Skip to content
AI Policy Generator

ESWhat applies

Algorithmic worker management (shifts, tasks, pay) in United States (federal): related rules

Systems that assign shifts, tasks, routes or pay, set targets or decide incentives and penalties without a supervisor in each case. They affect working conditions, so platform and algorithmic information laws require transparency and human oversight.

Risk classification

JurisdictionLevelDateNote
CaliforniaConsequential decisionJanuary 1, 2027CCPA ADMT covers work allocation and compensation as significant decisions.
ColoradoConsequential decisionJanuary 1, 2027SB 26-189 covers employment decisions, including independent contracting.
IllinoisConsequential decisionJanuary 1, 2026HB 3773 covers terms and conditions of employment.

Obligations related to this use case

Monitor AI selection tools for adverse impact

Title VII and ADA42 U.S.C. § 2000e-2(k); 29 CFR 1607.4(D) (regla de los cuatro quintos)In force

Already applicable

When it relates
Applies to employers with 15 or more employees that use AI in employment decisions. The "10 to 49" band includes companies below the threshold: check your headcount.
What the rule provides
  • Measure selection rates by sex, race and ethnicity before use and periodically.
  • If there is adverse impact, document job-relatedness and look for less discriminatory alternatives.
  • Require validation and bias-test data from the vendor.
  • Keep selection records for at least one year (29 CFR 1602.14).
Typical evidence
  • Adverse impact report per tool
  • Vendor contract and validation documentation
Verification
Pending confirmation in the official source (last checked: November 4, 2026)Checked in official sources: 42 U.S.C. § 2000e-2(k) (govinfo), 29 CFR 1607.4(D) (four-fifths rule) and 29 CFR 1602.14 (record retention) (eCFR). Not officially sourced: the EEOC's withdrawal of its AI guidance in January 2025 and the shift in enforcement priorities; the law did not change. The impact report is the recommended way to document a defense, not a legal requirement.

Risk assessment before using ADMT or other high-risk processing

CCPA ADMT and risk assessments11 CCR §§ 7150, 7151, 7152, 7155In force

Applies from January 1, 2026

When it relates
Applies to CCPA-covered businesses (revenue threshold, 100,000 residents or 50% of revenue from selling data) that use ADMT for significant decisions, infer traits of employees, applicants or students through systematic observation, process sensitive data, or train ADMT or facial recognition. Training models on your own data is not enough by itself. For processing that began before 2026 the deadline is December 31, 2027.
What the rule provides
  • Conduct and document the assessment before starting the processing.
  • Describe the specific purpose, data, concrete benefits, negative impacts and safeguards; involve the staff who take part.
  • Have it approved by a person with authority over the processing.
  • Review it at least every three years and update it within 45 days of a material change.
  • Keep it while the processing continues or for five years after completion, whichever is later.
  • For processing that already existed before January 1, 2026, the deadline is December 31, 2027.
Typical evidence
  • Signed, versioned risk assessment
  • List of contributors and approver
Verification
Verified in the official source on November 2, 2026Checked against the approved text published by CalPrivacy (§§ 7150 and 7155).

Submit assessment information to the agency with a signed attestation

CCPA ADMT and risk assessments11 CCR § 7157Adopted, applies later

Applies from April 1, 2028

When it relates
Applies to businesses that conducted risk assessments in 2026 or 2027.
What the rule provides
  • Submit the required information on 2026 and 2027 assessments by April 1, 2028, and every April 1 after that.
  • Include an attestation signed by an executive under penalty of perjury.
  • Provide the full assessment within 30 days if the agency or Attorney General requests it.
Typical evidence
  • Submitted form and confirmation
  • Signed attestation
Verification
Verified in the official source on November 2, 2026Checked against the approved text (§ 7157(a)(1)).

Pre-use notice for ADMT

CCPA ADMT and risk assessments11 CCR §§ 7200(b), 7220Adopted, applies later

Applies from January 1, 2027

When it relates
Applies to CCPA-covered businesses that use ADMT for significant decisions on lending, housing, education, employment or health care.
What the rule provides
  • Before using ADMT, explain the specific purpose, the right to opt out or appeal, the right of access, and how the ADMT works.
  • Explain in plain language which data affect the output and how the decision would be made if the person opts out.
  • Uses that began before 2027 must comply by January 1, 2027; new uses from first use.
Typical evidence
  • Published or delivered pre-use notice
Verification
Verified in the official source on November 2, 2026Date checked against the approved text (§ 7200(b)); notice content per § 7220.

