TL;DR: No single US "AI hiring law" exists. As of July 2026 you comply with a patchwork. New York City makes you audit the tool. Illinois and Colorado ban discriminatory output. California logs it. Federal Title VII reaches every state. One live case, Mobley v. Workday , is trying to put the vendor on the hook too. This page maps who requires what, with dates and named sources. It is not legal advice.
A recruiter on r/recruiting, buried under 1,000 applications, asked the question no vendor answers: "Are any of the AI tools safe to use legally? ( Workday class-action?)" ( r/recruiting, quote 45, 2025-09-09 ). Tool marketing pages skip it. This AI hiring compliance guide collects the US rules that touch AI screening, ranking, and interviewing, each with its statute name, effective date, and teeth. Every claim ties to a named law or case, so you can check it.
AI hiring compliance in 2026: the map (US)
AI hiring compliance is the set of laws that govern automated tools used to screen, rank, or select job candidates. As of July 2026, no single US federal statute covers it. You comply with a patchwork: NYC Local Law 144, Illinois HB 3773, Colorado and California rules, plus federal Title VII, ADEA, and ADA. Seven jurisdictions matter most.
| Jurisdiction | Law (named) | Effective | Core duty | Teeth |
|---|---|---|---|---|
| New York City | Local Law 144 of 2021 (AEDT) | Enforced July 5, 2023 | Independent bias audit, public summary, 10-business-day candidate notice | $500 to $1,500 per violation, each day counts |
| Illinois | HB 3773, amending the Human Rights Act (775 ILCS 5) | Jan 1, 2026 | No AI with discriminatory effect; no ZIP code as a proxy; notify employees | Civil-rights charge via IDHR |
| Illinois | AI Video Interview Act (820 ILCS 42) | Jan 1, 2020 | Notice, consent, and deletion for AI-scored video interviews | State enforcement |
| Colorado | SB 24-205, the Colorado AI Act | June 30, 2026 (delayed from Feb 1, 2026) | Reasonable care against algorithmic discrimination; impact assessments; notice | Attorney General enforcement |
| California | Civil Rights Council ADS rules (FEHA) | Oct 1, 2025 | Automated systems must not cause FEHA discrimination; 4-year records | Civil-rights complaint |
| Maryland | HB 1202 | Oct 1, 2020 | Applicant consent before facial recognition in interviews | Statutory |
| Federal (all 50 states) | Title VII, ADEA, ADA + EEOC 2023 guidance | Title VII since 1964 | Disparate-impact analysis (four-fifths rule) applies to AI tools | EEOC, DOJ, and private lawsuits |
Laws last verified July 10, 2026 against the named statutes and rules. Confirm current effective dates before you act; two of these are still moving in 2026.
Which tools count? An AEDT is not only the flashy stuff. A resume parsing engine qualifies. So does a candidate screening filter inside your applicant tracking system. So does sourcing automation like hireEZ or LinkedIn Recruiter, a conversational screener like Paradox Olivia , or a scored one-way video interview. A ranking layer bolted onto your recruitment CRM through an ATS integration counts too. If a tool scores or ranks people, treat it as covered. High-volume hiring raises the stakes. The more candidates a talent acquisition team runs through the tool, the bigger the disparate-impact math behind the short time-to-hire the vendor sells.
If a tool scores or ranks candidates, treat it as a covered AEDT.
One thread runs through all seven rules. The vendor writes "compliant" into the sales deck, disclaims liability in the contract, and the employer inherits the risk anyway. Louis v. SafeRent Solutions is the money-anchor. In November 2024, the tenant-screening vendor settled a Fair Housing Act suit for $2.275 million. The algorithm had allegedly scored Black, Hispanic, and voucher-holding applicants worse. That was housing, not hiring, but the lesson carries. The AI vendor disclaims, and whoever used the score holds the bag.
Disclosure: we sell none of these tools. We have no affiliate or business tie to any vendor or law firm named here as of publication. Our funding model is in our editorial policy . For the screening tools themselves, see our AI resume screening tools roundup . The workflow overview is in AI recruiting tools .
NYC Local Law 144: bias audits explained
NYC Local Law 144 carries a $500 to $1,500 fine per violation. Each day of unaudited use counts as its own violation. It took effect January 1, 2023. The Department of Consumer and Worker Protection began enforcing it on July 5, 2023. Use a covered tool for a job located in New York City, and three duties apply before a single candidate runs through it.
AEDT (automated employment decision tool): a computer process, built from machine learning or data analytics, that outputs a score, a class, or a ranking. It counts when it substantially drives a hiring or promotion decision. A resume ranker is an AEDT. A calendar scheduler is not.
Bias audit: an impartial review by an independent auditor, run within the year before you use the tool. It measures the selection rate and the impact ratio for sex, for race and ethnicity, and for the two combined. You must publish a summary of the results on your site.
The third duty is notice. Tell each NYC candidate at least 10 business days before use that an AEDT will assess them. Name the job qualities it measures.
Here is the honest part. The employer using the tool pays for the audit, so "independent" has real limits. Compliance in practice has been thin. Researchers who went audit-hunting in 2024 found published audits scarce; most covered employers had posted nothing at all. A published audit is a floor, not a clean bill of health. It proves you measured impact. It does not prove the tool is fair.
