AI Recruiting Academy › Module 4: Risk, law and fairness
The short answer
Every US employer is covered by the existing anti discrimination laws, which apply to AI the same way they apply to any hiring method. On top of those, a handful of places have AI specific rules: New York City (bias audits and notice), Illinois (notice and a ban on discriminatory AI), California (anti discrimination rules now, privacy rules from 2027) and Colorado (notice and appeal rights from 2027). The EU treats recruiting AI as high risk, with its main duties starting in December 2027.
What decides which rules apply is usually where the job or the candidate is, not where your company is based.
Do the old anti discrimination laws cover AI?
Yes. Title VII, the Americans with Disabilities Act and the Age Discrimination in Employment Act cover any way you select people, whether a person, a test or a model makes the call. The EEOC removed its AI hiring guidance from its website in early 2025, and an April 2025 executive order told federal agencies to drop disparate impact enforcement. Neither changed the laws themselves, and private lawsuits such as Mobley v. Workday continue.
There is also no federal AI hiring law that overrides the states. A December 2025 executive order set up a federal task force to challenge state AI laws, but as Tech Policy Press reports, states enacted more than 100 new AI laws in the first half of 2026 regardless. For now, state and city rules stand until a court or Congress says otherwise.
Which AI hiring laws are on the books?
| Where | Law | What you must do | In force |
|---|---|---|---|
| New York City | Local Law 144 | Annual independent bias audit, public summary, candidate notice with an alternative process | Since July 2023 |
| Illinois | AI Video Interview Act | Tell candidates AI analyzes video interviews, explain how it works, get consent, limit sharing, delete on request | Since January 2020 |
| Illinois | Human Rights Act, as amended by HB 3773 | No AI that discriminates, no zip codes as a proxy, notice whenever AI influences employment decisions | Since January 2026 |
| California | Civil Rights Council rules under FEHA | Existing discrimination law applies to automated tools; keep tool data four years; bias testing counts as evidence | Since October 2025 |
| California | CCPA rules on automated decisionmaking | Risk assessment, pre use notice, opt out or human appeal, access to information | From January 2027 |
| Colorado | SB 189 of 2026 (replaces the 2024 AI Act) | Notice when AI is used in a decision, plain explanation after a rejection, data correction, human review | From January 2027 |
| European Union | AI Act | Recruiting AI is high risk: human oversight, logs, monitoring, worker notice. Emotion recognition at work is already banned | Main duties from December 2027 |
What does Illinois require?
Illinois has two laws. The older AI Video Interview Act applies when AI analyzes recorded video interviews for Illinois based jobs: you must tell the candidate, explain how the AI works and what it looks at, and get consent first.
The newer amendment to the Illinois Human Rights Act, in force since January 1, 2026, makes it a civil rights violation to use AI that discriminates, or to use zip codes as a stand in for protected traits, and requires notice when AI is used in hiring and other employment decisions. Draft rules from the Illinois Department of Human Rights, summarized by Hinshaw, would require the notice in job postings and name the product, the vendor, the decisions it affects and the data it uses. The draft also covers recruiters and agencies acting for an employer.
What does California require?
California has two layers. Since October 2025, rules under the state’s Fair Employment and Housing Act confirm that automated decision systems fall under discrimination law, that vendors acting for an employer can be treated as its agents, and that tool data must be kept for four years.
From January 1, 2027, privacy rules under the California Consumer Privacy Act add duties for businesses with more than $25 million in revenue that use automated tools to replace or substantially replace human decisions on hiring. According to Littler, that means a documented risk assessment, a pre use notice, and a right to opt out or appeal to a human. Real human review, by someone who understands the output and can change the decision, can take a process outside these rules.
What happened to Colorado’s AI Act?
Colorado passed the first broad state AI law in 2024, then delayed its start date. In April 2026 a federal court paused enforcement after a legal challenge, and in May 2026 the state replaced it. The new law, SB 189, summarized by McDermott Will & Emery, drops the impact assessment and anti discrimination duties and keeps four candidate protections: notice when AI is used in a consequential decision, a plain language explanation within 30 days of a rejection, a chance to correct data, and human review. It starts January 1, 2027, and could still change.
What about the EU and the UK?
The EU AI Act lists AI used to target job ads, filter applications and evaluate candidates as high risk. The EU agreed in 2026 to move those duties from August 2026 to December 2, 2027, as Ogletree explains. Some rules already apply, including the ban on emotion recognition in the workplace, so an interview tool that claims to read candidates’ emotions is off limits for EU roles now.
In both the EU and the UK, data protection law also applies. Article 22 of the GDPR gives people the right not to be subject to decisions based solely on automated processing that significantly affect them, which covers an automatic rejection.
How do you work out which laws apply to you?
Start with the job and the candidate. New York City’s law turns on jobs located in the city, Illinois on Illinois based roles and applicants, California’s privacy rules on California residents. A company in Texas hiring for a New York City role is covered.
List every tool that touches a decision. Screening, ranking, assessments, video analysis, chatbots that reject people and matching features inside your ATS all count.
Check how much weight the output carries. Several laws only apply when the tool replaces or substantially drives the decision. Meaningful human review changes the picture.
Plan for the strictest rule. If you hire in several places, one process that meets the toughest standard is easier than five different ones.
Recheck twice a year. This area changes fast. Colorado’s law was rewritten about six weeks before it was due to start.
Quick answers
I am an agency recruiter. Do these laws apply to me or my client?
Often both. New York City’s law names employment agencies directly, and Illinois’ draft rules cover agents acting for employers. Agree in writing who handles audits and notices.
Does using ChatGPT to rank resumes count?
It can. If a general AI tool ranks, scores or filters candidates and you rely on the result, it is being used in an employment decision. Lesson 5 covers the data side.
Is there one federal AI hiring law coming?
Not yet. Proposals to override state laws have been discussed in Congress but none has passed.
What is the single most useful step?
Keep a written list of every AI tool in your hiring process, what it decides, and where the roles are. Every law above starts there.
This lesson explains the law in plain English as of September 2026. It is not legal advice; check your own situation with an employment lawyer.