Skip to content
AI Policy Generator

ESWhat applies

Hiring, evaluation or termination of staff in United States (federal): related rules

Using AI to target job ads, screen resumes, interview, score candidates or evaluate performance, promotions and terminations. It is the use case with the most laws in force worldwide because of its impact on the right to work and the risk of discrimination.

Risk classification

JurisdictionLevelDateNote
United States (federal)Sector rules—Title VII and the Uniform Guidelines still apply even though the EEOC withdrew its AI guidance in 2025.
New York (incl. NYC)Consequential decision—NYC Local Law 144: annual independent bias audit, published summary and candidate notice.
IllinoisConsequential decisionJanuary 1, 2026HB 3773: notice of AI use in employment decisions and ban on ZIP codes as a proxy; plus the AI Video Interview Act.
CaliforniaConsequential decisionOctober 1, 2025FEHA automated-decision system regulations: keep records for 4 years; anti-bias testing serves as a defense.
CaliforniaConsequential decisionJanuary 1, 2027CCPA ADMT: pre-use notice, opt-out or human appeal and access to logic for employment decisions.
ColoradoConsequential decisionJanuary 1, 2027SB 26-189: notice, explanation within 30 days, correction, human review and 3-year records; Attorney General rules pending.

Obligations related to this use case

Monitor AI selection tools for adverse impact

Title VII and ADA42 U.S.C. § 2000e-2(k); 29 CFR 1607.4(D) (regla de los cuatro quintos)In force

Already applicable

When it relates
Applies to employers with 15 or more employees that use AI in employment decisions. The "10 to 49" band includes companies below the threshold: check your headcount.
What the rule provides
  • Measure selection rates by sex, race and ethnicity before use and periodically.
  • If there is adverse impact, document job-relatedness and look for less discriminatory alternatives.
  • Require validation and bias-test data from the vendor.
  • Keep selection records for at least one year (29 CFR 1602.14).
Typical evidence
  • Adverse impact report per tool
  • Vendor contract and validation documentation
Verification
Pending confirmation in the official source (last checked: November 4, 2026)Checked in official sources: 42 U.S.C. § 2000e-2(k) (govinfo), 29 CFR 1607.4(D) (four-fifths rule) and 29 CFR 1602.14 (record retention) (eCFR). Not officially sourced: the EEOC's withdrawal of its AI guidance in January 2025 and the shift in enforcement priorities; the law did not change. The impact report is the recommended way to document a defense, not a legal requirement.

Offer reasonable accommodation and an alternative to AI assessment

Title VII and ADA42 U.S.C. § 12112(b)(5)-(7)In force

Already applicable

When it relates
Applies to employers with 15 or more employees that assess candidates with AI (tests, video interviews, games).
What the rule provides
  • Tell candidates how they are assessed and how to request an accommodation.
  • Offer an alternative assessment or human review where the tool may disadvantage people with disabilities.
  • Do not use tools that ask prohibited medical questions.
Typical evidence
  • Candidate notice with accommodation channel
  • Log of accommodation requests and responses
Verification
Pending confirmation in the official source (last checked: November 4, 2026)Checked on govinfo: 42 U.S.C. § 12112(b)(5)-(7) (reasonable accommodation, criteria that screen out people with disabilities and test administration). The ADA requires reasonable accommodation, not a specific written policy: the policy is the recommended way to document it. The EEOC's withdrawal of its AI guidance comes from secondary sources.

Risk assessment before using ADMT or other high-risk processing

CCPA ADMT and risk assessments11 CCR §§ 7150, 7151, 7152, 7155In force

Applies from January 1, 2026

When it relates
Applies to CCPA-covered businesses (revenue threshold, 100,000 residents or 50% of revenue from selling data) that use ADMT for significant decisions, infer traits of employees, applicants or students through systematic observation, process sensitive data, or train ADMT or facial recognition. Training models on your own data is not enough by itself. For processing that began before 2026 the deadline is December 31, 2027.
What the rule provides
  • Conduct and document the assessment before starting the processing.
  • Describe the specific purpose, data, concrete benefits, negative impacts and safeguards; involve the staff who take part.
  • Have it approved by a person with authority over the processing.
  • Review it at least every three years and update it within 45 days of a material change.
  • Keep it while the processing continues or for five years after completion, whichever is later.
  • For processing that already existed before January 1, 2026, the deadline is December 31, 2027.
Typical evidence
  • Signed, versioned risk assessment
  • List of contributors and approver
Verification
Verified in the official source on November 2, 2026Checked against the approved text published by CalPrivacy (§§ 7150 and 7155).

