A Remote Posting Adds the Candidate's State AI Law to Yours

Which state's law applies to a remote req?

The candidate's or the position's, on top of your own. The Illinois AI Video Interview Act keys on Illinois-based positions rather than on Illinois-based employers, so a remote role filled from Chicago falls inside it once AI analyses a recorded interview ³. New York City's duty attaches to the use of an automated employment decision tool on a New York City candidate ². The Illinois Human Rights Act amendments, live since January 1, 2026, reach employers operating in Illinois ¹.

None of those triggers is a headquarters, which is the whole problem. A compliance map drawn around the states a company has offices in leaves out every state its applicants are in.

California pushes on the definition instead. Its FEHA regulations now cover automated-decision systems, effective October 1, 2025, and define one broadly enough to include screening resumes for particular terms or patterns and analysing facial expression, word choice or voice in an online interview ⁴⁶. An agent acting for the employer, a vendor running the system included, counts as an employer under the Act, so outsourcing the tool does not outsource the question.

Maryland shows how narrow a trigger can get. Since October 1, 2020 an employer may not use a facial recognition service to create a facial template during an applicant's interview without a signed waiver giving the applicant's name, the date of the interview, consent to the use, and whether the applicant read the waiver ⁵. It reaches facial templates created during an interview and nothing else: not the recording, not voice analysis, not AI scoring of what the candidate says.

Pick the geography, or build to the strictest state

Both levers are in the location field. One names the states the role is genuinely open to, so the rule set stops at the edge of that list. The other posts nationally and applies the strictest applicable standard to every candidate, whatever their state asks for. Posting nationally while running your home state's rules is not a third option.

Each lever has a real cost, and picking without naming the cost is how teams end up with neither.

Scoping the geography costs applicant volume and creates a maintenance job. The list has to stay true: if sourcing is working a state the posting excludes, the posting is now a document that contradicts the process, and the process is the part a regulator can see. It also has to survive the way the AI requirement in a job description reshapes who applies, since a narrower geography and a sharper requirement compound.

Building to the strictest standard costs process. You run the audit, post the summary, send the notice and collect the consent for every candidate, including the ones whose state asks for none of it. That is more work per req and far less work per decision, because nobody has to check a map before sending an email. For a team hiring in six or more states at once, it is usually the cheaper of the two.

What the strictest standard actually costs

Across the regimes here, that means New York City's discipline plus Illinois' consent, applied to everyone. That is a bias audit from within the prior year on any tool that substantially assists or replaces a discretionary hiring decision, a public summary of the results, at least ten business days of candidate notice, and, where AI analyses a recorded video interview, an explanation of what the system evaluates plus consent before it runs ²³.

The details that catch people out are all in the timing and the scope:

• The audit expires. New York City wants one from within the prior year, and enforcement has run since July 5, 2023, with civil penalties set at a statutory maximum of $500 to $1,500 per day ².
• The notice period is ten business days, not ten calendar days, and a notice posted on a careers page starts the clock regardless of when a specific job went up ².
• The Illinois consent rule has an absolute edge even though the statute names no penalty: an employer may not use AI to evaluate an applicant who has not consented ³. A candidate who declines has to have a path that is not silence.
• California adds no audit or notice duty, but it makes testing evidence. In a claim that an automated-decision system discriminated, the presence or absence of anti-bias testing is relevant, including its quality, recency, scope, results and the response to those results ⁴. Testing, finding a disparity and doing nothing is worse than the number looks.

Whether any of this attaches at all turns on one classification, which is why what counts as an automated employment decision tool is the question to settle before budgeting for the rest.

Write the location field like a compliance decision

Treat the location field as the first line of the compliance record, because that is what it is. Before a req goes live, name the states it is open to, note who decided and when, and check the list against where sourcing is actually working. A posting that says remote-anywhere while recruiting runs in three states buys the widest rule set for nothing.

Four habits make this stick without adding a stage:

1. Put the geography decision on the intake call with the hiring manager, next to the salary band. It takes one minute there and a week anywhere else. 2. Keep one list of the states the company is set up to hire in, dated, and have the posting template pull from that list. 3. Where the posting is national, write the notice and consent steps into the process for every candidate. A conditional step gets skipped under load. 4. Re-read the list when the tool stack changes. Switching on a vendor feature can move a req into scope without anyone editing the posting.

The wider state map is moving fast enough that a quarterly re-read is cheap insurance: which AI hiring laws actually apply now is the version to check yours against. Confirm any scope language with counsel before it ships, since the posting is a public document and the first one a complaint will quote.

See a sample report >