Four regulators, no new law: the AI statement put the buyers of models on the hook

The week

On April 25, 2023, the heads of four federal enforcement bodies issued a joint statement on enforcement against discrimination and bias in automated systems. The signatories were Rohit Chopra of the Consumer Financial Protection Bureau and Kristen Clarke of the Justice Department’s Civil Rights Division. They were joined by Charlotte Burrows of the Equal Employment Opportunity Commission and Lina Khan of the Federal Trade Commission. Between them, those four bodies oversee consumer finance, civil rights, workplace discrimination and unfair business practices across much of the US economy.

The statement addressed a question that had been building for years. A loan applicant can be turned down in seconds by a website; a job seeker’s application can vanish before any person reads it. In both cases a piece of software made, or heavily shaped, the decision. Who is responsible if that software treats people unfairly: the company that built it, or the company that used it?

The statement did not create any new law. Instead it said existing legal authorities apply to automated systems and new technologies just as they apply to other practices, and that the agencies would use them. An “automated system,” in this sense, covers everything from a simple scoring formula to a complex AI model: any software that sorts, scores or decides about people.

The document was short, three pages, and careful about its own status. A closing note said it was for informational purposes only, was not final agency action, and created no new rights or obligations. That modesty was deliberate. A statement of enforcement intent does not need notice and comment, cannot be challenged in court the way a rule can, and commits each agency only to using powers it already had.

Each agency described what it had already done. The CFPB pointed to its guidance that complex or opaque credit models were no defense to adverse action requirements. The Civil Rights Division pointed to its statement of interest on algorithm-based tenant screening. The EEOC pointed to its guidance on the Americans with Disabilities Act and hiring software. The FTC cited a 2022 report to Congress warning that AI tools could be inaccurate and biased. It added warnings that unsubstantiated AI claims, or deploying AI without assessing its risks, could violate the FTC Act. It also noted orders requiring companies to destroy algorithms trained on improperly collected data.

It named three sources of potential discrimination. The first was unrepresentative or flawed data and datasets, since a model learns from the examples it is given. The second was model opacity and lack of access: systems so complex, or so locked away, that nobody can explain how they reach a result. The third was design and use that ignore the context in which a system is deployed, such as a tool built for one group of people being used on another.

The statement also cited earlier actions, showing this was not a new direction so much as a summary of one already under way. These included a 2022 CFPB circular on adverse action notices for complex models, which is guidance on how lenders must explain refusals, and EEOC technical assistance on AI in hiring under the Americans with Disabilities Act. In January 2023 the Justice Department and HUD had filed a statement of interest in a tenant screening case, signaling their view of how fair housing law applied to automated screening.

The surrounding months were busy. The White House had published its non-binding Blueprint for an AI Bill of Rights in October 2022. NIST released version 1.0 of its voluntary AI Risk Management Framework in January 2023. In March 2023, HUD reinstated its 2013 rule on discriminatory effects under the Fair Housing Act, and the CFPB finalized its rule requiring lenders to collect demographic data on small-business credit applications. In April, New York City adopted final rules for its law on automated employment decision tools, which required bias audits and notices, with enforcement set to begin in July. The public release of ChatGPT the previous November had pushed AI onto every board agenda.

Against that background, the statement’s choice of examples was telling. Almost none involved generative AI. The systems in view were the older, less glamorous kind: credit scores, applicant rankings, tenant screening reports, and assessments that decide who gets an interview. Those were the tools already embedded in lending, hiring and housing decisions at scale, and the ones existing law most obviously reached. The EEOC followed within weeks with further technical assistance, this time on how Title VII’s disparate impact rules applied to software used in hiring.

For the many organizations that buy rather than build their models, the message was blunt. Buying a tool does not mean buying your way out of responsibility for what it does.

Public discussion of AI regulation in spring 2023 looked ahead, to the EU’s AI Act and to possible US legislation. The joint statement looked at the present and said something narrower and more useful. Credit, employment, housing and consumer protection law already applied, and none of it had an exemption for decisions made with a purchased model.