Submit assessment information to the agency with a signed attestation

CCPA ADMT and risk assessments11 CCR § 7157Adopted, applies later

Applies from April 1, 2028

When it relates
Applies to businesses that conducted risk assessments in 2026 or 2027.
What the rule provides
  • Submit the required information on 2026 and 2027 assessments by April 1, 2028, and every April 1 after that.
  • Include an attestation signed by an executive under penalty of perjury.
  • Provide the full assessment within 30 days if the agency or Attorney General requests it.
Typical evidence
  • Submitted form and confirmation
  • Signed attestation
Verification
Verified in the official source on November 2, 2026Checked against the approved text (§ 7157(a)(1)).

Pre-use notice for ADMT

CCPA ADMT and risk assessments11 CCR §§ 7200(b), 7220Adopted, applies later

Applies from January 1, 2027

When it relates
Applies to CCPA-covered businesses that use ADMT for significant decisions on lending, housing, education, employment or health care.
What the rule provides
  • Before using ADMT, explain the specific purpose, the right to opt out or appeal, the right of access, and how the ADMT works.
  • Explain in plain language which data affect the output and how the decision would be made if the person opts out.
  • Uses that began before 2027 must comply by January 1, 2027; new uses from first use.
Typical evidence
  • Published or delivered pre-use notice
Verification
Verified in the official source on November 2, 2026Date checked against the approved text (§ 7200(b)); notice content per § 7220.

Offer an ADMT opt-out or a human appeal

CCPA ADMT and risk assessments11 CCR § 7221Adopted, applies later

Applies from January 1, 2027

When it relates
Applies to CCPA-covered businesses that use ADMT for significant decisions.
What the rule provides
  • Offer at least two ways to opt out, without requiring an account.
  • Or, instead, offer an appeal reviewed by a person with authority to change the decision, if the exception's conditions are met.
  • State in the notice which exception you rely on.
Typical evidence
  • Opt-out or appeal form and request log
Verification
Verified in the official source on November 2, 2026Checked against the approved text (§§ 7220 and 7221).

Respond to ADMT access requests

CCPA ADMT and risk assessments11 CCR § 7222Adopted, applies later

Applies from January 1, 2027

When it relates
Applies to CCPA-covered businesses that use ADMT for significant decisions.
What the rule provides
  • Explain the specific (not generic) purpose for which ADMT was used about that person.
  • Explain the ADMT's logic, the output produced and how it was used in the decision.
Typical evidence
  • Access response template and response log
Verification
Verified in the official source on November 2, 2026Checked against the approved text (§ 7222).

Do not use discriminatory automated-decision systems (anti-bias testing supports a defense)

FEHA automated-decision systemsCal. Code Regs., tit. 2, § 11009 y ss.In force

Applies from October 1, 2025

When it relates
Applies to employers with 5 or more employees using AI or algorithms with applicants or employees in California.
What the rule provides
  • Do not use systems that discriminate based on protected characteristics or proxies.
  • Recommended: run anti-bias tests before use and periodically and act on the results; their existence, quality and outcome are relevant to a defense, although the regulations do not impose them as a standalone duty.
  • Offer reasonable accommodation when the system assesses traits linked to disability or religion.
Typical evidence
  • Anti-bias test reports with date, scope and actions taken
Verification
Pending confirmation in the official source (last checked: November 4, 2026)Effective date (Oct 1, 2025) and OAL approval (Jun 27, 2025) checked in the CRD's official press release. The official text of 2 CCR § 11009 et seq. is still missing; the substantive content comes from law firms (Mayer Brown, Jackson Lewis).

