AI Hiring Laws by State: What US Employers Owe in 2026

On 13 October 2026 I searched “ai hiring laws by state” with Google set to US results. The guide in the top two places was last updated in August 2024. It describes Colorado’s 2024 AI Act as if it were still the law. Colorado repealed that act in May 2026 and replaced it with a different one that starts on 1 January 2027.

That is the problem with this topic. The laws change every few months, and most guides are written once and left alone. So this page does three things the others mostly don’t: every status below was checked against official texts or law-firm alerts on the date shown, the duties are sorted by the kind of AI tool you use rather than only by state, and there is a section on AI voice interviews, which none of the guides I read cover.

Disclosure up front: we make HireQwik, an AI screening tool that reads resumes and runs AI voice interviews. That is why we track these laws closely. This page is not legal advice. Use it to brief your counsel, not to replace them.

The short answer

As of 13 October 2026, binding AI-in-hiring rules are in force in New York City, Illinois, California, Texas, New Jersey and Maryland. Colorado (1 January 2027), California’s privacy rules for automated decisions (1 January 2027) and Connecticut (1 October 2027) are next. There is no federal AI hiring statute, but Title VII, the ADA and the ADEA apply to AI decisions exactly as they apply to human ones.

The laws at a glance

Status checked 13 October 2026.

Which duties apply to which AI tool

Lawyers organise these laws by state. Hiring teams buy tools. Here is the same information sorted the other way.

The pattern is simple: the closer the tool gets to making the decision on its own, the more duties attach. A tool that hands a recruiter evidence and a recommendation carries less risk than one that silently rejects.

New York City: Local Law 144

Local Law 144 covers employers and employment agencies that use an automated employment decision tool to substantially assist a hiring or promotion decision about candidates or employees in New York City.

What you must do:

• Get an independent bias audit of the tool within one year before using it, and publish a summary of the results on your careers site.
• Notify candidates at least 10 business days before the tool is used, including how to ask for an alternative process or an accommodation.
• Disclose the type and source of data the tool uses, and your retention policy, when asked.

Penalties are civil fines per violation, and each day a tool is used without a valid audit counts separately. Enforcement has been light: a December 2025 audit by the New York State Comptroller found the city recorded one violation across 32 companies where the auditors flagged 17. We covered what that means in why weak enforcement is the bigger risk. The audit duty sits with the employer, not the vendor, even when the vendor pays for the audit.

Illinois: three separate laws

Illinois is the most crowded state because three laws can apply to one hiring step.

HB 3773 (Human Rights Act). In force since 1 January 2026 for every employer with at least one Illinois employee. You must give notice when AI is used in recruitment, hiring, promotion and other covered decisions, and you must not use AI in a way that has a discriminatory effect, intended or not. Zip codes cannot stand in for a protected class. The Department of Human Rights proposed notice rules in May 2026 and withdrew them in June, so for now you comply from the statute itself.

AI Video Interview Act. If AI analyses recorded video interviews for Illinois-based roles, you must tell the applicant before the interview, explain how the AI works and what it looks for, get consent, limit who sees the video, and delete it within 30 days of a request. If you rely only on AI to decide who gets an in-person interview, you must report applicant demographics each year. (820 ILCS 42)

Biometric Information Privacy Act. A voiceprint and a scan of face geometry are biometric identifiers. Collecting one needs written notice, a written release and a public retention and destruction schedule. Damages are $1,000 per negligent and $5,000 per intentional violation, limited since 2024 to one recovery per person. We wrote more on why a voiceprint is not just a recording.

California: two rules now, a third in 2027

Civil Rights Council regulations. Since 1 October 2025, California’s anti-discrimination rules cover “automated decision systems” in employment for employers with five or more employees. A vendor acting for you can be treated as your agent. You must keep automated-decision data and records for four years, and evidence of anti-bias testing counts in your defence. (Paul Hastings summary) Our California vendor audit checklist turns that into questions.

Privacy regulations on automated decision-making. Businesses covered by the CCPA that already use automated tools for significant employment decisions must comply by 1 January 2027: notice before use, an opt-out or a human appeal, and access to information about the decision. Risk assessments follow in 2027 and 2028. (Littler summary)

SB 947. Signed on 30 September 2026 after a similar bill was vetoed in 2025. From 1 July 2027 it bars discipline and termination decisions based solely on an automated system. It does not cover hiring, despite what some summaries say. (Morgan Lewis)

Colorado: a new law on 1 January 2027

Colorado’s 2024 AI Act never took effect. After two delays, Colorado repealed and replaced it on 14 May 2026 with SB 26-189, a narrower law on automated decision-making technology that starts on 1 January 2027. (Holland & Knight)

Any employer that uses such a tool to materially influence a hiring decision must give clear notice, explain an adverse outcome within 30 days, and let the person correct their data and ask for meaningful human review. The old duties to run risk-management programmes and annual impact assessments are gone. The Attorney General enforces, with a cure period and fines of up to $20,000 per violation. Two caveats: the Attorney General’s rules are still being written, and enforcement is paused by agreement in a federal case (xAI v. Weiser). We explained why the delays are not a reason to wait.

Connecticut, Texas, New Jersey and Maryland

Connecticut. Public Act 26-15 was signed on 27 May 2026. From 1 October 2027, employers that use an automated employment-decision tool must tell applicants and employees about it, including what kinds of personal data it uses and where the data comes from. A vendor can deliver the notice for you. The law also says using such a tool is no defence to a discrimination claim. We broke down Connecticut’s two deadlines in July. (Paul Hastings)

Texas. TRAIGA has applied since 1 January 2026, but for private employers it only bans developing or using AI with the intent to discriminate. A disparate impact alone is not a violation. There is no notice or audit duty and no private lawsuit; only the Attorney General enforces. Read more on why Texas went the other way.