Most banks, health systems, employers and agencies do not build the models they use. They buy them inside screening services, hiring platforms and decision engines. The statement therefore landed hardest on buyers. Its own three sources of risk mark out what a buyer has to own: the data, the opacity and the use.

The agencies that signed did not regulate the same organizations, and that matters for anyone reading the statement as a compliance document. A community bank, a credit union, a fintech lender, a hospital hiring nurses and a county screening benefit applicants all use purchased models. Each answers to a different mix of statutes and supervisors. The common thread is that none of those statutes asks who wrote the code.

What follows explains how a purchased model reaches a decision and which laws reach it, then takes the statement’s three sources of risk in turn. It closes with how testing works, who should own the work, what is at stake, how to judge readiness and the questions to ask first.

How a purchased model ends up making decisions

A model, in this context, is a piece of software that has been trained to make a prediction from data. Feed it information about a loan applicant, a job candidate or a prospective tenant, and it returns a score: the likelihood of repaying, of succeeding in the role, of paying rent on time. The organization then uses that score, alone or alongside human judgment, to decide.

Many models are trained on history. The developer shows the software thousands or millions of past cases along with what happened, and the software finds patterns that predict the outcome. That is powerful, because it can spot patterns people would miss. It is also the source of the risk, because history includes past unfairness, and the software has no way to know which patterns are legitimate and which are not.

A model trained this way resembles a new employee who learns the job entirely by watching what their predecessors did, with no explanation of why. They will pick up good habits. They will also pick up bad ones, and repeat them faithfully and at scale.

Most organizations never see this training happen. The model arrives already built, inside a product. A bank buys a decision engine that scores applications. An employer subscribes to a hiring platform that ranks résumés or scores video interviews. A property manager uses a tenant screening service. A health system or agency uses a tool to prioritize cases. In each case a vendor built the model, and the buyer plugs it into its own process. The joint statement’s point was that the legal duty stays with whoever uses the tool to make decisions about people.

Which law applies to whom

The statutes behind the statement divide by activity, not by technology. In credit, the Equal Credit Opportunity Act and Regulation B apply to every creditor, including lenders to small businesses, and require specific reasons when an application is denied. The CFPB supervises banks and credit unions with more than $10 billion in assets and many nonbank lenders. Smaller banks and credit unions answer to their prudential regulators, who examine for fair lending too. When a lender uses a consumer report, the Fair Credit Reporting Act adds its own adverse action notice, and the screening company that produced the report has duties of accuracy as a consumer reporting agency.

In housing, the Fair Housing Act reaches landlords, property managers, mortgage lenders and others whose decisions affect access to housing, and HUD and the Justice Department enforce it. In employment, Title VII and the Americans with Disabilities Act generally apply to employers with 15 or more employees, and the Age Discrimination in Employment Act to those with 20 or more. Employment agencies are covered too, which matters when a vendor screens candidates on an employer’s behalf. The FTC Act’s ban on unfair or deceptive practices covers most businesses, but banks and federal credit unions fall to their own regulators instead.

Public bodies and health systems carry further layers. Agencies and health systems that receive federal funds are subject to Title VI of the Civil Rights Act, and many health programs to Section 1557 of the Affordable Care Act. Government agencies also face constitutional due process expectations when an automated tool helps deny a benefit. A county using a model to flag benefit applications for fraud review is therefore in a different legal position from a retailer using one to target offers, even if the two models look alike.

The data

Historical data can carry past discrimination into future decisions. A model trained on past lending, hiring or tenant screening outcomes can learn patterns that disadvantage protected groups without ever seeing a protected characteristic. Location, gaps in employment history, eviction filings and certain consumer behaviors can act as proxies. A proxy is a piece of information that stands in for another: a model told nothing about race may still learn to treat neighborhoods differently, with much the same effect.

Lenders had tested for disparate impact for years, under fair lending examinations and their own compliance programs. Disparate impact is the legal idea that a practice can be discriminatory in its effects even if nobody intended it. The method is established. Compare outcomes across groups, identify which variables drive any disparity, and look for a less discriminatory alternative that serves the same legitimate purpose. Employers using hiring tools, landlords using screening services and insurers using pricing models were often newer to it.

