AI Hiring Laws: NYC Local Law 144, EU AI Act and Other Rules for HR

By Kevin Kim · Updated Oct 11, 2026

AI hiring laws are the rules that apply when software screens, scores, ranks or helps decide who gets hired, promoted or let go. There's no single global law. Instead you face a patchwork of city, state and national rules that mostly ask for the same four things: tell people the tool is in use, test it for discriminatory effects, keep a human accountable, and keep records. The patchwork is also moving. Dates have been delayed, laws have been rewritten, and one US federal agency has pulled its guidance.

This page is for HR directors, talent acquisition leads and in-house counsel who need a working map rather than a legal treatise. It covers what each major law does, its status as of October 2026, and a method for building a compliance approach that doesn't need rewriting every time a legislature acts. This is general information, not legal advice. Confirm current requirements with counsel for each place you hire.

Key Facts

• New York City's Local Law 144 bars employers from using an automated employment decision tool unless it has had a bias audit within one year before use and a summary of the results is public; the city began enforcing it on 5 July 2023 (NYC DCWP).
• The European Commission lists AI tools for employment and worker management as high-risk, with CV-sorting software as its example, and states the high-risk rules for employment apply from 2 December 2027 under the AI Omnibus (European Commission).
• Illinois House Bill 3773, which bars discriminatory AI use in hiring and promotion decisions, took effect on 1 January 2026 (Hinshaw & Culbertson).
• Colorado repealed and re-enacted its 2024 AI law as SB26-189, an automated decision-making technology law covering consequential decisions that include employment; the governor signed it on 14 May 2026 (Colorado General Assembly).
• California's regulations on automated-decision systems in employment took effect on 1 October 2025 and require employers to keep employment records, including automated-decision data, for at least four years (California Civil Rights Council).
• The US EEOC removed its AI guidance from its website on 27 January 2025 after an executive order, though the underlying discrimination laws didn't change (K&L Gates).

The Laws at a Glance

Statuses below are as of 11 October 2026. A date in the past is something already in force or already changed.

Now the detail on each.

New York City: Local Law 144

Local Law 144 is the oldest hiring-specific AI law in the US and the one most employers hear about first. Under it, an employer or employment agency can't use an automated employment decision tool for a hiring or promotion decision unless the tool has been subject to a bias audit within one year of its use. Information about the audit must be publicly available, and certain notices must go to employees or job candidates. The Department of Consumer and Worker Protection (DCWP) says candidate notice must be given 10 business days before the tool is used, and that it began enforcement on 5 July 2023 (NYC DCWP).

The practical point: the audit is a recurring cost, not a one-time certificate. A tool audited in March is out of date by the following March. And the duty sits with the employer using the tool, so "our vendor says it passed" isn't a plan. For how to run the selection-rate comparison yourself, see AI resume screening.

The European Union: AI Act

The EU AI Act classes AI used in employment as high-risk. The Commission's own summary gives CV-sorting software for recruitment as its example and says high-risk systems face obligations such as risk management, data quality, logging, documentation and human oversight (European Commission). The category covers employment and the management of workers, not only hiring. See the EU AI Act for the wider structure.

The date is the part that changed. The original schedule would have brought the high-risk employment rules in on 2 August 2026. The "digital omnibus" simplification package moved them: the Commission page now states that rules for high-risk systems in sensitive areas, including employment, were extended to 2 December 2027, and that the omnibus entered into force on 27 July 2026 (European Commission). So the delay is enacted law, not a proposal. It isn't a reason to wait, though. The obligations still need a risk process, logging and oversight, and those take months to build.

Not everything moved. The Commission says the Act became applicable on 2 August 2026 with some exceptions, so check which obligations apply to each tool you use. For interview tools that analyze faces or voices, AI in interviews covers the specific risks.

Illinois: Two Laws, Different Jobs

Illinois has two separate rules, and employers often confuse them.

The Artificial Intelligence Video Interview Act (2020). When an employer uses AI during a video interview, it must tell the applicant, explain how the AI works, and get consent before the interview (Hinshaw & Culbertson). It's narrow: video interviews only.

HB 3773, amending the Illinois Human Rights Act. This is the broad one. It prohibits the use of AI, including generative AI, in hiring or promotion decisions that result in discrimination based on protected characteristics, and the draft rules treat a failure to give notice that AI is being used as a violation. It took effect on 1 January 2026, and the Department of Human Rights is tasked with adopting implementing rules (Hinshaw & Culbertson).

The draft notice rules are worth reading even if you don't hire in Illinois, because they show where US notice duties are heading. As drafted, a notice would name the AI product and its vendor, the decisions it influences, the purpose and data categories involved, a point of contact, and how to request an accommodation. Drafts also require employers to keep AI notices for four years (Hinshaw & Culbertson). Check whether the rules have been finalized before you rely on any detail.

