AI hiring compliance in 2026 is a patchwork. No federal statute is written for it, and half a dozen state and city laws are, each with a different trigger and date. If you use AI anywhere in screening engineers, the rules that most likely touch you today are California's FEHA regulations (in force since October 1, 2025), Illinois' notice law (January 1, 2026) and NYC Local Law 144 (if the role ties to a New York office). Colorado and California's privacy rules land January 1, 2027. The EU's hiring rules slipped to December 2, 2027.
Everything below is general information, not legal advice. Laws in this area moved three times this year. Check the current status with counsel before you rely on a date.
Key Takeaways
- California already requires keeping automated-decision records for at least four years, and treats discriminatory ADS use as a FEHA violation.
- Illinois requires notice whenever AI is used in hiring decisions, with no "substantial factor" threshold, from January 1, 2026.
- Colorado repealed its original AI Act before it took effect; the replacement (SB 26-189) starts its key duties January 1, 2027.
- A December 2025 executive order targets state AI laws, but an executive order doesn't itself preempt them. Plan as if they apply.
The 2026 AI hiring compliance checklist
| Jurisdiction | Law | In force | What it asks of an employer using AI in hiring |
|---|---|---|---|
| New York City | Local Law 144 | Enforced since July 5, 2023 | Annual independent bias audit, published; notice to NYC-resident candidates 10 business days before use |
| Illinois (Illinois-based roles) | AI Video Interview Act | Since 2020 | Before an AI-analyzed video interview: notify, explain how the AI works, get consent; delete on request within 30 days |
| Illinois (employers with 1+ Illinois employee) | HB 3773 (Human Rights Act) | January 1, 2026 | No AI use that discriminates; no zip code as a proxy; notice of AI use in hiring and other decisions |
| California | FEHA ADS regulations | October 1, 2025 | Discriminatory ADS use can violate FEHA; keep records, including automated-decision data, at least four years |
| California | CCPA ADMT regulations | January 1, 2027 | If you meet the CCPA's "business" thresholds (mainly revenue above roughly $26M or large consumer-data volumes): notice, opt-out and access rights for ADMT used in significant decisions, which include employment |
| Colorado | SB 26-189 | Key duties January 1, 2027 | Notice at the point of interaction; plain-language explanation within 30 days of an adverse decision; rights to correct data and to meaningful human review |
| Texas | TRAIGA | January 1, 2026 | Bans AI used with intent to unlawfully discriminate; no disclosure duty for private employers |
| European Union | AI Act, Annex III | December 2, 2027 | Recruitment and candidate-evaluation AI is high-risk, with the obligations that come with it |
The ones that changed this year
Colorado. The original Colorado AI Act (SB 24-205) was delayed to June 30, 2026, then repealed and re-enacted by SB 26-189, signed May 14, 2026. So the first law never took effect. The new one is lighter: notice, an explanation after adverse decisions, and human review rights. Only the attorney general enforces it, with no private lawsuits, and there's a 60-day cure period before 2030. Separately, xAI sued over the old law in April 2026, the DOJ joined, and a stipulated order paused its enforcement, per McDermott's summary.
The EU. Hiring AI was due to become regulated as high-risk on August 2, 2026. Regulation (EU) 2026/1744, the "Digital Omnibus," moved stand-alone high-risk systems to December 2, 2027. Relevant if you hire EU-based engineers or sell to EU customers.
Illinois rulemaking. The Illinois Department of Human Rights proposed notice rules in May 2026, then withdrew them in June. The statute still applies. You just have less guidance on the exact form of notice.
What about federal law?
Two things to know. First, Executive Order 14365, "Ensuring a National Policy Framework for Artificial Intelligence," signed December 11, 2025, directed the Attorney General to set up a task force to challenge state AI laws and told Commerce to list "onerous" ones. An executive order doesn't repeal a state statute; courts or Congress would have to. Plan as if the state laws stand.
Second, the EEOC stepped back from disparate-impact-only investigations in 2025, but disparate impact is still in Title VII's text and private lawsuits remain possible. Less federal enforcement is not the same as less liability.