Where the proxies hide

Proxies are rarely as obvious as a postal code. In consumer lending, the type of device used to apply, the email provider, the time of day an application arrives, or the merchant categories in a bank account can all correlate with protected characteristics. In hiring, the college attended, the gaps in a work history and even the vocabulary in a résumé can stand in for sex, age, race or disability. A gap in employment may reflect caregiving or illness as much as anything about job performance. In tenant screening, eviction filings are a known hazard because a filing is not a judgment, and filings are not spread evenly across neighborhoods. HUD warned in 2016 guidance that blanket criminal record bans in housing could have unlawful discriminatory effects.

Each of these variables can be lawful to use. The legal question is whether a variable that produces a disparity is justified by a legitimate business need, and whether a less discriminatory alternative would serve that need. A buyer can only answer that question for variables it can see, which is why a list of model inputs belongs in the contract and the model inventory.

Getting the data to test with

Testing for disparity requires knowing who belongs to which group, and many organizations are not allowed, or do not want, to ask. Mortgage lenders collect applicants’ race, ethnicity and sex under the Home Mortgage Disclosure Act. For most other credit, Regulation B generally bars creditors from asking, except under narrow exceptions such as a formal self-test. The CFPB’s small-business lending rule would add another exception. Analysts therefore estimate demographics, most often with a method that combines surname and address, known as Bayesian Improved Surname Geocoding. The CFPB has published how it uses that method in its own fair lending analysis.

Regulation B also offers some protection to lenders that look. A self-test that meets its conditions is privileged, meaning regulators and plaintiffs generally cannot use its results against the creditor, provided the creditor takes appropriate corrective action for any problems found. Employers have different sources: voluntary self-identification forms, applicant flow data that federal contractors must keep, and the EEO-1 reports that larger employers file. Agencies and health systems often hold demographic data already, for program reporting, and must decide whether using it for testing is permitted and appropriate.

The harder problem for a buyer is access. A vendor may report that its model was tested for bias on its own client base. That says little about outcomes for the buyer’s applicants, in the buyer’s markets, at the buyer’s cut-off scores. The useful contract terms are specific:

• The buyer needs decision-level outputs and the inputs behind them, meaning the score for each individual and the data that produced it.
• It needs the right to run its own disparity testing or commission it independently.
• And it needs the vendor’s commitment to support a search for alternatives if a disparity appears.

Without those terms, the organization holds the legal exposure and the vendor holds the evidence. The organization is then badly placed when an examiner, a regulator or a plaintiff’s lawyer asks for proof.

The opacity

Complex models are hard to explain, sometimes even for their developers. Some modern techniques combine thousands of variables in ways no person can follow step by step; they are sometimes called “black boxes” for that reason. That creates two problems. Internally, it is harder to see whether a model treats groups unfairly. Externally, it collides with legal duties to explain individual decisions.

Credit shows this most clearly. Under the Equal Credit Opportunity Act and Regulation B, a creditor that takes adverse action, such as declining an application, must state the specific principal reasons. The CFPB’s 2022 circular said complexity does not excuse that duty. A lender that cannot identify why a model declined an applicant should not use the model for that decision. Those stated reasons are usually delivered as reason codes: short explanations such as “insufficient length of credit history” that tell an applicant what drove the outcome.

Employment has a parallel. An applicant cannot ask for a reasonable accommodation under the ADA for an assessment whose nature and scoring nobody has explained. A candidate with a disability cannot request an alternative to a timed online game, for example, if nobody has told them what the game measures.

For buyers, opacity is partly a procurement choice. Before signing, a compliance team can ask the vendor to produce reason codes for a sample of real declines and check whether those reasons would mean anything to an applicant. It can ask whether the model changes after deployment, how the buyer is told, and whether reason codes are revalidated after each change. A model that retrains silently can make last quarter’s validation meaningless. A short validation memo for each version, kept with the model inventory, gives examiners and plaintiffs’ counsel the same answer.

