AI Hiring Tools in the US: 2026 State AI Law Rules

If you use AI anywhere in hiring in the United States in 2026, the compliance work is no longer optional, but it is also narrower than the headlines suggest. There is still no federal AI hiring statute; what binds you is a patchwork of state and city rules — Illinois and Texas since 1 January 2026, California's FEHA automated-decision rules since 1 October 2025, New York City's bias-audit law since July 2023 — plus existing anti-discrimination law, which applies to an algorithm exactly as it applies to a recruiter. The practical obligations reduce to four things: know which tools you use, tell candidates, test for disparate impact, and keep records.

Stratgik is a technology firm, not a law firm — nothing here is legal advice, and employment counsel in your jurisdiction should review your notices and vendor contracts before you rely on them.

Why 2026 is the year this became an operational problem

Three things changed at once. States began enforcing laws written in 2024. Courts started answering who is liable when software rejects a candidate. And the federal government moved in the opposite direction from the states, creating uncertainty rather than relief.

On 11 December 2025, Executive Order 14365, "Ensuring a National Policy Framework for Artificial Intelligence," directed federal agencies to challenge state AI regulation, and the Department of Justice stood up an AI Litigation Task Force on 9 January 2026. But an executive order cannot preempt a state statute on its own, Congress has declined to pass broad preemption, and no court has yet struck down a state AI employment law. The state rules are the ones to plan against.

The state and city rules that bind US employers now

New York City Local Law 144: the only true audit mandate

Local Law 144 is the most prescriptive rule in the country, and the only one requiring you to pay a third party before switching a tool on. If an automated employment decision tool substantially assists or replaces discretionary decision-making for a job or promotion in New York City, you need an independent bias audit completed within the previous year, renewed annually.

The audit calculates selection rates and impact ratios by sex and by race or ethnicity, including intersectional categories. A summary of the results, the distribution date, and the data source must be published on your careers site. Candidates must be notified at least 10 business days before the tool is used, with an alternative process available.

Penalties are modest per incident but compound badly: $500 for a first violation and $500 to $1,500 for each subsequent violation, with every day a tool runs without a valid audit counted separately. A tool left live for a quarter without a current audit is not a $500 problem.

Illinois HB 3773: effects, not intentions

Illinois amended its Human Rights Act so that using AI which has the effect of discriminating on a protected basis is itself a civil rights violation. The covered ground is the whole employment lifecycle: recruitment, hiring, promotion, renewal of employment, selection for training or apprenticeship, discharge, discipline, tenure, and the terms or conditions of employment. Employers must also notify applicants and employees, in plain language, when AI is used for these decisions.

One detail matters for planning: the Illinois Department of Human Rights withdrew its proposed notice regulations on 2 June 2026, so the exact form, timing, and channel remain unspecified. The statutory duty applies regardless. The defensible position is a clear, documented, pre-decision notice you can prove was delivered — not a sentence buried in a privacy policy.

Texas TRAIGA: a much lower bar, and a trap

Texas took the opposite approach. TRAIGA prohibits developing or deploying an AI system with the intent to unlawfully discriminate, and disparate impact alone cannot establish that intent. There is no disclosure duty for private employers at all. Penalties run from $10,000 to $12,000 for curable violations up to $80,000 to $200,000 for uncurable ones, with $2,000 to $40,000 per day for continuing violations; the Texas Attorney General has exclusive enforcement and there is no private right of action.

The trap is assuming TRAIGA is your ceiling. Title VII and the ADEA still apply in Texas, and they are effects-based. TRAIGA changes what the state can sue you for, not what a federal plaintiff can.

Colorado: the law you prepared for is not the law you got

The 2024 Colorado AI Act (SB 24-205) was postponed to 30 June 2026, then overtaken. A federal magistrate judge stayed its enforcement on 27 April 2026 after a challenge by xAI in which the DOJ intervened, and on 14 May 2026 Colorado signed SB 26-189, a notice-based replacement effective 1 January 2027.

SB 26-189 drops the mandatory impact assessments and affirmative anti-discrimination duties of the original. What remains for deployers: clear and conspicuous notice before automated decision-making technology materially influences a consequential decision; within 30 days of an adverse outcome, a plain-language description of its role, a route to request more information, and a statement of rights; meaningful human review on request where commercially reasonable; and at least three years' retention of compliance documentation. The Attorney General enforces it as a deceptive trade practice with a 60-day cure period, waived for knowing or repeated violations; there is no private right of action. Rulemaking is still open — treat the detail as provisional.