Keep automated-decision system data for four years

FEHA automated-decision systemsCal. Code Regs., tit. 2, § 11013(c)In force

Applies from October 1, 2025

When it relates
Applies to FEHA-covered employers that use these systems.
What the rule provides
  • Keep inputs, outputs and data used to configure or customize the system for four years.
Typical evidence
  • Retention policy and decision records
Related base documents
Verification
Pending confirmation in the official source (last checked: November 4, 2026)The CRD's official press release (Jun 30, 2025) confirms that employment records, including automated-decision system data, must be kept for at least four years. The section number (2 CCR § 11013(c)) still has to be checked in the official text.

Oversee hiring-tool vendors

FEHA automated-decision systemsCal. Code Regs., tit. 2, § 11008 (definición de agente)In force

Applies from October 1, 2025

When it relates
Applies if a vendor screens, filters or evaluates people on your behalf.
What the rule provides
  • Ask the vendor for anti-bias testing and access to the data needed to keep records.
  • Set responsibilities, audit rights and cooperation on complaints in the contract.
Typical evidence
  • Due diligence questionnaire and signed contract
Verification
Pending confirmation in the official source (last checked: November 4, 2026)The official text of 2 CCR § 11008 (agent definition) is still missing; the content comes from law firms and specialist publications. The CRD press release does not give section numbers.

Annual independent bias audit

NYC Local Law 144N.Y.C. Admin. Code § 20-871(a)(1); 6 RCNY § 5-301In force

Already applicable

When it relates
Applies if you use an AEDT to make or substantially assist hiring or promotion decisions in New York City.
What the rule provides
  • Commission an audit from an independent auditor before use and at least every 12 months.
  • Calculate selection or scoring rates and impact ratios by sex, race/ethnicity and their intersections.
  • Obtain the necessary historical data from the vendor.
Typical evidence
  • Audit report signed by the independent auditor
Related base documents
Verification
Verified in the official source on November 2, 2026Enforcement date and the duty to have an audit less than one year old checked on nyc.gov; calculation method and independence requirement from secondary sources.

Publish the audit summary

NYC Local Law 144N.Y.C. Admin. Code § 20-871(a)(2); 6 RCNY § 5-303In force

Already applicable

When it relates
Applies to anyone using an AEDT in New York City.
What the rule provides
  • Post on the careers website the date of the latest audit, a summary of results and the date the tool was first used.
Typical evidence
  • Web page with the published summary
Related base documents
Verification
Verified in the official source on November 2, 2026Duty to publish the summary checked on nyc.gov.

Notify candidates and employees 10 business days in advance

NYC Local Law 144N.Y.C. Admin. Code § 20-871(b); 6 RCNY § 5-304In force

Already applicable

When it relates
Applies to New York City candidates and employees assessed with an AEDT. It does not extend to the rest of New York State.
What the rule provides
  • Give notice that an AEDT will be used and which qualifications and characteristics it will assess.
  • Explain how to request an alternative process or reasonable accommodation.
  • Provide, on request, the type and source of data and the retention policy.
Typical evidence
  • Dated notice, posted or sent
Verification
Verified in the official source on November 2, 202610-business-day period checked on nyc.gov; notice content from secondary sources.

Do not use AI with discriminatory effect or ZIP codes as a proxy

Illinois HB 3773775 ILCS 5/2-102(L)(1)In force

Applies from January 1, 2026

When it relates
Applies to employers with workers or candidates in Illinois that use AI in employment decisions.
What the rule provides
  • Prohibit in internal policy the use of ZIP codes as a proxy for protected characteristics.
  • Check whether the tool produces unequal outcomes by group; the law does not require an audit, but it is the best defense.
Typical evidence
  • AI-in-employment policy
  • Bias review report (voluntary)
Related base documents
Verification
Pending confirmation in the official source (last checked: November 4, 2026)ilga.gov refused the connection on Nov 4, 2026, so the official text is still unchecked. The wording of the duty in 775 ILCS 5/2-102(L) still has to be confirmed. The effective date (Jan 1, 2026) and the withdrawal of the IDHR proposed rules (Jun 2, 2026) come from consistent secondary sources (Seyfarth, Burke, National Law Review).