How reason codes are produced

For a traditional scorecard, reasons are easy to produce. Each factor contributes points, and the reasons are the factors where the applicant fell furthest below the maximum. For a complex model, the vendor uses an explanation method that estimates how much each input pushed a particular score up or down. Shapley-value methods, borrowed from game theory, are the most common. They work reasonably well, but they have limits a buyer should understand. When inputs are strongly correlated, credit can be split between them in ways that change from one run to the next. When a model uses hundreds of inputs, the top reasons may each explain only a small part of the outcome.

The CFPB’s 2023 circular addressed a related shortcut. Lenders had long used the sample reason list attached to Regulation B. The circular said a lender could not pick the closest item on that list if it did not accurately describe what drove the model’s decision. Mapping hundreds of model inputs onto a dozen reason statements is therefore a compliance decision as well as a technical one, and the mapping itself should be documented and reviewed.

Model risk management already covered vendors

For banks, much of this had a home before 2023. Supervisory guidance on model risk management, issued by the Federal Reserve and the OCC in 2011 and adopted by the FDIC in 2017, applies to models a bank buys as well as those it builds. It expects validation of conceptual soundness, ongoing monitoring and outcomes analysis. Where a vendor will not disclose enough to validate a model fully, the guidance expects the bank to obtain what it can and compensate with its own testing. Fair lending risk was not the focus of that guidance, but the machinery it requires, an inventory, independent validation and change control, is the machinery the joint statement implied.

Credit unions, fintech lenders, employers, health systems and agencies are not bound by that bank guidance. Many have no comparable discipline at all. For them, the statement’s practical effect was to make model governance a compliance requirement in substance, even where no rule said so in words.

Accommodation as a design requirement

The EEOC’s 2022 disability guidance made a point many buyers missed. An employer can be responsible under the ADA for a hiring tool even when a vendor designed and administers it. The guidance described three main risks. A tool can fail to offer a reasonable accommodation. It can screen out a qualified applicant with a disability who could do the job with or without an accommodation. And it can ask questions that amount to disability-related inquiries. The practical response is procedural. Tell applicants which tools will be used and what they measure, give them a clear way to ask for an alternative, and make sure the vendor can deliver that alternative quickly. A request route that leads to a generic support mailbox does not count.

The use

A model sound in one setting can harm in another. A tool validated on one population may perform poorly on another. A screening score meant as one input can become a hard cut-off in practice, which magnifies its errors. A system designed without considering people with disabilities can exclude them before any human sees the application.

These are decisions the deploying organization makes, often without noticing. A vendor sells a score. The buyer chooses the threshold, decides whether a person reviews borderline cases, and decides whether applicants can ask for reconsideration or an alternative assessment. Each choice changes legal exposure. A threshold set to cut review workload by half may also double the disparity.

The controls belong with the business owner of the decision, supported by compliance and technology:

• Document the intended use and the population the model was validated on.
• Record who set each threshold and why.
• Define which cases get human review and check that reviewers do more than confirm the score.
• Monitor approval and rejection rates by group after launch, at a set interval.
• Publish a route for applicants to request review or accommodation, and track how often it is used.

How the use question differs by sector

Deployment choices look different across the organizations the statement reached. A bank or credit union usually controls the whole credit decision, so thresholds and overrides are its own. A fintech that partners with a bank to originate loans splits those choices between the two, and the bank remains answerable to its regulator for a program it may not run day to day. An employer using a hiring platform often lets the platform’s defaults decide which candidates a recruiter ever sees, which turns a ranking into a filter without anyone deciding that it should be one.

Health systems meet these tools in two places. Like any large employer, they use hiring and scheduling software. They also use clinical and operational models that prioritize patients for outreach, care management or follow-up, which raise the same questions of data, opacity and use under health civil rights law. Public agencies use models to flag benefit applications for review, to prioritize inspections and to triage child welfare reports. There, a flag that triggers extra scrutiny for some applicants and not others can delay benefits, and the affected people are often those least able to contest it.

