US AI hiring laws in 2026: a state-by-state guide for recruiters

There is still no single federal rulebook for AI in American hiring. AI hiring laws in 2026 are a patchwork instead: a city ordinance in New York, civil-rights rules in Illinois and California, a rewritten statute in Colorado, a narrow law in Texas, a brand-new one in Connecticut, and a federal government actively trying to shrink the map. This guide covers what is in force or scheduled as of late October 2026, with a source behind every date. It is meant as a map for recruiting teams and should not be read as legal advice. That map has moved more in the last twelve months than in the three years before.

The short answer: which AI hiring laws apply, and when

• New York City: in force since July 2023. Independent bias audit, a public summary of results, and advance notice to candidates.
• Illinois: in force since January 1, 2026. AI that has a discriminatory effect in employment decisions is a civil-rights violation, and employers must give notice.
• California: in force since October 1, 2025. Civil-rights regulations cover automated-decision systems; privacy-law rules on automated decisions follow on January 1, 2027.
• Texas: in force since January 1, 2026. Bans AI deployed with intent to discriminate; light duties for private employers.
• Colorado: repealed and replaced. The original AI Act never took effect. The obligations of a narrower replacement law start January 1, 2027.
• Connecticut: enacted in 2026, phased in. Candidate notice duties start October 1, 2027.

New York City: the oldest AI hiring law is finally being enforced

Local Law 144 has been enforced since July 5, 2023: you may not use an automated employment decision tool unless it has had a bias audit within the past year and the audit information is public, and candidates must get notice (NYC DCWP). We walked through those three duties in AI interviews and the law.

The city’s own enforcement record is now under scrutiny. A New York State Comptroller audit released in December 2025, covering July 2023 to June 2025, called the city’s enforcement “ineffective.” Seventy-five percent of test calls to 311 about AI hiring tools were misrouted. The city reviewed 32 posted bias audits and found one compliance issue; the Comptroller’s review of the same 32 found at least 17 potential issues. The city agreed to most of the recommendations, including better complaint routing and investigations that can involve tool demonstrations (DLA Piper summary).

A bias audit you posted once and never reread is now a liability. Assume the summary on your careers page will be read by someone looking for problems.

Illinois: discriminatory effect is a civil-rights violation since January 1, 2026

Public Act 103-0804 (HB 3773) amends the Illinois Human Rights Act. Since January 1, 2026, it is a civil-rights violation to use AI in recruitment, hiring, promotion, discipline or discharge in a way that subjects employees to discrimination on a protected basis, to use ZIP codes as a proxy for protected classes, or to fail to give notice that AI is being used (Gordon Rees). The test is effect, and the employer’s intent is irrelevant.

The notice duty took effect without implementing rules. The Department of Human Rights published proposed notice rules on May 15, 2026, then withdrew them on June 2, 2026 to coordinate with other state agencies. The statutory obligations apply anyway (Ogletree, via National Law Review). The withdrawn draft would have covered applicants as well as employees, so notifying candidates is the safe reading.

California: one rulebook in force, a second arriving in January

The Civil Rights Council regulations took effect October 1, 2025. They make explicit that using an automated-decision system can violate state anti-discrimination law if it harms applicants or employees on a protected basis, require employers to keep automated-decision data with other employment records for at least four years, and warn that assessments which elicit disability information can be unlawful medical inquiries (California Civil Rights Department). Two details matter for anyone buying a tool: “employer” includes agents acting on the employer’s behalf, and courts may weigh the quality, timing and results of “meaningful anti-bias testing,” along with what you did about those results (Thompson Coburn).

The privacy agency’s automated-decision rules apply from January 1, 2027. Businesses using automated decisionmaking technology for significant decisions, employment included, must comply by that date (California Privacy Protection Agency). That means a pre-use notice, an opt-out, and access to meaningful information about the system’s logic, inputs and outputs. The opt-out is not required where the candidate can appeal to a human reviewer with authority to overturn the decision (Lowenstein Sandler).

One bill did not survive: Governor Newsom vetoed SB 7, the “No Robo Bosses Act,” on October 13, 2025, citing overbroad notice duties and overlap with the privacy agency’s rules (Fisher Phillips).

Colorado: the AI Act was rewritten before it ever took effect

Colorado’s 2024 AI Act was first delayed from February 1 to June 30, 2026. In April 2026, xAI sued to block it, the U.S. Department of Justice moved to intervene, the state attorney general agreed not to enforce the law until after rulemaking, and a federal magistrate judge stayed enforcement on April 27 (Proskauer). The Justice Department argued that the law violates the Equal Protection Clause (DOJ).

