Impact
AI hiring laws by state: which rules apply where you hire
Four jurisdictions, and they do not agree.
October 9, 2026
Ben Chino
The short answer
There is no federal US rule on AI in hiring. Four jurisdictions regulate it separately: New York City requires an annual independent bias audit and a published summary, California makes the absence of bias testing evidence in a discrimination claim, Illinois treats discriminatory effect as a civil rights violation, and Colorado scaled its act back before it took effect.
There is no federal rule on AI in hiring. There are four local ones, they arrived in a different order than anyone expected, and they do not ask for the same things.
If you hire across state lines, which most enterprises do, you are not choosing a framework. You are meeting the strictest one you touch, because that is the one you will be measured against.
The timeline
Four jurisdictions, in the order they arrived
New York City, Local Law 144
Annual independent bias audit, published summary of results, candidate notice ten business days ahead. The template other cities copy.
California, FEHA
Screeners, assessments and interview analytics in scope. Bias testing, or its absence, becomes relevant evidence in a discrimination claim.
Illinois, HB 3773
Notice when AI is used, no zip-code proxies for protected classes, discriminatory effect treated as a civil rights violation.
Colorado
Replacement act. Bias-audit and risk-assessment requirements were stripped from the original before it took effect.
New York City
Local Law 144, in force since July 2023.
The oldest of the four and the one everyone else copies. It covers automated employment decision tools, which includes screeners, assessments and anything that scores a candidate.
Three obligations. An independent bias audit, conducted annually by someone who is not you and not your vendor. A published summary of the results, posted publicly. And notice to candidates that the tool is being used, given at least ten business days before it is.
What makes this one unusually demanding is the publication requirement. Most rules ask you to do the work. This one asks you to show it.
California
FEHA regulations on automated decision systems, in force since October 2025.
Broader in scope than New York and softer in form. Resume screeners, assessments and interview analytics are all explicitly named.
The inversion worth noticing
California does not fine you for failing to test. It makes the absence of a test relevant evidence if you are ever in front of a plaintiff. The missing document becomes the document.
Record-keeping obligations extend too, which matters more than it sounds: you are expected to be able to produce the material later, not just to have had it at the time.
Illinois
HB 3773, in force since January 2026.
Three parts. Notice when AI is used in an employment decision. A prohibition on using zip code as a proxy for a protected class, which is specific enough that it clearly came from somebody who had seen it happen. And the one with teeth: discriminatory effect produced by an AI system is treated as a civil rights violation.
Effect, not intent. You do not get to argue that nobody meant it.
Colorado
Replacement act arriving January 2027.
Worth knowing mostly as a correction. The original Colorado AI act was widely covered as the most demanding state law in the country, and it was scaled back before it ever took effect. Bias-audit and risk-assessment requirements were stripped out.
If your internal paper cites the original Colorado act as a reason to act, it is citing something that never came into force.
What this means in practice
If you hire in New York, California, Illinois and the EU, you are not choosing between frameworks. You need the artefacts that satisfy the strictest one you touch.
Building to the strictest is cheaper than building four times.
Notice is the common thread. All three live rules require telling candidates something. The wording differs, the timing differs, and the easiest way to get this wrong is to have three different notices maintained by three different people. One notice, approved once, deployed everywhere, is a smaller problem.
The evidence requirement is quietly the biggest one. California's framing is the clearest statement of something that is true in all four jurisdictions: the thing that protects you is a record. An audit you ran and cannot locate is worth nothing.
What to have on file
The four documents
These cover all four jurisdictions
If you have those four, adding a jurisdiction is an update. If you do not, each new rule is a project.
One note on the EU
If you also hire in Europe, the timeline moved. The Digital Omnibus approved in June 2026 deferred the EU AI Act's high-risk obligations for hiring from August 2026 to December 2027.
What did not move is Article 50, the transparency obligation, which has applied since August 2026. People must be told when they are interacting with an AI system.
So the European work split into two pieces with different deadlines, and the one that is live now is the smaller one.
Key takeaways
There is no federal rule. There are four local ones.
- NYC Local Law 144 is the strictest and the one other cities copy: annual independent audit, published summary, candidate notice.
- California made the absence of bias testing evidence in a discrimination claim. No fine, no date, just a much worse position in front of a plaintiff.
- If you hire across state lines you are not choosing a framework. You are meeting the strictest one you touch.
Frequently asked
Questions people ask about this
Is there a federal US law on AI in hiring?
No. As of October 2026 there is no federal rule. Regulation sits at city and state level, currently New York City, California, Illinois and Colorado, and each asks for different things.
Which US AI hiring law is the strictest?
New York City Local Law 144. It requires an annual independent bias audit, a publicly posted summary of the results, and notice to candidates at least ten business days before the tool is used. Building to that standard covers most of what the other jurisdictions ask for.
Does the EU AI Act still apply from August 2026?
Not for hiring. The Digital Omnibus approved in June 2026 deferred the high-risk obligations, which include recruitment and selection, to 2 December 2027. Article 50 transparency obligations did take effect on 2 August 2026 and still apply.
Sources
NYC Local Law 144; California FEHA automated decision system regulations; Illinois HB 3773; Colorado replacement act; Council of the EU approval of the Digital Omnibus on AI, 29 June 2026. Last reviewed 9 October 2026.
See what Maki Agents can do for you
