Dayforce

Company overview

Dayforce, Inc. is a global HCM vendor headquartered in Minneapolis, Minnesota with a co-headquarters in Toronto, Ontario. The company was founded as Ceridian in 1992, acquired the Dayforce cloud HCM product in 2012, and rebranded company-wide to Dayforce in 2024; it was taken private by Thoma Bravo affiliates on 4 February 2026 and delisted from the NYSE and TSX. Its recruiting-relevant AI includes candidate grading (an AI model that assigns letter grades and a weighted 'report card' to external applicants), AI-assisted screening and application summarization, AI-generated job descriptions, and AI agents across the wider suite. In February 2026 Dayforce announced ISO/IEC 42001 certification and NIST AI RMF attestation, and it operates an external AI Ethics Council launched in September 2025 whose members include Miranda Bogen (CDT AI Governance Lab), Merve Hickok (AIethicist.org), and Dr. Nicol Turner Lee.

Regulatory exposure

Dayforce candidate grading is squarely a high-risk employment AI system under EU AI Act Annex III and an automated employment decision tool under NYC Local Law 144 in substance, so Dayforce is a provider and its customers are deployers. Notably, Dayforce does not publish an LL 144 bias audit; instead its product suppresses grades entirely for candidates identified as residing in New York City (a 'Restricted' icon replaces the letter grade), which is compliance by avoidance rather than by audit. Illinois AIVI and HB 3773 and the Colorado AI Act create disclosure and impact-assessment duties that Dayforce addresses only through a one-line instruction telling administrators to add an AI disclosure to job descriptions 'if required in your jurisdiction'. The company claims alignment with GDPR, ISO 42001, NIST AI RMF, and the EU AI Act and says it commissions independent bias and fairness audits for higher-risk models, but no audit report, certificate, or auditor name is published, and no Article 27 FRIA template or deployer pack exists. Security and privacy certifications (ISO 27001/27017/27018/27701, SOC 1 and SOC 2 Type 2, NIST 800-171) are real but released only through a gated customer Due Diligence Portal.

Path to a higher score

The single highest-value move is to publish the artifacts Dayforce already says it holds: the ISO/IEC 42001 certificate and scope statement, the NIST AI RMF attestation letter, and at least a redacted summary of the independent bias and fairness audits of candidate grading, naming the auditor, date, sample size, and impact-ratio results by race and sex. Second, replace the NYC grade-suppression workaround with a published Local Law 144 bias audit so the feature can be used in New York City with transparency rather than switched off. Third, publish the internal 'explainability factsheets' referenced in the AI Governance Cycle post as public model cards for candidate grading and skills inference, and add an EU AI Act deployer pack containing an Article 27 FRIA template, an Article 13 instructions-for-use document, and per-jurisdiction disclosure templates. Finally, ungate the DPA and certification package, and stand up a public status/incident and AI model-change channel so post-market monitoring is externally observable rather than described only in prose.