New Jersey. No AI-specific statute, but disparate-impact rules in force since 15 December 2025 name automated employment decision tools, especially untested ones, as a risk under the Law Against Discrimination. Candidates can sue. See why New Jersey’s old law already applies.

Maryland. You cannot create a facial template from an applicant’s interview without a signed waiver stating the applicant’s name, the interview date and their consent.

Still pending. New York State’s legislature passed an AI workforce-reporting bill in June 2026 that had not been signed as of our check. Virginia’s AI bills were held over to 2027. We found no enacted AI hiring law in Washington, Minnesota, Vermont or Utah. Massachusetts has no AI-specific law, but its Attorney General says existing law already covers AI tools.

Federal law: no AI statute, same liability

There is no federal AI hiring law. The EEOC removed its AI technical-assistance guidance on 27 January 2025. A December 2025 executive order set up a Justice Department task force to challenge state AI laws, and Congress has twice declined to pass a moratorium on them. None of that removes a state law, and none of it changes your federal exposure.

Title VII still prohibits selection procedures with an unjustified disparate impact, whether a person or a model applies them, and the Uniform Guidelines’ four-fifths rule is still the first test lawyers run. The ADA and the ADEA still apply too. Two cases to watch:

• Mobley v. Workday. In 2024 the court let claims proceed on the theory that a screening vendor can act as the employer’s agent. In 2025 it certified a nationwide age-discrimination collective. The case is ongoing. (Civil Rights Litigation Clearinghouse)
• Kistler v. Eightfold AI. Filed in January 2026, it argues that AI candidate profiles can be consumer reports under the Fair Credit Reporting Act. A motion to dismiss is pending.

AI voice interviews: the gap in every other guide

Every guide I read treats “AI interviews” as video and facial analysis, because that is what Illinois and Maryland wrote laws about in 2020. Many AI interviews now are voice conversations. Three questions decide your exposure:

1. Does the tool make a voiceprint, or only a transcript? A transcript of what someone said is not a biometric identifier. A voiceprint, a template that identifies a person by their voice, is, and under Illinois law it needs written consent. A proposed $3.75 million settlement in Deyerler v. HireVue, which HireVue denies liability for, shows these claims are being brought against interview tools.
2. Is video recorded and analysed by the AI? If the camera is on and the AI analyses the video, the Illinois AI Video Interview Act’s consent and deletion rules are the safer reading. If video is recorded only for a human reviewer, discuss with counsel whether the Act applies.
3. Does the interview result feed a hiring decision? If so, it is an automated decision tool for New York City, Illinois, California and, from 2027, Colorado and Connecticut, whatever the medium.

Ask your vendor these questions in writing before you launch. A vendor that cannot answer the first one is not ready for Illinois.

Which law applies when candidates are in many states

High-volume roles pull applicants from everywhere, and the laws do not agree on what triggers them: some turn on where the job is, some on where the candidate lives, some on where your employees are. Rather than running fifty processes, most legal teams build one process that meets the strictest common requirements:

• Notice to every candidate before any AI step, saying what the tool does, what data it uses and how to ask for a human alternative.
• A human in the loop for every rejection, with a recorded reason the candidate can ask about.
• Adverse-impact testing on your own applicant data before launch and on a schedule after, using the four-fifths rule as the first screen.
• Four years of decision records (the California standard), kept separately from any biometric data, which Illinois tells you to destroy.
• An NYC bias audit if any role touches New York City, because it is the one duty you cannot meet after the fact.

Records: what to keep and what to delete

These rules pull in opposite directions, so keep two separate stores:

A rollout checklist for AI screening

1. List every AI step in your funnel and what it decides: rank, recommend or reject.
2. Map where your roles and candidates are, and which laws above they trigger.
3. Get your vendor’s answers in writing: model inputs, voiceprint or not, video analysis or not, retention, deletion, bias testing done so far.
4. Run adverse-impact analysis on a historical sample before launch.
5. Commission an independent bias audit if any role is in New York City.
6. Publish candidate notices and a way to request a human alternative.
7. Keep a human decision on every rejection, and log the reason.
8. Re-test quarterly and re-check this page’s change log, because the dates move.

The seven questions your legal team will ask about an AI hiring audit trail make a good pre-launch review.

What HireQwik does, and what it doesn’t claim

We built HireQwik for high-volume hiring, so these laws shape the product. Every resume score shows the evidence behind it, requirement by requirement. Every AI interview keeps a transcript and a scored evaluation a recruiter can read. Recruiters make the decision and can override the AI, and automatic rejection is off unless you turn it on for a role. That design follows the direction of every law above: evidence behind every score and a human who decides.

What we don’t claim: HireQwik does not make you compliant with any of these laws. Under New York City’s law the employer must obtain the bias audit, and under every law here the hiring decision and the duty to give notice stay with you. Application data is stored with Amazon Web Services in Mumbai, India, as our privacy policy explains, which matters if your counsel requires US data residency.

Change log

• 15 October 2026: first published. Statuses checked on 13 October 2026 against official texts and law-firm alerts dated through 9 October 2026. Includes Colorado SB 26-189 (effective 1 January 2027), Connecticut Public Act 26-15, California SB 947, and the withdrawal of Illinois’ draft notice rules.