Colorado: A Law That Was Replaced

Colorado's story is the best argument for not building your program around one statute. The state's 2024 AI Act, SB 24-205, was the first comprehensive US attempt to regulate high-risk AI in consequential decisions, employment included. In 2026 the legislature repealed and re-enacted it as SB26-189, which the governor signed on 14 May 2026 (Colorado General Assembly).

The replacement is narrower and built around "automated decision-making technology." It still treats access to, eligibility for, or compensation related to employment as a consequential decision. According to the bill page, deployers must give clear notice when people interact with covered technology, give a plain-language description of its role within 30 days of an adverse outcome, and honor requests for meaningful human review. Developers must give deployers documentation on intended uses, training data categories and limitations, with developer duties starting 1 January 2027 and attorney general rules on adverse-outcome explanations due by that date. The attorney general enforces it as a deceptive trade practice, and the act creates no new private right of action (Colorado General Assembly).

If your 2025 plan referenced the older "high-risk AI system" duties of care and impact assessments, that plan needs a rewrite.

California: Existing Law, Applied to Algorithms

California didn't write a hiring-AI statute. Its Civil Rights Council amended the regulations under the Fair Employment and Housing Act so that they cover automated-decision systems. They took effect on 1 October 2025. They state that using an automated-decision system can violate California law if it harms applicants or employees based on protected characteristics, require records including automated-decision data to be kept for at least four years, and treat assessments such as tests, questions or puzzle games that elicit information about a disability as potential unlawful medical inquiries (California Civil Rights Council). For the assessment side of this, see AI pre-employment assessments.

This is the model to expect elsewhere: no new tool-specific rule, just a clear statement that old rules reach new tools.

The US Federal Picture

On 27 January 2025 the EEOC removed its AI guidance, published in May 2023, from its website, days after a 23 January 2025 executive order on AI; the Department of Labor also flagged two AI publications as possibly outdated (K&L Gates).

Don't read that as permission. Technical assistance explained existing law; it didn't create it. Title VII and the ADA still apply to selection tools, and the long-standing federal rule of thumb still applies: a selection rate below four-fifths (80%) of the highest group's rate is generally regarded as evidence of adverse impact (29 CFR 1607.4). Private plaintiffs and state agencies don't need federal guidance to bring a case.

How to Build a Compliance Approach That Survives New Laws

Laws differ on triggers and dates, but the duties repeat. Build to the common core and treat each jurisdiction as a thin layer on top.

1. Inventory every tool that touches a people decision. Resume screeners, assessments, video interview analysis, chatbots that pre-screen, scheduling and ranking features inside your ATS. Many teams find AI features they didn't know they'd switched on.
2. Classify each tool by decision impact. Does it reject, rank, recommend or only schedule? Rejecting and ranking tools carry the heaviest duties everywhere.
3. Map where you hire and where candidates live. Rules often attach to where the job or the candidate is located, not where your HR team sits. A remote role can touch several regimes at once.
4. Set one notice standard to the strictest rule you face. A notice that names the tool, the decision it supports, the data it uses, a contact and an accommodation route satisfies the direction of nearly every law above.
5. Test for adverse impact on a schedule. Compute selection rates by group at each stage and compare to the highest group. Re-run after any change to criteria, model or vendor. Annual is the floor where an audit is mandated.
6. Put a human in every adverse decision. A named person reviews rejections that rest on a score. Colorado's human-review right, the EU's oversight duty and Illinois's anti-discrimination focus all point the same way. See human-in-the-loop and human oversight in HR AI.
7. Keep records for four years. California and the Illinois drafts both use four years. It's a safe single retention rule. Log tool versions, criteria, notices sent and test results.
8. Write it into vendor contracts. Require audit support, documentation on training data and limits, notice of material model changes, and cooperation with regulators. The vendor evaluation framework gives a checklist.
9. Assign an owner and a review date. One person tracks legislation quarterly. Dates in this area have slipped, statutes have been rewritten, and guidance has been withdrawn. Your policy should name a review cadence, not a statute.

For the wider governance structure, AI governance covers how these controls fit into company-wide policy.

Common Pitfalls

• Planning around a single date. The EU high-risk date moved, Colorado's law was replaced, and the EEOC pulled its guidance. Build duties, not deadlines.
• Assuming the vendor carries the risk. In the regimes above the employer using the tool carries duties, and California's regulations add a definition of "agent" for parties acting for employers.
• Treating "no new law" as "no rule." California applied existing anti-discrimination rules to automated systems. A state without an AI statute can still have exposure.
• Notice that's buried. A line in a privacy policy rarely meets a requirement to tell candidates in advance.
• One-off bias tests. NYC requires an audit within a year of use, and models drift. Test again after changes.
• Ignoring remote candidates. Where the applicant sits can matter as much as where you are.
• Waiting on the EU delay. Logging, documentation and oversight take longer to build than a deferral buys.