Offer an ADMT opt-out or a human appeal

CCPA ADMT and risk assessments11 CCR § 7221Adopted, applies later

Applies from January 1, 2027

When it relates
Applies to CCPA-covered businesses that use ADMT for significant decisions.
What the rule provides
  • Offer at least two ways to opt out, without requiring an account.
  • Or, instead, offer an appeal reviewed by a person with authority to change the decision, if the exception's conditions are met.
  • State in the notice which exception you rely on.
Typical evidence
  • Opt-out or appeal form and request log
Verification
Verified in the official source on November 2, 2026Checked against the approved text (§§ 7220 and 7221).

Respond to ADMT access requests

CCPA ADMT and risk assessments11 CCR § 7222Adopted, applies later

Applies from January 1, 2027

When it relates
Applies to CCPA-covered businesses that use ADMT for significant decisions.
What the rule provides
  • Explain the specific (not generic) purpose for which ADMT was used about that person.
  • Explain the ADMT's logic, the output produced and how it was used in the decision.
Typical evidence
  • Access response template and response log
Verification
Verified in the official source on November 2, 2026Checked against the approved text (§ 7222).

Do not use discriminatory automated-decision systems (anti-bias testing supports a defense)

FEHA automated-decision systemsCal. Code Regs., tit. 2, § 11009 y ss.In force

Applies from October 1, 2025

When it relates
Applies to employers with 5 or more employees using AI or algorithms with applicants or employees in California.
What the rule provides
  • Do not use systems that discriminate based on protected characteristics or proxies.
  • Recommended: run anti-bias tests before use and periodically and act on the results; their existence, quality and outcome are relevant to a defense, although the regulations do not impose them as a standalone duty.
  • Offer reasonable accommodation when the system assesses traits linked to disability or religion.
Typical evidence
  • Anti-bias test reports with date, scope and actions taken
Verification
Pending confirmation in the official source (last checked: November 4, 2026)Effective date (Oct 1, 2025) and OAL approval (Jun 27, 2025) checked in the CRD's official press release. The official text of 2 CCR § 11009 et seq. is still missing; the substantive content comes from law firms (Mayer Brown, Jackson Lewis).

Keep automated-decision system data for four years

FEHA automated-decision systemsCal. Code Regs., tit. 2, § 11013(c)In force

Applies from October 1, 2025

When it relates
Applies to FEHA-covered employers that use these systems.
What the rule provides
  • Keep inputs, outputs and data used to configure or customize the system for four years.
Typical evidence
  • Retention policy and decision records
Related base documents
Verification
Pending confirmation in the official source (last checked: November 4, 2026)The CRD's official press release (Jun 30, 2025) confirms that employment records, including automated-decision system data, must be kept for at least four years. The section number (2 CCR § 11013(c)) still has to be checked in the official text.

Oversee hiring-tool vendors

FEHA automated-decision systemsCal. Code Regs., tit. 2, § 11008 (definición de agente)In force

Applies from October 1, 2025

When it relates
Applies if a vendor screens, filters or evaluates people on your behalf.
What the rule provides
  • Ask the vendor for anti-bias testing and access to the data needed to keep records.
  • Set responsibilities, audit rights and cooperation on complaints in the contract.
Typical evidence
  • Due diligence questionnaire and signed contract
Verification
Pending confirmation in the official source (last checked: November 4, 2026)The official text of 2 CCR § 11008 (agent definition) is still missing; the content comes from law firms and specialist publications. The CRD press release does not give section numbers.

Do not use AI with discriminatory effect or ZIP codes as a proxy

Illinois HB 3773775 ILCS 5/2-102(L)(1)In force

Applies from January 1, 2026

When it relates
Applies to employers with workers or candidates in Illinois that use AI in employment decisions.
What the rule provides
  • Prohibit in internal policy the use of ZIP codes as a proxy for protected characteristics.
  • Check whether the tool produces unequal outcomes by group; the law does not require an audit, but it is the best defense.
Typical evidence
  • AI-in-employment policy
  • Bias review report (voluntary)
Related base documents
Verification
Pending confirmation in the official source (last checked: November 4, 2026)ilga.gov refused the connection on Nov 4, 2026, so the official text is still unchecked. The wording of the duty in 775 ILCS 5/2-102(L) still has to be confirmed. The effective date (Jan 1, 2026) and the withdrawal of the IDHR proposed rules (Jun 2, 2026) come from consistent secondary sources (Seyfarth, Burke, National Law Review).

