AI hiring laws in the US: what employers must do in 2026 and 2027

Hiring is where US AI regulation is most developed. Résumé screeners, ranking tools, video interview analysis and chatbots that pre-qualify applicants all make or shape decisions about people’s livelihoods, and lawmakers have reached for them first. The result is a patchwork, but the pieces fit together into a fairly clear picture of what a careful employer needs.

The laws in force now

New York City. Local Law 144 bars employers and employment agencies from using an automated employment decision tool to screen candidates or employees for promotion in the city unless the tool has had an independent bias audit within the past year. The employer publishes a summary of the results, including selection or scoring rates and impact ratios by sex and race and ethnicity, and gives candidates at least 10 business days’ notice. Enforcement began on July 5, 2023.

Illinois. Since January 1, 2026, amendments to the Illinois Human Rights Act make it a civil rights violation to use AI in recruitment, hiring, promotion, discipline, discharge or other terms of employment in a way that has the effect of discriminating on a protected basis, to use zip codes as a proxy for a protected class, or to fail to give notice that AI is being used. The test is effect, not intent. Illinois’s older Artificial Intelligence Video Interview Act separately requires notice, explanation and consent before AI analyzes a recorded video interview.

California. The Civil Rights Council’s regulations on automated-decision systems, in force since October 1, 2025, confirm that a system or proxy that discriminates on a protected basis breaches the Fair Employment and Housing Act. Vendors acting for the employer are its agents. Evidence of anti-bias testing, or its absence, is relevant to any claim or defense. Automated-decision data must be kept for four years.

Everywhere. Title VII of the Civil Rights Act, the Americans with Disabilities Act and the Age Discrimination in Employment Act apply to employment decisions made with AI tools exactly as they apply to decisions made without them.

What changes in 2027

Colorado, January 1, 2027. SB 26-189 lists employment among its covered decisions. An employer using technology that materially influences a hiring, promotion or other employment decision gives notice beforehand, explains an adverse outcome within 30 days, including the role the technology played, and offers correction of inaccurate data and human review to the extent commercially reasonable. The developer supplies the documentation the employer needs.

California, January 1, 2027. Under the CCPA’s ADMT rules, employees, applicants and contractors are consumers, and employment opportunities and compensation are significant decisions. A business using technology that replaces or substantially replaces human decision-making in those decisions gives a pre-use notice, offers an opt-out or a human appeal, and explains its use of the technology on request.

Connecticut, October 1, 2027. Public Act 26-15 requires an employer using automated employment-related decision technology as a substantial factor in an employment decision to give the employee or applicant written notice beforehand, covering the tool’s trade name, purpose, the data it uses and where that data comes from. Since October 1, 2026, using such technology has been no defense to a discrimination complaint in Connecticut.

What a careful employer has in place

Put the rules side by side and the same handful of capabilities keeps coming up.

• An inventory of every hiring and workforce tool. Include AI features inside applicant tracking systems and HR suites, and tools individual recruiters have adopted. You cannot give notice about, audit or retain records for a tool nobody listed.
• Bias testing on a schedule. Mandatory in New York City and the main evidence of care everywhere else. The approach in our guide to running an AI bias assessment works for selection rates, impact ratios and the documentation around them.
• Notices drafted from the inventory. New York City, Illinois, Colorado, California and Connecticut all require some form of notice, with overlapping content. One accurate description per tool, kept current, serves them all.
• A human review route. Colorado requires one on request after an adverse decision, and California’s human appeal is the main exception to its opt-out. Decide who reviews, with what authority to overturn, and how quickly.
• Vendor documentation and contracts. Ask each supplier for intended use, known limitations, training data categories and bias testing results, and say in the contract who does which audit and notice.
• Four years of records. California’s retention period is the longest. Keeping assessments, audit results, notices and changes for four years covers the other regimes too.

Aicura’s register, discovery, vendor records, assessments and policies support this work, and Pro adds risk assessments against the NIST AI RMF and ISO/IEC 42001. Aicura does not perform the independent bias audit New York City requires, and it gives support and guidance for your own judgment and your advisers’.