A small-business lending model, six months in

Suppose a regional bank buys a small-business lending model. The vendor’s materials say the model was tested for bias across its client base. The bank sets an approval threshold to keep its underwriters’ workload manageable and goes live. Six months later, its fair lending team runs the bank’s usual analysis and finds approval rates differ noticeably between applicants from different neighborhoods. When the team asks the vendor for the inputs behind individual decisions, the contract turns out not to require them. When it asks why particular applicants were declined, the reason codes are generic. The bank now owns a disparity it cannot fully diagnose, in a tool it cannot easily change. Every one of those problems could have been addressed before signing: rights to decision-level data, a test of reason codes on real declines, and a disparity check at the bank’s own threshold rather than the vendor’s.

How disparity testing works in practice

Disparity testing sounds technical, but the core idea is one any executive can follow. It is the same reasoning a good auditor applies to any process: look at the results, see whether they differ between groups, and if they do, find out why.

In practice it usually runs in three steps.

1. Compare outcomes. The team takes a period of real decisions and compares rates across groups: what share of applicants from each group were approved, offered an interview or accepted as tenants. Where the organization does not collect demographic information directly, analysts often use established statistical estimation methods, which is one reason this work belongs with specialists.
2. Find the drivers. If outcomes differ, the team asks which inputs are producing the difference. Is it income, which may be a legitimate factor, or a variable such as postal code or a particular gap in work history that may be acting as a proxy?
3. Look for a less discriminatory alternative. The final step asks whether a different model, a different set of inputs or a different threshold would serve the same legitimate business purpose with a smaller disparity. If one exists and the organization does not adopt it, that choice needs a strong justification.

The measures, and their limits

Several measures are in common use, and each answers a slightly different question. In employment, the Uniform Guidelines on Employee Selection Procedures, adopted in 1978, describe a four-fifths rule of thumb. A selection rate for one group below 80 percent of the rate for the most selected group is generally treated as evidence of adverse impact. The EEOC’s 2023 technical assistance stressed that this is only a rule of thumb, and that courts may rely on tests of statistical significance instead. In lending, analysts typically compare approval rates, pricing and terms, often controlling for credit characteristics with regression models. For scores, they also compare the distribution of scores across groups, since a disparity can appear before any threshold is applied.

Small numbers are the most common trap. A credit union or a regional employer may have too few applicants in some groups for any measure to be stable, so a single quarter can show a large disparity that disappears the next. Pooling longer periods, reporting confidence ranges and agreeing in advance what result triggers investigation all help. So does keeping a record of tests that found nothing, since an examiner will ask how often the organization looked, as well as what it found.

Each step requires data. The first needs every decision. The second needs the inputs behind each decision. The third needs the ability to try changes, which usually means cooperation from the vendor. That is why the contract terms described above matter so much: without them, a buyer can see the outcome but cannot complete the analysis the law expects.

Timing matters too. A test run once before launch tells you how the model behaved on historical data. Testing at a set interval afterward tells you how it is behaving on today’s applicants, at today’s thresholds, after whatever updates the vendor has made in the meantime. Populations shift, economic conditions change and models get retrained. A result from last year is a starting point, not a permanent clean bill of health.

Finally, the results need an audience. Testing that ends in a spreadsheet nobody reads protects no one. The findings, and the decisions taken in response, should reach the business owner of the decision and, for material models, a senior risk or compliance committee.

When the test finds something

A disparity finding starts a process rather than ending one. The first step is to confirm it: check the data, the group estimates and whether the result holds over a longer period. The second is to trace it to inputs or to the threshold. The third is to test alternatives, which may mean dropping or capping a variable, adjusting the threshold, adding human review for a band of borderline scores, or asking the vendor for a different model version. Each option has a cost in accuracy, workload or vendor fees, and the decision should be recorded with the evidence behind it. Where the disparity cannot be explained by a legitimate need and no alternative works, the remaining choice is to stop using the model for that decision.

Who should own this inside the organization

The statement also changed the division of labor inside organizations. AI governance had often sat with data science or innovation teams. The statement placed it inside compliance programs that already handled fair lending, equal employment and consumer protection. Those programs had testing methods, examination experience and counsel. They often lacked an inventory of where models made or shaped decisions, and building that inventory became the first concrete task.