Give notice of AI use in employment decisions

Illinois HB 3773775 ILCS 5/2-102(L)(2)In force

Applies from January 1, 2026

When it relates
Applies to employers with workers or candidates in Illinois that use AI in employment decisions.
What the rule provides
  • Tell employees (and, as good practice, candidates) that AI is used and for which decisions.
  • As good practice, include the tool and vendor name, as the withdrawn IDHR draft required.
Typical evidence
  • Dated notice, delivered or posted
Supporting documents
Verification
Pending confirmation in the official source (last checked: November 4, 2026)ilga.gov refused the connection on Nov 4, 2026, so the official text is still unchecked. The wording of the duty in 775 ILCS 5/2-102(L) still has to be confirmed. The effective date (Jan 1, 2026) and the withdrawal of the IDHR proposed rules (Jun 2, 2026) come from consistent secondary sources (Seyfarth, Burke, National Law Review).

Clear consumer notice of ADMT use

Colorado SB 26-189SB 26-189 (C.R.S. 6-1-17xx), obligaciones del deployerAdopted, applies later

Applies from January 1, 2027

When it relates
Applies if you use ADMT that materially influences decisions on employment, housing, health care, education, lending or insurance for Colorado consumers.
What the rule provides
  • Give a clear and conspicuous notice at the point of interaction that ADMT is used.
Typical evidence
  • Published notice and screenshots of interaction points
Verification
Verified in the official source on November 2, 2026Signing, dates and obligations checked on leg.colorado.gov on Nov 2, 2026. Exact content will depend on the Attorney General's rules, still pending.

Explanation within 30 days after an adverse decision

Colorado SB 26-189SB 26-189, obligaciones del deployerAdopted, applies later

Applies from January 1, 2027

When it relates
Applies to ADMT deployers in consequential decisions about Colorado consumers.
What the rule provides
  • Within 30 days of an adverse outcome, explain in plain language the decision and the role of ADMT.
  • Explain how to request information about the system, its data and the rights of correction and review.
Typical evidence
  • Explanation template and delivery log
Verification
Verified in the official source on November 2, 202630-day period checked on leg.colorado.gov; details subject to Attorney General rules.

Data correction and human review

Colorado SB 26-189SB 26-189, derechos del consumidorAdopted, applies later

Applies from January 1, 2027

When it relates
Applies to ADMT deployers in consequential decisions about Colorado consumers.
What the rule provides
  • Let consumers access their personal data and correct inaccurate data.
  • Offer meaningful human review and reconsideration after an adverse outcome, by a trained person with authority to change it.
Typical evidence
  • Review procedure and log of requests and outcomes
Verification
Verified in the official source on November 2, 2026Checked on leg.colorado.gov.

Developer technical documentation for deployers

Colorado SB 26-189SB 26-189, obligaciones del desarrolladorAdopted, applies later

Applies from January 1, 2027

When it relates
Applies to those who develop or sell ADMT used in consequential decisions about Colorado consumers. Selling an AI product is not enough: in the assessment, select the type of decision your product supports.
What the rule provides
  • Give each deployer documentation on intended uses, training data categories, known limitations and instructions for use and human review.
  • Notify deployers of material updates.
Typical evidence
  • Delivered technical documentation and version log
Related base documents
Verification
Verified in the official source on November 2, 2026Checked on leg.colorado.gov.

Keep compliance records for three years

Colorado SB 26-189SB 26-189, conservación de registrosAdopted, applies later

Applies from January 1, 2027

When it relates
Applies to developers and deployers covered by the law.
What the rule provides
  • Keep records showing compliance for at least three years, with version identifiers.
Typical evidence
  • Decision log and system version log
Related base documents
Verification
Verified in the official source on November 2, 2026Three-year period checked on leg.colorado.gov.

Related base documents

Related kits

Includes 5 documents

Platforms and Algorithmic Management Kit

Algorithmic management notice to workers, human oversight, review of decisions on shifts, tasks or pay, a decision log and DPIA.

USD 129USD 215

Complete kit · available to buy

Find out what applies to you (free)United States (federal)