AI Hiring Laws in 2026: What Employers Need to Know

AI hiring laws are rules that control how employers use AI and other automated tools to screen, rank, interview or reject candidates. Most of them ask for the same few things: tell candidates when AI is involved, test the tool for bias, keep a person able to review the outcome, and keep records. This guide covers the laws in force or coming in the US and the EU, with every date checked on October 13, 2026. It is general information, not legal advice, so confirm how each law applies to you with counsel.

TL;DR: AI hiring laws now apply in New York City, Illinois, California and Connecticut, with Colorado following on January 1, 2027 and the EU's high-risk rules from December 2, 2027. There is still no federal AI hiring law in the US, but discrimination law applies to AI decisions the same way it applies to people. This guide explains what each law requires, the duties they share, and the steps and vendor questions that keep a hiring team compliant.

What are AI hiring laws?

AI hiring laws are city, state and national rules on using automated tools in employment decisions. They cover software that scores resumes, ranks candidates, runs or analyses video interviews, or scores assessments, when its output makes or materially shapes a hiring decision.

Most of these laws do not ban AI in hiring. They set conditions for using it. The common ones are notice to candidates, bias testing, an explanation or human review after a rejection, and record-keeping.

Two points catch hiring teams out:

• Employers carry the duty, even when the tool is bought. New York City, Illinois and Colorado all place duties on the employer that uses the tool, not only on the vendor that built it.
• A human making the final call does not always take a tool out of scope. Colorado's law covers tools that materially influence a decision, and California's rules cover tools that support a human decision, not only tools that decide alone.

Awareness is low. SHRM's State of AI in HR 2026 research found that 57% of HR professionals are unaware of the AI laws in their state.

Which AI hiring laws apply in 2026?

AI hiring laws that apply to employers in October 2026 are New York City's Local Law 144, Illinois's amended Human Rights Act and AI Video Interview Act, California's automated-decision rules under FEHA, and the first part of Connecticut's CART Act. Colorado, the rest of Connecticut's law and the EU's high-risk rules start in 2027.

More states have bills moving, including New York State and New Jersey, so treat this table as a snapshot and check it again each quarter.

What does NYC Local Law 144 require?

NYC Local Law 144 requires employers and employment agencies that use an automated employment decision tool (AEDT) on candidates or employees in New York City to have the tool bias audited within one year of use, make the audit information public, and give the required notices.

Under the city's AEDT guidance, the main duties are:

1. Independent bias audit of the tool within one year before it is used.
2. Public summary of the audit results.
3. Notice to candidates and employees, at least 10 business days before the tool is used.

The city's Department of Consumer and Worker Protection began enforcing the law on July 5, 2023.

Enforcement has been light so far. A December 2025 audit by the New York State Comptroller found the department reviewed 32 companies and flagged one likely violation, while the auditors found 17 potential ones. Only 3 of 12 test calls to the city's 311 line reached the right office. The department agreed to most of the 13 recommendations, so expect closer checks, not fewer.

What do Illinois and California require?

Illinois and California both treat biased AI hiring decisions as discrimination under their existing civil rights laws. Illinois adds a duty to give notice when AI is used. California adds longer record-keeping and makes clear that agents acting for an employer, which can include vendors, can be liable too.

Illinois. HB 3773, signed in August 2024 and in force since January 1, 2026, amends the Illinois Human Rights Act. Using AI that has the effect of discriminating against a protected group is a civil rights violation, and so is using zip codes as a proxy for a protected trait. Employers must give notice when AI is used in recruitment, hiring, promotion and other employment decisions, with the timing and format set by the state's Department of Human Rights.

Illinois's older AI Video Interview Act still applies too: candidates must consent before AI analyses a recorded video interview, and recordings must be deleted on request.

California. The Civil Rights Council's rules on automated-decision systems took effect on October 1, 2025. Key points for hiring teams:

• An automated-decision system includes any tool that makes a decision or supports a human decision about a job.
• Records and data from those systems must be kept for four years.
• Bias testing is not required, but whether you did it can be weighed in a discrimination claim.
• An agent acting for the employer, which can include a vendor, can share liability.

What changes in Colorado and Connecticut in 2027?

Colorado and Connecticut both passed AI laws in 2026 that put notice and explanation duties on employers from 2027. Colorado's law focuses on what happens after an adverse decision. Connecticut's focuses on telling people up front, and its first provisions are already in force.

Colorado. SB26-189 was signed on May 14, 2026 and replaces the state's 2024 AI Act. From January 1, 2027, employers that use automated decision-making technology to materially influence employment decisions must:

• Give clear notice where the candidate interacts with the tool.
• Explain in plain language, within 30 days of an adverse decision, what role the tool played.
• Let the person correct wrong personal data and get meaningful human review.
• Keep compliance records for at least three years.

Vendors must give employers documentation on intended use, limits and human review. The Attorney General enforces the law, with a 60-day chance to fix problems until 2030. A federal lawsuit filed in April 2026 is also challenging the law, so watch for changes before the start date.