A model inventory is simply a list: each model the organization uses, what decision it supports, who owns that decision, which vendor supplied it, what population it was validated on, and when it was last tested. Many organizations had never assembled one, and an honest attempt often turns up scoring models hidden inside vendor products that nobody thought of as AI.

Finding the models nobody calls models

A first inventory rarely comes from asking teams which AI they use, because few people think of a vendor’s score as AI. Better sources are more mundane. Accounts payable and contract records show every subscription to a screening, scoring, ranking or decisioning service. Process maps show where a number, a color or a ranked list determines what happens next to a person. Vendor questionnaires can ask directly whether a product uses a statistical or machine learning model to score, rank or filter individuals. Each entry then needs the same fields: the decision supported, the business owner, the vendor, the inputs, the validation population, the threshold, the last test date and the contract rights available.

For a chief executive, the practical shift is to stop thinking of these tools as technology purchases and start thinking of them as decision-making delegated to a third party. You would not let an outside contractor make lending or hiring decisions without oversight, explanation or the ability to check their work. The statement made clear that regulators would not accept that arrangement either, simply because the contractor was software.

A division of labor that works

Ownership is clearest when it follows the decision. The business owner of the lending, hiring, tenancy or eligibility decision owns the model’s use, including the threshold and the review process. Compliance owns the testing method, the interpretation of results and the link to the existing fair lending or equal employment program. Technology or data science owns the integration, the inventory records and the monitoring feeds. Procurement and legal own the contract terms. A senior risk committee sees the material models at least annually and decides on any disparity the business owner cannot resolve. Internal audit checks that the cycle actually runs.

Exposure, complaints and the negotiating window

Legal exposure. Discrimination claims under credit, employment and housing law can lead to enforcement, restitution and private lawsuits. Using a vendor’s model is not a defense.

Customers and applicants. People who are refused without a meaningful reason, or excluded without a chance to ask for an alternative, become complaints, then headlines. Clear reasons and a real route to reconsideration protect both the person and the brand.

Operational efficiency, honestly measured. Models are bought to save time and improve decisions, and they often do. But savings that come from a threshold set to halve review workload need to be weighed against the disparity that threshold may create. That trade-off should be visible to leaders, not buried in a configuration setting.

Examination evidence. In a fair lending examination, or an equal employment investigation, the requests are predictable. Expect to be asked for the inventory entry, the validation and disparity testing results, the documentation behind each threshold, the mapping from model inputs to stated reasons, and the complaints received about the decision. An organization that can produce these within days is in a different position from one that must ask its vendor for them.

Negotiating position. The strongest moment to secure data access, testing rights and change notifications is before the contract is signed. Afterwards, the buyer is asking for favors.

The case that this overstates the risk

A sceptical executive in 2023 had real arguments against investing heavily. The statement itself said it created no obligations and was not enforceable. Enforcement depended on agency priorities that could change with an election, and disparate impact theory was politically contested. Vendors offered indemnities and published bias audits. And for many organizations, especially smaller ones, the volume of automated decisions seemed too low to matter.

Those arguments carry some weight, and later events gave the political one more. They are weaker than they look. The statutes do not depend on any statement, and private plaintiffs and state attorneys general can use them whatever federal agencies prioritize. Intentional discrimination and failure to accommodate disability do not rely on disparate impact theory at all. An indemnity moves some of the cost after the fact, but it does not provide the decision-level evidence needed to defend a challenge, and it rarely covers regulatory remedies such as restitution. Low volume reduces the size of the risk, not its existence. The controls proposed here, an inventory, contract terms, documented thresholds and periodic testing, are cheap compared with reconstructing them under subpoena.

Inventories, thresholds and reviewers who review

In good shape, an organization has a current model inventory; contracts that give it decision-level data, testing rights and notice of changes; reason codes tested on real cases before launch; documented thresholds with named owners; human reviewers who genuinely review; group-level monitoring at a set interval; and a published route for review or accommodation.

