, 42 U.S.C. § 12112; Title VII of the Civil Rights Act of 1964, 42 U.S.C. § 2000e; Age Discrimination in Employment Act, 29 U.S.C. § 621.
- California Consumer Privacy Act, Cal. Civ. Code § 1798.140, definition of covered business; California Privacy Protection Agency proposed regulations on automated decisionmaking technology, advanced to formal rulemaking November 2024.
- Colorado Senate Bill 24-205, signed May 17, 2024, scheduled effective date February 1, 2026.
- EEOC v. iTutorGroup, Inc., No. 1:22-cv-02565 (E.D.N.Y.), consent decree August 2023.
- Mobley v. Workday, Inc., No. 3:23-cv-00770 (N.D. Cal.), order on motion to dismiss, July 2024.
- New York City Local Law 144 of 2021, Automated Employment Decision Tools.
- U.S. Department of Labor and Partnership on Employment & Accessible Technology, AI and Inclusive Hiring Framework, September 2024.
- U.S. Equal Employment Opportunity Commission, The Americans with Disabilities Act and the Use of Software, Algorithms, and Artificial Intelligence to Assess Job Applicants and Employees, EEOC-NVTA-2022-2, May 12, 2022; removed from the agency website January 27, 2025.
- Uniform Guidelines on Employee Selection Procedures, 29 C.F.R. Part 1607, including § 1607.15A(1); EEOC recordkeeping requirements, 29 C.F.R. Part 1602.