Review copy. Publication details are being completed. This copy is not available for contractual acceptance.
Version 2026-09-14.2 · Permanent link to this version · U.S. legal documents
Version history
- Version 2026-09-14.2 — Prepared 2026-09-14 · Draft — not published
- Version 2026-09-14.1 — Prepared 2026-09-14 · Draft — not published
- Version 2026-09-13.1 — Prepared 2026-09-13 · Draft — not published
1. Supported U.S. hiring use
This guide covers private employers and staffing agencies hiring for U.S. jobs, with assessments completed while candidates are physically in the U.S. Government and government-contractor hiring are outside the supported scope. Citizenship does not determine a person's assessment location.
Evidize provides application analysis, qualification summaries, scores, rankings and temporary interview security checks. Analysis and ranking can run automatically. A valid clear security check can release meeting access automatically. A security signal is not proof of cheating, a qualification failure or a hiring decision.
2. Evidize's duties and your organization's duties
Evidize: handles the legal duties that apply to its own development, processing, collection and services. These can include privacy notices, lawful data use, security, provider information, request assistance and preservation. Its duties depend on its actual activity and legal role, not simply the word “vendor” in a contract.
Your organization: handles its lawful hiring criteria and decisions, required candidate notices and permissions, accommodations, audits, assessments, responses and employment records. A particular duty applies only if the relevant law covers your organization and use. Evidize's general documents do not perform that work.
In the portal: the hiring-location section in requisition and interview creation links to state guidance. The existing Terms, Privacy and Help links provide service information and support. This is information, not an employer compliance approval process. You can use your organization's established procedures; there is no general requirement to upload its legal assessments or audits to Evidize.
3. Using the information
Review the rules for the actual job, candidate and feature. Keep job and associated-office locations accurate where supplied. A company's headquarters alone does not determine coverage: for example, a New York employer's collection of a California resident's information may be subject to California privacy law.
The state guide preserves the sources, coverage limits and unresolved questions for all 50 states and Washington, D.C. It explains responsibilities without certifying that every municipal rule or your particular use has been cleared.
4. Requirements by topic
Privacy information and permissions
The legal requirement: give notices required for the actual collection and use. Some activities require separate permission. Reading a privacy notice does not mean agreeing to a commercial contract or consenting to monitoring, recording, biometrics or a consumer report. California collection duties.
What Evidize does: provides its own Privacy Notice and handles permissions required for its actual collectors through the relevant collection flow. It preserves the applicable document and permission evidence. Candidate notice templates are optional drafting help, not completed employer notices.
What your organization must do: deliver its own applicable notice with its correct purposes, contacts and other required facts, through a lawful channel and at the required time. A general footer link is not a substitute where the law requires notice before a particular activity.
New York City audits and advance notices
The legal requirement: employers and employment agencies using a covered NYC automated employment decision tool must meet the independent audit, publication, advance notice and information-request rules. This is not a duty imposed on an ordinary software vendor. NYC requirements and vendor responsibility.
What Evidize does: explains the relevant product behavior and provides available service information. It does not certify an employer's audit, verify the employer's publication or run its notice waiting period as an employer compliance service. If Evidize itself acts as a covered employer or agency, its own duties must be assessed separately.
What your organization must do: determine whether its actual use is covered and, if so, obtain the qualifying independent audit, publish required information, give timely notice and respond to required information requests. Use the state guide for the separate conditions and deadlines. No statutory audit “pass” threshold is supplied by LL144.
Lawful assessment and hiring decisions
The legal requirement: selection practices must meet applicable discrimination and disability laws. An AI tool does not remove those duties or create a universal legal requirement that every AI result receive human approval. Federal selection guidance; California employer-agent responsibility.
What Evidize does: keeps missing or unclear evidence distinct from confirmed failure and supplies the available underlying evidence and limitations. Its own unlawful conduct cannot be excused by assigning responsibility to the employer. Any required provider or reporting-company controls apply to the actual feature.
What your organization must do: choose lawful criteria, assess whether the results are appropriate for the job, provide accommodations and complete review, reconsideration or validation when the applicable law requires it. Do not present a score or security signal as a verified fact it does not establish.
Access problems and accommodations
The legal requirement: covered hiring processes must provide reasonable accommodations as required by disability law. Security and hiring decisions are different activities. Disability and AI guidance.
What Evidize does: provides the existing assistance route and technical support for the screening it operates. An approved technical accommodation must work in the actual assessment or detector; a note alone cannot fix a continuing block. An alternative participation arrangement does not turn an unclear security result into a clear result.
What your organization must do: arrange the required accommodation or participation alternative for its hiring process and respond through its normal contact channels. Contact Evidize where a technical change or service information is needed.
Requests and provider assistance
The legal requirement: rights and deadlines depend on the organization, data and law. A processor can owe assistance without becoming responsible for deciding the employer's hiring appeal. California expressly requires covered service-provider assistance with requests, risk assessments and cybersecurity audits. California regulations, sections 7050–7051.
What Evidize does: uses its request and support process and applicable data controls to address its own obligations or assist the responsible organization. Submitting a form does not automatically correct every output, erase all copies or decide an appeal.
What your organization must do: handle requests it is responsible for, provide lawful instructions and tell Evidize when assistance is needed. The employer remains responsible for its response and copies it controls.
Records and deletion
The legal requirement: applicable preservation and privacy rules govern which records must be retained and which may be deleted. California employment recordkeeping can apply to an employer or covered agent; selling software alone does not establish that role. California recordkeeping; federal employer recordkeeping.
What Evidize does: restricts access by organization and uses the applicable retention, deletion, export and preservation controls for records it holds. It retains its own legally required records and assists with lawful customer instructions. The Privacy Notice describes limits and company procedures still being completed.
What your organization must do: retain its required records, provide preservation instructions when needed and protect downloaded or externally held copies. An export does not establish that every copy has been deleted.
Developer information and separate capabilities
What Evidize must do: provide developer information and direct material-update notices where it is covered, including the Colorado duties from January 1, 2027 and the Connecticut requirements for covered deployments from October 1, 2027. See the provider-information document. Any applicable California training-data publication is Evidize's development duty, described in the training-data guide.
What your organization must do: give its own required deployment notices and handle its consequential decisions. Provider updates can be emailed without requesting acceptance; this does not replace a separate permission or agreement the law actually requires.
Recording, video analysis, biometric identification, credit or criminal-background screening and general AI companions are not added by these documents. Templates for separate activities do not enable them. Existing integrity reports and collectors still need classification under the laws governing what they actually do.