The usual failures:

• Accepting the vendor’s bias testing as sufficient. It describes someone else’s population and thresholds, not yours.
• Treating a score as advice while using it as a rule. If nobody ever overrides it, it is a cut-off.
• Rubber-stamp review. A human who confirms every score adds cost without adding judgment.
• Ignoring silent updates. A model that retrains without notice can invalidate every test you have run.
• Leaving AI governance with the innovation team alone. The people who know how to test for discrimination usually sit in compliance.

Every model in use needs an owner and a test

1. Where in our organization does a model make or shape a decision about a customer, applicant, employee or citizen, and do we have a complete list?
2. For each, who owns the decision, and who chose the threshold that turns a score into a yes or no?
3. Have we tested outcomes by group using our own applicants and our own thresholds, rather than relying on the vendor’s results?
4. If we declined someone today, could we tell them specific reasons they could act on?
5. When a person reviews a borderline case, how often do they disagree with the score?

With hindsight

The statement’s core claim, that old laws reach new tools, held up. What changed was who was willing to enforce it.

In April 2024 five more agencies, the Departments of Education, Health and Human Services, Homeland Security, Housing and Urban Development and Labor, joined an updated version of the statement. Their contributions showed how far the idea had traveled. HUD had cautioned housing providers in guidance about screening companies whose algorithms might carry bias or make the decision for them. The Labor Department’s contract compliance office said it would review federal contractors’ AI-based selection procedures like any other. HHS pointed to its rule under Section 1557 of the Affordable Care Act, finalized weeks later. It required covered health programs to make reasonable efforts to identify and mitigate discrimination risks in patient care decision support tools. It also pointed to ONC’s HTI-1 rule on transparency for decision support in certified EHRs. The CFPB followed its 2022 circular with another in September 2023, saying lenders using complex models must give accurate and specific reasons, rather than generic checklist items: ticking the nearest box on a standard list of reasons would not do if it did not reflect what actually drove the model’s decision.

Private litigation tested the vendor question directly. The tenant screening case the Justice Department had weighed in on settled in late 2024. The screening company agreed to pay about $2.3 million and to change how it scored applicants who used housing vouchers. In Mobley v. Workday, a federal court in California allowed discrimination claims against a hiring software vendor to proceed in 2024 on the theory that it acted as the employers’ agent. In 2025 it let the age discrimination claims proceed as a collective action. Vendors could share the exposure. Those rulings did nothing to relieve the employers and landlords using the tools, who remained answerable for the decisions made with them.

Enforcement then diverged. The October 2023 executive order on AI was revoked in January 2025, and an April 2025 executive order directed federal agencies to deprioritize disparate-impact enforcement. It also told the agencies that enforce credit, housing and employment law to review pending matters and existing consent decrees that relied on that theory. And it asked the Attorney General to consider whether federal law preempted state disparate impact rules. For organizations, that reduced one source of federal pressure without removing the underlying risk.

States stepped in. In July 2025 the Massachusetts attorney general announced a $2.5 million settlement with a student lender over AI underwriting models it said could produce disparate harm, with required model governance and testing. Colorado enacted a high-risk AI law in 2024, then used a 2025 special session to push its start date to June 2026. Illinois amended its Human Rights Act to address discriminatory use of AI in employment decisions from January 2026. New York City’s bias audit law for hiring tools took effect in July 2023, though its narrow definitions limited its reach. The common thread across these state and local measures was the one the 2023 statement had drawn: the deploying organization carried duties of its own, whoever built the tool.

The statutes the statement relied on did not change, and private litigation continued under them. Leaders most often miss this part. Federal priorities shift with administrations. The Equal Credit Opportunity Act, the fair housing and employment laws and the ADA remain on the books, and individuals and state attorneys general can still use them.

The practical conclusion is that the work the statement implied remains worth doing regardless of the federal mood: know where models shape decisions, secure the data and testing rights to check them, own the thresholds, and be able to explain a refusal. Organizations that built those habits in 2023 found the Massachusetts settlement’s requirements, model governance and testing, familiar rather than alarming.