Six controls that cover most of it
You don't need a compliance team. You need habits that satisfy the overlap.
1. Inventory every AI tool that touches candidates: resume screeners, AI interviewers, scorers, sourcing tools. Note what decision each one influences. That includes anything a vendor runs for you, such as a scored shortlist from Sol, our hiring agent.
2. Give notice by default. One paragraph in every job post saying AI is used, for what, and how to ask for an accommodation or a human review. That handles Illinois, the notice half of NYC (which also needs 10 business days' lead time and a bias audit), and Colorado's direction of travel.
3. Keep a human in the decision. No auto-rejects on a score alone. Colorado's "meaningful human review" right and NYC's "substantially assists" test both reward this.
4. Keep records for four years. California's rule is the longest common denominator.
5. Ask vendors for bias audits and their data on adverse impact. If they don't have one, that's an answer.
6. No proxies. Strip zip code and similar proxies from anything that scores people (explicit in Illinois).
Our post on NYC Local Law 144 covers the audit mechanics in depth. For how to keep scoring structured and defensible, see the interview scorecard template.
A Concrete Version
A 25-person startup in Austin hires 8 engineers a year: two in California, one in Chicago, the rest in Latin America. It uses an AI tool to score coding tests and an AI notetaker on interviews.
Here's what applies. Texas TRAIGA covers intentional discrimination only, and the startup has no disclosure duty there. The California and Illinois hires bring FEHA's four-year record rule and Illinois' notice rule into play. The LATAM contractors sit outside these US state laws as far as their own location goes, though if the startup ever hires in the EU, the AI Act becomes relevant from December 2027.
The fix takes about a day: a notice paragraph on every job post, a rule that a human reads every coding report before a rejection, a shared folder retained for four years, and an email to both vendors asking for bias audits. That covers the California and Illinois hires today and most of what Colorado will ask in 2027.
The Honest Counterpoint
Two warnings. First, this table will age. Three of its rows changed in 2026 alone, and the federal-state fight isn't settled. Put a calendar reminder to re-check every quarter rather than trusting any blog post, this one included.
Second, compliance overhead can push a small team toward dropping AI tools entirely. That's sometimes the right call: if you hire four engineers a year, a human reading every application may be cheaper than audits and notices. AI screening pays off at volume, and the rules scale with it.
On Ruzora's side: our AI-led interview and coding assessment vet engineers for our bench, and clients make every hiring decision on blind profiles first, then identities after the MSA. A decision audit trail is on our roadmap and isn't live. If your counsel needs specifics about how a candidate was assessed, ask us before you hire.
Frequently Asked Questions
Which states regulate AI in hiring in 2026?
Illinois (AI Video Interview Act and HB 3773), California (FEHA automated-decision rules, with CCPA rules from 2027) and New York City (Local Law 144) are the main ones in force. Colorado's replacement law starts January 1, 2027, and Texas' TRAIGA bans intentional AI discrimination.
When does the EU AI Act apply to hiring?
Under Regulation (EU) 2026/1744, rules for stand-alone high-risk systems, including recruitment and candidate evaluation, apply from December 2, 2027, instead of the original August 2, 2026.
Does the December 2025 executive order cancel state AI hiring laws?
No. EO 14365 directs federal agencies to challenge state AI laws, but an executive order does not repeal them. They stay enforceable unless a court strikes them down or Congress preempts them.
The Bottom Line
AI hiring compliance in 2026 rewards four habits: tell candidates, keep a human in the decision, keep records for four years, and make vendors show their bias audits. Those cover most of what California, Illinois and NYC require now and what Colorado asks from 2027.
If you'd rather start from engineers already vetted with a structured coding assessment and AI-led interview, and keep the hiring decision with your team, request a shortlist.
Roberto Espinoza is CEO of Ruzora, which helps US startups hire pre-vetted senior LATAM engineers, with a vetted shortlist in 72 hours. See available engineers.
