AI in hiring: a 2026 compliance checklist for US employers

FlourishAIHR · Published October 18, 2026 · Method note

This article is general information, current to the best of our knowledge in October 2026. It is not legal advice. Several of these laws have had effective dates changed; verify the current status with qualified counsel before relying on it.

The common requirements

Across jurisdictions, four obligations recur: notice to candidates that an automated tool is used and what it assesses; bias testing of the tool's outcomes by protected group; human oversight of consequential decisions, with a way for a candidate to request an alternative or an appeal; and records — of the audit, the notice and the decisions — kept for a defined period. Design your process to satisfy the strictest version and most of the patchwork is covered.

New York City — Local Law 144

In force since July 2023. Employers using an automated employment decision tool for hiring or promotion of NYC candidates must have an independent bias audit within the past year, publish a summary of the results, give candidates at least ten business days' notice before use, disclose the job qualifications the tool assesses, and provide a way to request an alternative process or accommodation. Penalties accrue per day of non-compliance.

Illinois — HB 3773 (amending the Human Rights Act)

Effective 1 January 2026. Employers may not use AI in recruitment, hiring, promotion, discipline or discharge in a way that has a discriminatory effect on protected classes, may not use zip codes as a proxy for protected classes, and must notify employees and applicants when AI is used for these decisions. Illinois also retains its earlier Artificial Intelligence Video Interview Act, which requires consent before AI analysis of recorded interviews.

Colorado — SB 24-205 (Colorado AI Act)

The first comprehensive state law on high-risk AI, which expressly includes employment decisions. Its effective date was delayed from February to 30 June 2026 after lawmakers failed to agree amendments in a 2025 special session. Deployers of high-risk systems must maintain a risk-management programme, complete impact assessments, notify individuals when a high-risk system is used in a consequential decision, explain adverse decisions and allow correction and appeal, and report discovered algorithmic discrimination to the Attorney General. Confirm the current status; further amendment has been debated.

California

Civil Rights Council regulations on automated-decision systems in employment took effect 1 October 2025: an employer is liable for discriminatory outcomes of tools it uses, anti-bias testing is relevant evidence, and records of automated-decision data must be kept for four years. Separately, the California Privacy Protection Agency's automated decision-making technology regulations impose notice and opt-out obligations for significant decisions, with compliance deadlines phased into 2027.

Federal — Title VII, ADA, ADEA

Federal anti-discrimination law applies to hiring tools regardless of technology: disparate impact under Title VII, screening out people with disabilities under the ADA, and age discrimination under the ADEA. The EEOC's 2023 technical-assistance documents on AI were withdrawn in 2025, but the statutes and the Uniform Guidelines on Employee Selection Procedures did not change. Adverse-impact analysis (including the four-fifths rule as a screening heuristic) remains the practical standard.

EU AI Act — for US employers hiring in Europe

AI used for recruitment, selection, evaluation or promotion is classified as high-risk. Deployers must use the system per the provider's instructions, ensure human oversight by trained staff, inform affected workers, keep logs and carry out a fundamental-rights impact assessment in some cases. The high-risk obligations were scheduled to apply from 2 August 2026; the Digital Omnibus package adopted by the European Parliament in June 2026 moves that to 2 December 2027, pending final Council approval. Treat the later date as likely but not yet certain.

The checklist

1. Inventory every tool that scores, ranks, screens or recommends candidates or employees — including features inside your ATS.
2. For each, record what it assesses, which decisions it feeds, and which jurisdictions' candidates it touches.
3. Give candidates plain-language notice before use; keep proof of the notice.
4. Run or commission a bias audit at least annually; publish a summary where required (NYC) and keep the full results.
5. Ensure a named human approves every consequential decision and that the log shows it.
6. Offer an alternative process or accommodation route and track requests.
7. Keep records — notices, audits, decisions, overrides — for at least four years.
8. Put the vendor's obligations (audit cooperation, data isolation, no training on your data, incident notice) in the contract.
9. Review the inventory and this checklist each quarter; effective dates move.

The FlourishAIHR platform is designed around items 3, 5, 6 and 7 — notice support, named human approval, alternative-process tracking and a complete audit log — and a pilot produces those records from week one. The audit itself (item 4) should be performed by an independent party.

Sources

• NYC Department of Consumer and Worker Protection, Local Law 144 of 2021 and implementing rules.
• Illinois General Assembly, HB 3773 (Public Act 103-0804).
• Colorado General Assembly, SB 24-205 and SB 25B-004.
• California Civil Rights Council, Employment Regulations Regarding Automated-Decision Systems (effective 1 October 2025); California Privacy Protection Agency ADMT regulations.
• U.S. EEOC, Title VII, ADA, ADEA; Uniform Guidelines on Employee Selection Procedures (29 CFR 1607).
• Regulation (EU) 2024/1689 (AI Act), Annex III; European Parliament vote on the Digital Omnibus on AI, 16 June 2026.