Illinois HB 3773 bars zip codes as protected-class proxies in hiring. EU AI Act Article 10(3) requires training data that is relevant, representative and complete, which in practice means geographic coverage. Mask the geography and the EU obligation fails. Keep it and Illinois is violated. One model configuration cannot satisfy both, and no fairness score can describe that situation, because two statutes are applying to the same hiring stack and demanding opposite things from the same feature.
We built Clarion, an AI hiring compliance overlay that sits on top of the vendor tools an employer already runs, to find out what an honest system does when it hits a contradiction like that. It ingests one vendor scoring export, computes every adverse-impact statistic in deterministic code, and fans that single audit into six jurisdiction-shaped deliverables: NYC Local Law 144, Colorado SB 24-205, Illinois HB 3773, Texas TRAIGA, California's FEHA ADS amendments, and EU AI Act Annex III. It never scores or ranks a candidate; it reads the vendor's output. The full breakdown is at https://veriprajna.com/demos/ai-hiring-compliance.
Six regulators asked six structurally different questions
Every AI-governance vendor's instinct is to produce one number, because a dashboard can hold one number and a buyer will sign off on it. The six regimes did not ask one question six times. NYC wants intersectional impact ratios and a posted public summary. Colorado wants a documented reasonable-care impact assessment and specifies no methodology at all. Texas rejects disparate impact as a standalone basis and asks about intent, which makes the statistics driving the NYC deliverable evidentiarily beside the point in Texas. The EU wants Article 10 data governance and an Article 11 technical file. California wants a records pack and a four-year retention attestation.
A single score cannot be true across all six. And the market is nowhere near reckoning with that yet: only 4.6% of 391 NYC employers had published a bias audit at all (Cornell / Data & Society / Consumer Reports, FAccT 2024), on the regime enforceable the longest.
One audit run, six deliverable rows, and not one of them green. Each row carries its own citation, its own effective date and its own required artifact. The verdicts come out mixed because the questions are.
What one of those shapes costs to actually compute
Take the NYC one. On the demo's seeded synthetic export of 1,040 candidates on one fictional requisition, scored by three simulated tools (a Workday-Spotlight-style scorer, a HireVue-style video round and an Eightfold-style match engine, all served by stubbed fixture adapters over synthetic data), the marginal four-fifths test that a vendor self-audit ships passes cleanly. Race minimum impact ratio 0.8196, sex minimum 0.8744, both above the 0.80 line. That is the real computation, and it really passes.
LL144 asks for the intersectional race by sex ratios. Against the White / Male reference cell, the Black / Female cell advances 44 of 130 candidates, an impact ratio of 0.6471. Under Benjamini-Hochberg FDR control at alpha 0.05 that cell is statistically robust (q = 0.0185), while Hispanic / Female at 0.7647 is flagged but not called significant (q = 0.1629), so a chance finding does not get counted as a win. The disparity is planted. We built the violation into the export, because an engine that has never been handed a failure is not evidence of anything.
The same synthetic screening decision, cut two ways in one dialog: the marginal table a vendor self-audit reports, and below it the race by sex grid LL144 actually requires.
The contradiction the gate refused to smooth over
The zip proxy is where six shapes stop being an inconvenience and become a contradiction. Clarion tests every feature on that same seeded export for protected-class correlation with Cramér's V. The zip_region feature scores 0.3321 against race (0.3253 bias-corrected), over the 0.2 threshold, so it is a proxy. In the same pass school_tier scores 0.0711 and clears. An engine that flags every feature is as useless to a General Counsel as one that flags none.
Then two rule packs fire on that single finding and pull in opposite directions. The Illinois pack reads HB 3773's prohibition on zip codes as protected-class proxies and requires the Illinois-safe configuration to mask geography. The EU pack reads Article 10(3) and requires training data representative enough to cover it. The policy gate has no rule for picking the more agreeable regulator, so it returns CONFLICT, and both the Illinois HB 3773 and the EU AI Act Annex III deliverables carry that status on their rows.
