Five US AI Hiring Laws Bind You Today, and Colorado Is Not One

Which five regimes actually impose duties today?

Five, and none of them is federal. New York City Local Law 144 bars an employer from using an automated employment decision tool on a city candidate unless a bias audit was done within the prior year, a summary of the results is posted publicly, and the candidate got notice at least ten business days beforehand ¹. Illinois adds two separate statutes and Maryland one. California's civil rights regulator amended its discrimination rules to name automated-decision systems outright ⁴.

Here is the set, with the date each one started binding:

• NYC Local Law 144. In effect since January 1, 2023 and enforced by the Department of Consumer and Worker Protection since July 5, 2023, with statutory civil penalties of $500 to $1,500 a day ¹.
• Illinois HB 3773 (Public Act 103-0804), amending the Illinois Human Rights Act as of January 1, 2026. It is a civil rights violation to use AI that has the effect of discriminating on a protected basis, to use zip codes as a proxy for a protected class, or to fail to notify an employee that AI is being used ². The timing and form of that notice sit in rulemaking, not in the statute.
• The Illinois AI Video Interview Act (820 ILCS 42), in force since 2020. Before AI analyses a recorded video interview for an Illinois-based position, tell the applicant, explain what the system evaluates, and get consent. An applicant who has not consented may not be evaluated that way ³.
• Maryland's facial recognition waiver (Md. Code Lab. & Empl. section 3-717), in force since October 1, 2020. An employer may not use a facial recognition service to create a facial template during an applicant's interview unless the applicant signs a waiver covering their name, the interview date, consent, and whether they read it ¹⁰. The statute is narrow: facial templates only, no penalty, no private right of action, and nothing that stops an employer from declining to interview a candidate who will not sign.
• California's FEHA automated-decision-system regulations, effective October 1, 2025. An automated-decision system is a computational process that makes or facilitates a decision about an employment benefit, and the rules name resume screening for terms or patterns, analysis of facial expression, word choice or voice in online interviews, and computer-based assessments of personality or aptitude ⁴. A vendor running the system counts as an employer under the Act.

Four of the five ask you to act: audit plus notice before the tool runs in New York City, notice under the Illinois Human Rights Act (its timing waits on rulemaking), notice-plus-consent before AI touches a recorded video interview, and a signed waiver before facial recognition runs in a Maryland interview. California changes what has to be proved after someone complains. Sorting obligations that way is more useful than sorting them by state, and it is the first thing to settle when you work out whether a given tool counts as an automated employment decision tool.

This maps US law. Recruiting into the EU adds the AI Act: its AI-literacy duty and its ban on emotion-inference AI in the workplace have applied since February 2025 ¹¹, and the high-risk hiring rules arrive December 2027 ¹².

Why Colorado belongs off your list

Because the statute everyone still cites never applied to anyone. Colorado SB 24-205 was scheduled to start February 1, 2026, pushed to June 30, 2026 by SB 25B-004, and then repealed and reenacted by SB 26-189, which the governor signed on May 14, 2026 ⁵. The replacement is a narrower automated decision-making regime that does not take effect until January 1, 2027.

What the replacement asks for is worth reading now, because the start date is close and the content is not what the 2024 act contained. SB 26-189 names employment as a consequential decision, requires a deployer to give notice at the point of interaction, to provide a plain-language description of the technology's role within 30 days of an adverse outcome, and to honour a request for meaningful human review ⁵. The 2024 act's duty of care against algorithmic discrimination, its deployer risk-management programs and its impact assessments did not survive into the new text.

So the instruction is narrow. If your AI hiring policy names Colorado as a live obligation with a 2026 date, that paragraph is wrong today, and the repair is a deletion rather than an edit. Diary the January 2027 date, note that a law amended twice inside a year can be amended again, and move the hours you were spending on Colorado onto the five regimes that already reach you.

What the federal floor still requires

Everything on the state map sits on top of Title VII, the ADEA and the ADA, which apply in every state and carry a private right of action. Title VII puts disparate impact in the statute itself at 42 U.S.C. 2000e-2(k): once a plaintiff identifies a particular practice causing the impact, the employer has to show that practice is job related for the position in question and consistent with business necessity ⁶.

That test is the one an AI hiring tool is most likely to face in a courtroom, and it does not care which state you sit in. It is also why the state statutes read the way they do. Illinois wrote an effects standard straight into its Human Rights Act ². Texas went the other way: the Responsible Artificial Intelligence Governance Act took effect January 1, 2026 and prohibits developing or deploying an AI system with the intent to unlawfully discriminate, saying expressly that a disparate impact by itself does not demonstrate intent ⁷. Enforcement there belongs to the attorney general alone, after a 60-day period to cure.

Two consequences follow. First, "compliant with AI hiring law" names no single standard: Illinois asks what the tool did, Texas asks what you intended. Write to the stricter effects standard and the intent standard comes along. Second, federal enforcement posture and federal law are different things, and the gap between them is wider than usual right now. Executive Order 14281, signed April 23, 2025, directs agencies to deprioritize enforcement of disparate-impact liability and names 42 U.S.C. 2000e-2 in the text ⁹, and the EEOC took its AI technical assistance documents down in late January 2025 ⁸. Every statute behind both stayed where it was.

Run the map against your own stack this quarter

Start with a tool inventory, not a legal memo. List every system that touches a candidate, mark which of them produces an output a human treats as a conclusion, and write down where your candidates actually are. Your office address is not the one that matters. Those two facts, what the tool does and whose state reaches the candidate, decide every question on this page.

Five steps, in the order that saves the most rework:

1. Inventory every candidate-facing system, including the ATS features nobody switched on deliberately and the ones a vendor enabled in an upgrade. 2. For each system, write a one-line classification and the reason for it. The reason is the part that has to survive being read back to you. 3. Check the candidate side of the ledger, not only the company side. A remote posting puts you under the candidate's state law, which is the single most common way a compliance map drawn at headquarters turns out to be the wrong map. 4. Where an audit duty attaches, settle the data question early. Running an adverse impact audit when the vendor holds the data takes months, and it takes longer when the contract says nothing about access. 5. Put the whole thing in one dated document. What belongs in an AI hiring policy is a shorter list than most drafts assume, and naming the person who signs it matters more than the length.

Confirm the classifications with counsel before they go in writing. The classification is the document a regulator or a plaintiff reads first, and it is the one place where a guess written in confidence costs more than a question asked early.

Read the evidence >