Give notice of AI use in employment decisions

Illinois HB 3773775 ILCS 5/2-102(L)(2)In force

Applies from January 1, 2026

When it relates
Applies to employers with workers or candidates in Illinois that use AI in employment decisions.
What the rule provides
  • Tell employees (and, as good practice, candidates) that AI is used and for which decisions.
  • As good practice, include the tool and vendor name, as the withdrawn IDHR draft required.
Typical evidence
  • Dated notice, delivered or posted
Supporting documents
Verification
Pending confirmation in the official source (last checked: November 4, 2026)ilga.gov refused the connection on Nov 4, 2026, so the official text is still unchecked. The wording of the duty in 775 ILCS 5/2-102(L) still has to be confirmed. The effective date (Jan 1, 2026) and the withdrawal of the IDHR proposed rules (Jun 2, 2026) come from consistent secondary sources (Seyfarth, Burke, National Law Review).

Clear consumer notice of ADMT use

Colorado SB 26-189SB 26-189 (C.R.S. 6-1-17xx), obligaciones del deployerAdopted, applies later

Applies from January 1, 2027

When it relates
Applies if you use ADMT that materially influences decisions on employment, housing, health care, education, lending or insurance for Colorado consumers.
What the rule provides
  • Give a clear and conspicuous notice at the point of interaction that ADMT is used.
Typical evidence
  • Published notice and screenshots of interaction points
Verification
Verified in the official source on November 2, 2026Signing, dates and obligations checked on leg.colorado.gov on Nov 2, 2026. Exact content will depend on the Attorney General's rules, still pending.

Explanation within 30 days after an adverse decision

Colorado SB 26-189SB 26-189, obligaciones del deployerAdopted, applies later

Applies from January 1, 2027

When it relates
Applies to ADMT deployers in consequential decisions about Colorado consumers.
What the rule provides
  • Within 30 days of an adverse outcome, explain in plain language the decision and the role of ADMT.
  • Explain how to request information about the system, its data and the rights of correction and review.
Typical evidence
  • Explanation template and delivery log
Verification
Verified in the official source on November 2, 202630-day period checked on leg.colorado.gov; details subject to Attorney General rules.

Data correction and human review

Colorado SB 26-189SB 26-189, derechos del consumidorAdopted, applies later

Applies from January 1, 2027

When it relates
Applies to ADMT deployers in consequential decisions about Colorado consumers.
What the rule provides
  • Let consumers access their personal data and correct inaccurate data.
  • Offer meaningful human review and reconsideration after an adverse outcome, by a trained person with authority to change it.
Typical evidence
  • Review procedure and log of requests and outcomes
Verification
Verified in the official source on November 2, 2026Checked on leg.colorado.gov.

Developer technical documentation for deployers

Colorado SB 26-189SB 26-189, obligaciones del desarrolladorAdopted, applies later

Applies from January 1, 2027

When it relates
Applies to those who develop or sell ADMT used in consequential decisions about Colorado consumers. Selling an AI product is not enough: in the assessment, select the type of decision your product supports.
What the rule provides
  • Give each deployer documentation on intended uses, training data categories, known limitations and instructions for use and human review.
  • Notify deployers of material updates.
Typical evidence
  • Delivered technical documentation and version log
Related base documents
Verification
Verified in the official source on November 2, 2026Checked on leg.colorado.gov.

Keep compliance records for three years

Colorado SB 26-189SB 26-189, conservación de registrosAdopted, applies later

Applies from January 1, 2027

When it relates
Applies to developers and deployers covered by the law.
What the rule provides
  • Keep records showing compliance for at least three years, with version identifiers.
Typical evidence
  • Decision log and system version log
Related base documents
Verification
Verified in the official source on November 2, 2026Three-year period checked on leg.colorado.gov.

Related base documents

Related kits

Includes 5 documents

HR and AI Recruiting Kit

AI hiring policy, notice to workers and representatives, meaningful human oversight, DPIA and decision review for candidates and employees.

USD 129USD 215

Complete kit · available to buy

Includes 5 documents

US AI in Employment Kit (New York, Illinois, California, Colorado)

Reference template for the impact-ratio bias audit report (in New York City an independent auditor performs it), AI hiring policy, AI-use notice to candidates, human oversight and a decision log, related to New York, Illinois, California and Colorado employment rules.

USD 119USD 215

Complete kit · available to buy

Find out what applies to you (free)United States (federal)