AI rules for employers and HR teams in 2026

Which AI rules apply to employers in 2026?

An employer that uses AI to recruit, screen, promote, monitor, or schedule workers is bound by federal anti-discrimination law, by the AI-specific rules of each state or city where it hires, and, if it hires in the EU or uses AI output there, by the EU AI Act. As of October 2026, the AI-specific duties already in force include New York City’s bias audit law, Illinois’s amended Human Rights Act and AI Video Interview Act, California’s civil rights regulations, and the EU ban on emotion recognition in the workplace. Colorado’s law and California’s privacy rules on automated decisionmaking add duties from January 1, 2027.

Two facts decide most of the list: where the job or the worker is located, and how many employees you have. Each row in the table links to the rule’s text or to a guide; most point into the employment and HR guide.

How do headcount and location change which rules apply?

Headcount sets the floor and location sets the rest. The thresholds differ enough that a small employer can be outside federal law and still inside a state’s.

• Federal: Title VII and the ADA cover employers with 15 or more employees for each working day in 20 or more calendar weeks of the current or preceding year. The ADEA uses 20 employees on the same count.
• California: the Fair Employment and Housing Act covers employers of 5 or more employees, so the October 2025 regulations reach any California employer of that size. The privacy agency’s ADMT rules reach only for-profit businesses that do business in California and meet one of the CCPA thresholds: annual gross revenue above $26,625,000 in the preceding calendar year (the CPI-adjusted figure in effect since January 1, 2025); buying, selling, or sharing the personal information of 100,000 or more consumers or households; or deriving 50 percent or more of annual revenue from selling or sharing personal information.
• Illinois: since July 1, 2020, the Human Rights Act has defined an employer as any person with one or more employees in Illinois during 20 or more calendar weeks, so HB 3773 reaches nearly every employer that hires there.
• New York City: Local Law 144 turns on the job’s location, not headcount. DCWP’s FAQ says it applies when the job is at a city office at least part time, or is fully remote but associated with a city office.
• Colorado: the enacted law defines a consumer to include an employee and a job applicant who is a Colorado resident, and covers a deployer doing business in Colorado. The text sets no employee-count threshold.
• EU: the AI Act covers deployers located in the EU and providers and deployers elsewhere whose AI output is used in the EU.

Who is liable when a vendor’s AI tool discriminates?

Both the employer and the vendor can be liable. Buying a tool adds a second responsible party; it does not move the duty off the employer.

California’s Civil Rights Council regulations define an employer’s agent to include a party acting on its behalf, including through an automated-decision system. New Jersey’s Division on Civil Rights wrote in January 2025 that a covered entity can violate the Law Against Discrimination even if it has no intent to discriminate and even if a third party developed the tool. Its guidance states that it imposes no new requirements beyond the statute.

In Mobley v. Workday (N.D. Cal., No. 3:23-cv-00770), the court preliminarily certified a nationwide collective of applicants age 40 and over on May 16, 2025. In July 2025 it held that the collective includes applicants screened with Workday’s HiredScore features. On June 22, 2026, according to a Duane Morris summary, the court let the California FEHA claims proceed, finding that the plaintiffs adequately alleged Workday screened applications from its California headquarters and that, as an alleged agent, Workday would be directly rather than derivatively liable under FEHA. It dismissed one plaintiff’s newly added Title VII race claim as outside the leave to amend. The case was still pending as of October 2026. Plaintiffs moved for class certification on September 14, 2026; Workday’s opposition and any motion to decertify the age collective are due November 10, 2026, and the court has set a hearing for March 9, 2027.

What is the federal enforcement position on AI hiring bias?

None of the federal changes since January 2025 amends a statute. They change what federal agencies enforce and the legal positions the government takes. Courts, not agencies, decide private suits, and a Justice Department opinion does not bind them.

• Secondary sources report that the EEOC removed its AI technical assistance documents from its website in January 2025.
• Executive Order 14281, signed April 23, 2025, directs agencies to deprioritize disparate impact enforcement. Reports describe a September 2025 EEOC memo directing closure of charges that rest only on disparate impact.
• On June 9, 2026, the Justice Department’s Office of Legal Counsel advised the EEOC that its Title VII disparate impact guidelines are unconstitutional, and read the business-necessity defense to require only that a practice rationally serve a valid business purpose. The opinion states that it does not address disparate impact under the ADEA, and law firm summaries note that it does not amend Title VII or bind courts.
• The EEOC’s regulatory agenda lists rescinding the interpretive portions of the Uniform Guidelines on Employee Selection Procedures, with a final action projected for November 2026, according to Ogletree’s July 2026 summary. No final rule had been published in the Federal Register as of October 21, 2026.

Title VII still makes a practice that causes a disparate impact unlawful unless the employer shows it is job-related and consistent with business necessity. The practice is also unlawful where a plaintiff shows a less discriminatory alternative practice that the employer refuses to adopt (42 U.S.C. 2000e-2(k)). The ADA still requires reasonable accommodation in an AI-driven application process. A lighter federal docket does not shorten a private plaintiff’s claim or a state agency’s.