Illinois HB 3773 and the state patchwork
Illinois HB 3773 took effect January 1, 2026. It amends the Illinois Human Rights Act. Now it is a civil-rights violation to use AI that has a discriminatory effect on protected classes in hiring, promotion, discipline, or discharge. Using a ZIP code as a stand-in for a protected class is banned too. Employers must also tell staff when AI is used in those calls. The Illinois Department of Human Rights enforces it.
Illinois moved first back in 2020. The AI Video Interview Act (820 ILCS 42) took effect January 1, 2020. It applies when you record video interviews and use AI to analyze them. It asks for three things. Tell the applicant that AI will be used and how it works. Get consent before the interview. Delete the video within 30 days of a deletion request.
Four more states fill in the map. Colorado's SB 24-205, the Colorado AI Act, is the first broad US "high-risk AI" law, and it covers major employment decisions. Lawmakers pushed its start date from February 1, 2026 to June 30, 2026, so confirm the current date. Deployers there owe reasonable care against algorithmic discrimination, plus impact assessments and candidate notice. In California, the Civil Rights Council's rules on automated decision systems took effect October 1, 2025. That state's anti-bias law (FEHA) now clearly reaches AI used in hiring, and employers must keep those records for four years. Maryland's HB 1202 (2020) asks for an applicant's consent before you use facial recognition in an interview. Texas passed the Responsible AI Governance Act, effective January 1, 2026, which bars building or using AI meant to discriminate unlawfully. Note the catch. It targets intent, not disparate impact.
One more point on federal power. An executive order cannot rewrite an Illinois law or an NYC local law. State duties stand on their own.
EEOC guidance and the Workday class-action
The four-fifths rule is the federal number to know. Under Title VII of the Civil Rights Act of 1964, a selection tool can trigger disparate-impact liability. The trigger is simple. It passes one protected group at less than 80% of the top group's rate. That math applies to an AI screener the same way it applies to a written test. The EEOC AI guidance said so directly on May 18, 2023. It ties back to the 1978 Uniform Guidelines on Employee Selection Procedures.
The live test of vendor liability is Mobley v. Workday , Inc., in the Northern District of California. The plaintiff, an applicant over 40, was rejected from more than 100 jobs. He alleges Workday 's AI screening discriminates by race, age, and disability. In July 2024, the judge let the case go forward on a theory that matters to every buyer. An AI vendor can be sued directly as an agent of the employers using its tool, under Title VII, the ADEA, and the ADA. In May 2025, the court granted conditional certification of a nationwide ADEA collective. Notice can now reach applicants aged 40 and up who were rejected through the platform. That is the " Workday class-action" the r/recruiting thread asked about.
The federal posture softened in 2025, and honesty means saying so. An executive order signed April 23, 2025 told agencies to deprioritize disparate-impact enforcement, and the EEOC pulled some AI guidance documents offline that year. What did not change? The disparate-impact rule is written into the statute (42 U.S.C. §2000e-2(k)). Private plaintiffs can still sue. State laws in Illinois, New York, California, and Colorado are untouched. A weaker federal enforcer is not a safe harbor. It changes who does the suing.
Which law applies where: a federal floor plus five state overlays.
The vendor-vetting checklist: 5 questions before you sign
Ask five questions in writing, and keep the answers. An HR generalist on r/humanresources named the fear: policies drafted with ChatGPT came back "riddled with legal errors" ( quote 20, 2025-11-13 ). Vendor marketing is not a compliance record. Each question below maps to a duty from the sections above.
- "Show me your latest bias audit and the impact ratios, by group." This is the NYC Local Law 144 duty. No audit, or a refusal to share numbers, tells you the tool is not audited for the market you hire in.
- "Which protected-class outcomes have you tested against the four-fifths rule?" This maps to Title VII and the EEOC AI guidance. A vendor who cannot answer has not measured the exact risk that gets employers sued.
- "What does your contract say about indemnification if the tool is found to discriminate?" Read the answer against Mobley v. Workday and SafeRent. Most contracts push the liability to you. Get the indemnity clause in writing before you sign.
- "How do you support candidate notice and accommodation in NYC, Illinois, and California?" These are the notice and consent duties. The tool should generate the notices. It should not leave you to build them by hand.
- "What is your data retention and deletion process?" California wants four-year records. Illinois wants interview video deleted on request. The two duties pull opposite ways, so the vendor needs an answer for both.
A vendor who treats these as fair questions is a safer buy than one who calls them a deal-blocker. To see how specific screening tools handle candidates, compare them in the screening tools roundup .
Compliance checklist by state
Use this as a copy-paste starting point, not a legal opinion. It answers "are any AI tools safe to use legally?" with a process, not a yes or no. A tool is safe to the degree you can prove you did the following.
- Everywhere (federal): confirm the vendor tested outcomes against the four-fifths rule. Keep the results. Keep a human making the final call, not the algorithm.
- Hiring for an NYC role: get an independent bias audit dated within the last 12 months. Publish the summary on your site. Send candidates notice at least 10 business days before use.
- Hiring in Illinois: tell employees AI is used. Confirm the tool does not use ZIP code as a proxy. For AI-scored video, get consent up front and delete on request within 30 days.
- Hiring in California: confirm the system does not cause FEHA discrimination. Keep those records for four years.
- Hiring in Colorado: track the June 30, 2026 start date. Plan for impact assessments and candidate notice on major decisions.
- Hiring in Maryland: get consent before any facial-recognition analysis in interviews.
- Every state, before signing: ask the five vendor questions above. File the answers with the contract.
AI hiring compliance changes every quarter. Bookmark the date at the bottom. Re-check before you rely on any single line.
No comments yet