The legislature then replaced it. SB 26-189 was signed on May 14, 2026 (Colorado General Assembly), and its obligations start January 1, 2027. It drops the old duty of care, risk-management program and impact assessments (Paul Hastings). The duties that remain are aimed at hiring tools that score or rank. Covered technology is anything that “materially influences” a consequential decision, including selection for a job; a tool that only summarizes or organizes information for a human is out unless it produces a score, ranking or recommendation. Employers must give clear notice before use, explain an adverse decision within 30 days, let people correct inaccurate data, offer meaningful human review where commercially reasonable, and keep records for three years. The attorney general enforces it, with a 60-day cure period until 2030 and no private right of action (Venable).

Texas: TRAIGA requires proof of discriminatory intent

The Texas Responsible Artificial Intelligence Governance Act (HB 149) was signed June 22, 2025 and took effect January 1, 2026 (Texas Legislature). For private employers it is narrow. It bars developing or deploying AI “with the intent to unlawfully discriminate” against a protected class, and says a disparate impact “is not sufficient by itself” to show intent. Its duty to disclose AI interactions applies to government agencies and health care, and leaves employers out. The attorney general alone enforces it, after a 60-day cure window, with no private right of action (enrolled text).

Connecticut: the newest entry on the map

Connecticut’s SB 5, the Artificial Intelligence Responsibility and Transparency Act, was signed in late May 2026. From October 1, 2026, using an automated employment-related decision technology is not a defense to a discrimination complaint, though evidence of anti-bias testing may be considered (Fisher Phillips). From October 1, 2027, employers must tell candidates when they are interacting with such a tool unless it is obvious, give a pre-decision notice when its output is a substantial factor, and explain an adverse decision with a chance to correct personal data (Holland & Knight). It does not require bias audits (Future of Privacy Forum).

New Jersey also belongs on the map: its disparate-impact rules, effective December 15, 2025, explicitly identify automated decision-making tools as a potential source of liability (Morgan Lewis).

The federal push against state AI laws has not erased any of them

On December 11, 2025, Executive Order 14365 directed the Attorney General to form an AI Litigation Task Force, the Commerce Department to publish an evaluation of “onerous” state AI laws within 90 days, and agencies to tie some broadband funding to state AI policy. It singles out Colorado’s algorithmic-discrimination law in its rationale. It does not, by itself, preempt or invalidate any state law (executive order text).

So far the order has produced the Justice Department’s intervention in the Colorado case; a White House framework on March 20, 2026 of nonbinding recommendations asking Congress to preempt burdensome state laws; and a Commerce evaluation that had not been published as of late March 2026 (Holland & Knight). We could not find a published version while writing this. Until a court or Congress actually acts, plan for the state laws as written.

What these laws ask of every recruiting team

Read side by side, the laws converge on a short list:

1. Know which tools score, rank or shortlist. That is the trigger almost everywhere: “materially influence” in Colorado, “substantial factor” in Connecticut.
2. Tell candidates before the tool is used. New York, Illinois, Colorado, Connecticut and California’s 2027 rules all require notice.
3. Be able to explain an adverse outcome. Colorado gives you 30 days, Connecticut requires an explanation too, and California’s privacy rules give candidates access to the logic behind the output.
4. Offer real human review, by a person with authority to change the result.
5. Keep the records. Four years in California, three in Colorado.
6. Test for disparate impact even where no audit is mandated. Illinois and New Jersey judge effect, and California and Connecticut will weigh your testing.

Two of these come down to evidence. On why a score should point to what was actually said, see evidence-based scorecards; on consistency across candidates, see structured interviews at scale.

Where Hure lands

Hure was designed around the questions these laws ask. Every score cites a verbatim moment in the transcript, against a sealed, versioned rubric, with the model version recorded. An adverse outcome can be explained from evidence, and the record still exists months later. Hure uses no biometrics and no emotion inference: it scores the content of what candidates say and ignores how they sound or look. And a human always makes the hiring decision. Hure’s Workflows have no reject action by design; adverse outcomes go to a human review queue. More on the product at the interviewer page.

A caveat on all of this: notices, bias audits under New York law, record retention and the review process itself are obligations on the employer, and no vendor’s architecture can discharge them for you. These rules are also still moving. Colorado’s obligations and California’s privacy rules arrive in January 2027, Connecticut’s later in 2027, and federal preemption is a live fight. Treat this as a map dated October 2026, and talk to counsel when the stakes are real.