What notices and audits are due, and when?

New York City and Illinois require notice now; Colorado and California’s privacy rules add it from January 1, 2027. Of the rules on this page, New York City’s is the one that requires a bias audit by name.

• New York City: an independent bias audit within one year before use, with a posted summary. Notice to candidates and employees who live in the city, 10 business days before use, stating that an AEDT is in use, the qualifications or characteristics it assesses, and how to request an accommodation. A website notice can serve applicants; a written policy can serve promotion candidates.
• Illinois: notice when AI is used in covered decisions. The Department of Human Rights withdrew its proposed notice rules on June 2, 2026, so the statute governs without implementing rules. For recorded video interviews analyzed by AI, notice, an explanation of what the AI evaluates, and consent before the interview.
• California, from January 1, 2027: a pre-use notice covering the ADMT’s purpose, how it works, and the applicant’s access, opt-out, and appeal rights. Risk assessment duties under the same regulations began January 1, 2026, with attestations due April 1, 2028.
• Colorado, from January 1, 2027: clear and conspicuous notice before using covered ADMT, a plain-language description of its role within 30 days after an adverse decision, and meaningful human review on request, to the extent commercially reasonable. Enforcement is limited by the court order in X.AI LLC v. Weiser described above.
• EU, from December 2, 2027: employers that deploy high-risk AI must inform workers’ representatives and affected workers before putting the system into service at the workplace.

No law in this list sets a pass or fail score for an audit. California treats evidence of anti-bias testing, or its absence, as relevant to a claim or defense.

What about AI that monitors or schedules workers?

New York Civil Rights Law 52-c requires an employer with a place of business in New York that monitors employee phone, email, or internet use to give written notice on hiring, obtain a written or electronic acknowledgment, and post the notice. The Attorney General enforces it, with civil penalties of up to $500 for a first offense, $1,000 for a second, and $3,000 for each later offense.

California’s privacy regulations count the allocation or assignment of work, and compensation, as significant decisions. Their ADMT definition includes profiling, such as analysis of performance at work, when it replaces or substantially replaces human decisionmaking (11 CCR 7001). Colorado’s law excludes routine scheduling and workflow management that does not materially influence a covered decision. The EU AI Act lists AI that allocates tasks based on individual behavior or traits, or that monitors and evaluates performance, as high-risk, and has banned emotion recognition in the workplace, except for medical or safety reasons, since February 2, 2025.

What must a contract with an AI hiring vendor cover?

The contract should buy you the evidence your own duties require. A vendor’s assurance does not move the duty: New Jersey’s Division on Civil Rights says a covered entity is not shielded from liability because a third party developed the tool, and DCWP’s FAQ leaves the employer ultimately responsible for the bias audit.

• Independent bias audit results the employer can post, with the data sources used; DCWP’s FAQ lets a vendor arrange the audit but leaves the employer responsible for it
• Technical documentation on intended use, training data categories, known limits, and human review, which Colorado requires developers to give deployers from January 1, 2027
• Enough information to answer a California access request about the tool’s purpose, logic, and output
• Logs and records kept at least four years, the California minimum
• For EU high-risk deployers, the system’s automatically generated logs under the deployer’s control, kept for a period appropriate to the intended purpose and at least six months, unless EU or national law, in particular data protection law, provides otherwise (Article 26(6))
• Advance notice of model changes, new features, and acquired products such as HiredScore in Mobley
• Support for accommodations and an alternative process for applicants with disabilities
• A statement whether the vendor acts as a consumer reporting agency under the FCRA
• Cooperation with regulators and litigation holds

What should an employer do in the first 90 days?

• Inventory every tool that screens, ranks, scores, schedules, or monitors applicants or workers, including features inside your applicant tracking system
• Map each tool to the locations of the jobs and people it touches, and to your headcount in each state
• Confirm a current independent bias audit and a posted summary for every tool used on New York City jobs
• Post New York City notices at least 10 business days before use, give Illinois notice of AI use now (the statute sets no timing and no implementing rule is in force), and keep dated copies
• Give and collect acknowledgments for New York electronic monitoring notices, and post the notice
• Run adverse impact testing by sex, race and ethnicity, and age, and remove zip codes and other proxies from inputs
• Draft the California and Colorado pre-use notices and the adverse-decision explanation now, for January 1, 2027
• Rewrite vendor contracts to cover audit data, documentation, change notice, records, and cooperation
• Set a four-year retention rule for automated-decision data
• For EU hiring, check every interview and call-center tool for emotion recognition, and plan worker consultation for December 2, 2027

Where to read more

The employment and HR guide covers each law in detail. The US state AI laws guide covers Colorado SB 26-189, the California privacy rules, and the federal preemption push. The EU AI Act guide covers provider and deployer duties and the Digital Omnibus dates, and the governance frameworks guide covers NIST and ISO programs that can organize the work.

This page is general information as of October 2026, not legal advice. Confirm obligations with employment counsel or the relevant agency in each place you hire.