The reconciler then writes the memo counsel actually works from. It lays out a two-configuration path: a full geographic mask for Illinois inference, and a coarser residence feature (region rather than zip) for EU training data. If the organization insists on one configuration, leadership has to knowingly accept a named exposure, either Illinois enforcement through the Department of Human Rights or EU AI Act high-risk penalties, which reach the greater of 15 million euros or 3% of global annual turnover, a statutory maximum. The memo's fallback is to pick the regime with the larger exposure and document the accepted risk. What the engine will not do is certify "fully compliant", because a false claim of compliance is the record a plaintiff would rather find than a documented trade-off.
One entry on this run: the zip finding wired to both the Illinois and the EU rule packs. The register names both branches, puts a statutory figure on the EU one, and hands the choice to a human who is allowed to make it.
A dashboard that reads "compliant" is, in a courtroom, an exhibit. A memo that reads "you are knowingly accepting Illinois exposure or EU exposure on geography, and here is the magnitude of each" is the document that survives discovery.
Why the refusal has to be written in code
A refusal is only worth having if it cannot be argued down. Agents advise, code decides: every statistic, every threshold comparison, every conflict edge and the bundle hashing live in a deterministic engine outside the agent framework, and the LLM cannot override the gate. Six jurisdiction agents narrate each regime's verdict, the reconciler writes the conflict memo, an adversarial skeptic tries to refute every claimed pass. None of them computes a number. Model agreement is purchasable with a better prompt, so it never sets a verdict here.
That skeptic is also why three findings never reach a colour. It rejects a vendor memo claiming a scoring tool is not an AEDT, on the agent theory pending in Mobley v. Workday, and routes it to counsel for a scope attestation. It routes the video round, where word error rate runs 0.0794 on standard speech against 0.3016 on non-standard speech, to a human accessibility review, echoing the theory pending in D.K. v. Intuit/HireVue. And it routes a third-party-scored stream against the FCRA question pending in Kistler v. Eightfold: if the platform is a consumer reporting agency, every scored candidate is owed an adverse-action notice regardless of how fair the score was. Clarion detects and routes all three. It does not build the accommodation workflow or the candidate dispute path.
Those three sit in the Human Proof Queue. Separately, the run evaluates 13 obligations across the six regimes: 2 PASS, 2 FAIL, 7 NEEDS_PROOF, 2 CONFLICT. The console's headline tiles read Jurisdiction Deliverables 6, Lowest Impact Ratio 0.65, Items Requiring Human Action 9. Nine of thirteen obligations sent to a named human is a number no governance vendor puts on a slide. On this synthetic export it is what the code returned, and it reproduces exactly on every run because code set the verdicts.
The output is a SHA-256 hash-chained pre-audit package of 17 nodes, each carrying its inputs, its computation and its rule citation plus a link to the hash before it, so any edit to any node breaks the chain. The exported packet leads with an integrity line reading VERIFIED, and under it a sentence we put there on purpose: Veriprajna produces this pre-audit package, and the independent LL144 sign-off remains with DCI Consulting, ORCAA or Secretariat. We are not the auditor. We build the package so the auditor can sign it without rewriting it.
The exported packet on the synthetic run. The line naming DCI, ORCAA or Secretariat as the signing auditors sits in the header rather than a footnote, because the package is built to be handed to one of them.
What is actually coming for employers
Enforcement is moving faster than the paperwork. The NY State Comptroller found 17 potential LL144 violations in the same 32-company sample where DCWP found one, and DCWP agreed to shift to proactive enforcement (NY State Comptroller, December 2, 2025). The employers facing the worst of it will be the ones holding a single vendor audit that was never shaped like any of the six things they are asked to produce.
One check worth running this quarter: open your AEDT vendor's most recent bias audit and look for two things. Does it report intersectional race by sex ratios, or only the marginal ones? Does anything in it name a feature that two of your jurisdictions treat differently? If the audit names no such feature, that tells you nobody checked the question, rather than that your jurisdictions agree. The six deliverables, the conflict memo and the exported package are at https://veriprajna.com/demos/ai-hiring-compliance. We are still arguing internally about whether a conflict memo should recommend a branch, or stay silent on which exposure to accept and leave that call to counsel.