Connecticut. The CART Act phases in. Since October 1, 2026, employers cannot avoid a discrimination claim by pointing to an automated tool, though evidence of anti-bias testing can be considered. From October 1, 2027, employers must give written notice before an automated tool factors into an employment decision, naming the tool, its purpose and the personal data it analyses.

How does the EU AI Act treat AI in hiring?

The EU AI Act treats AI used to recruit or select people as high-risk. Annex III of the AI Act names systems that place targeted job ads, analyse and filter applications, and evaluate candidates. Employers that use them will have duties on oversight, monitoring, records and informing people.

The dates moved in 2026. The Digital Omnibus on AI, Regulation (EU) 2026/1744 entered into force on July 27, 2026 and pushed the high-risk rules for hiring tools to December 2, 2027.

What applies now and what comes later:

• Already in force since February 2, 2025: bans on certain AI practices, including inferring emotions in the workplace. Emotion analysis in video interviews is the clearest hiring risk.
• From December 2, 2027: employers using high-risk hiring AI must follow the vendor's instructions, assign human oversight, monitor the system, keep logs, and inform candidates and workers that the system is used.

GDPR rules on fully automated decisions with significant effects still apply alongside the AI Act.

Is there a federal AI hiring law in the US?

The US has no federal AI hiring law in 2026. Federal anti-discrimination laws such as Title VII, the ADEA and the ADA still apply to hiring decisions made with AI, and the employer stays responsible for the outcome.

Federal enforcement has eased. After an executive order in April 2025, an EEOC memo of September 2025 told offices to close charges based only on disparate impact, the theory most often used against biased screening tools. Candidates can still sue on their own, and state laws still apply.

Courts are where the risk now sits. In Mobley v. Workday, a federal court in California gave preliminary certification on May 16, 2025 to an age discrimination collective of applicants aged 40 and over who were screened through Workday's AI. The case shows that screening tools can face group claims about how they treat older applicants, even without proof of intent.

What do AI hiring laws have in common?

AI hiring laws share five duties: know which tools you use, tell candidates, test for bias, keep a person able to review, and keep records. A hiring team that builds these five into its process covers most of each law, then adds local details such as NYC's public audit summary.

How can hiring teams comply with AI hiring laws?

Hiring teams comply with AI hiring laws by mapping every AI tool to the decisions it touches, then adding notice, bias testing, human review and records around each one. Start with the strictest law that applies to your candidates, because it usually covers most of the rest.

1. List every AI feature in your hiring stack. Include ATS ranking, resume screeners, chatbots, video interview scoring and assessment scoring. Across the teams we work with, AI features switched on by default inside an ATS are the ones most often missed.
2. Map where your candidates and jobs are. NYC's law covers candidates and employees in the city, so a remote role open to New York City candidates may bring it in. Check each law's reach rather than your head office location.
3. Write one candidate notice. Say which tool is used, for what, what data it looks at, and how to ask for a review or an alternative. Send it before the tool runs.
4. Get a bias audit. Ask the vendor for an independent audit, and check your own selection rates by group at least once a year.
5. Name a human reviewer. Every rejection based on an AI score should be reviewable by a trained person who can override it.
6. Keep the evidence. Store scores, notices, overrides and audits for at least four years to cover California, the longest period in this guide.

Pro tip: Use structured, job-related criteria for every AI score. We have seen hiring teams answer bias questions more easily when each score links to a skill in the job description, because a reviewer can explain the decision in plain words.

For a wider view of hiring compliance, see the legal compliance checklist for hiring and legal compliance in recruitment automation.

What should you ask your AI hiring vendors?

AI hiring vendors carry their own duties in Colorado, Connecticut and the EU, and they hold the evidence employers need everywhere else. Ask these five questions before you sign or renew:

1. Has the tool had an independent bias audit in the last 12 months, and can we publish the summary?
2. Can a reviewer see the evidence behind every score and override it?
3. What personal data does the tool analyse, and does it use video, voice or facial analysis?
4. Will you give us the documentation Colorado and Connecticut require, and tell us about material changes?
5. How long are scores, logs and recordings kept, and can we export them?

Key takeaway: AI hiring laws reward tools that score on clear, job-related evidence and keep a person in charge. Choose vendors that can show an audit, explain every score, and hand you the records.

How does Testlify support compliant AI hiring?

Testlify supports compliant AI hiring by scoring candidates on job-related skills, showing reviewers the evidence behind each score, and keeping a person in the final decision. Its matching model has also completed a third-party bias audit under NYC Local Law 144.

• Audited. Testlify's matching model completed a third-party bias audit under Local Law 144 on June 16, 2023. NYC bias audit
• Job-related scoring. Assessments are built from the job description, using 3,500+ validated tests and 25+ question types, so every score maps to a skill the role needs.
• Explainable results with human oversight. Reports show per-skill scores and the answers behind them, and reviewers make the final call.
• Security and privacy. ISO 27001, SOC 2 Type II, GDPR and CCPA, with regional data residency. security and compliance

For how AI fits each stage of hiring, read AI in the hiring process.

Frequently asked questions

Ready to hire on job-related evidence?

See how skills-based, explainable scoring works on a real role. Start a 7-day free trial of Testlify, no credit card required, and share the NYC bias audit with your legal team.