The litigation risk is already larger than the regulatory risk

Mobley v. Workday (N.D. Cal.) is the case to understand. On 12 July 2024 the court dismissed the claim that the vendor was an employment agency but allowed an "agent" theory to proceed, reasoning that a tool which performs the traditional hiring function of rejecting candidates at the screening stage is materially different from a spreadsheet. On 16 May 2025 the court granted preliminary certification of a nationwide ADEA collective covering applicants aged 40 and over who, from 24 September 2020 onward, applied through the platform and were denied employment recommendations.

Two consequences follow. Your vendor's exposure does not reduce yours, and the question you will be asked is factual: what role did the tool play in this rejection, and can you show it? Firms that cannot describe their own screening logic are the ones that settle.

What good practice looks like regardless of jurisdiction

The rules differ by state but converge on the same evidence, so build to the strictest requirement you are exposed to and apply it everywhere. California's four-year retention rule and New York City's audit discipline make a reasonable national baseline. Remote hiring makes this close to unavoidable anyway: a candidate's location, not your headquarters, often determines which rules bite.

Note what is not prohibited. California's regulations do not bar lawful uses such as sourcing, ranking, or productivity monitoring; they bar discriminatory outcomes and require you to show you looked. Evidence of anti-bias testing — its quality, recency, scope, and what you did about the results — is explicitly relevant to defending a claim. Testing is not just a cost; it is the defense.

A practical checklist

• Inventory every tool touching an employment decision — ATS scoring, resume parsing, video interview analysis, chat screeners, scheduling triage, internal mobility matching, performance ranking. Most organizations under-count by half, because business units buy their own.
• Map tools to jurisdictions by where candidates and employees are, not where you are. Flag NYC, California, Illinois, and Texas first; add Connecticut and Colorado to the 2027 plan.
• Classify each tool by whether it substantially assists or replaces discretion. This single judgment drives whether Local Law 144 applies.
• Commission bias audits for NYC-covered tools before use, annually, by an independent auditor; publish the summary with selection rates, impact ratios, data source, and distribution date.
• Write the notices — plain language, pre-decision, delivered through a channel you can evidence. Build 10 business days of lead time into NYC requisitions.
• Test for disparate impact on your own data, not just the vendor's benchmark, and document what you changed when a ratio looked wrong.
• Fix retention to four years for automated-decision system data, including inputs, outputs, and training data where you hold it. Default ATS retention is usually shorter.
• Rework vendor contracts to require bias-testing disclosure, audit cooperation, data access on demand, and sensible liability allocation. Assume you will need the vendor's cooperation under litigation timelines.
• Keep a human in the loop on rejection, discipline, and termination, and record the review. A documented human decision is the cleanest answer to the Mobley question.
• Write one governance policy covering tool authorization, vetting, monitoring, documentation, and annual review — and name an owner.

Where the cost actually sits

The expensive part is rarely the audit. It is the plumbing: HR systems that cannot evidence when a notice was shown, retention policies that delete the data you now need, and screening logic nobody can explain because a vendor configured it three years ago. Those are integration and data problems, which is why this lands on technology teams as much as on HR.

Some steps are worth automating and some are not once that overhead is priced in. Scheduling, acknowledgment, document collection, and interview logistics carry little regulatory weight and real time savings. Scoring and ranking candidates carry the full weight of everything above. Our AI automation opportunity scanner helps separate the two, and a technology decision sprint is how we usually settle it properly.

Frequently asked questions

Is there a federal law regulating AI in hiring in the United States?

No. There is no federal AI hiring statute as of October 2026. Title VII, the ADEA, and the ADA apply to automated tools as they do to human decisions, and enforcement of those is effects-based. Executive Order 14365 of 11 December 2025 directs agencies to challenge state AI laws, but an executive order cannot preempt state statutes by itself, and Congress has not passed preemption.

Does Local Law 144 apply if my company is not in New York City?

It can. The law attaches to the job or promotion rather than to your headquarters, so a remote role open to New York City candidates may bring a tool in scope. Take specific legal advice on your posting footprint rather than assuming geography protects you.

Do I need a bias audit in Illinois or Texas?

Neither statute mandates a third-party audit. Illinois prohibits discriminatory effects and requires notice; Texas requires discriminatory intent, which is a higher bar. But testing remains the practical way to know whether you have an effects problem, and in California the quality and recency of anti-bias testing is expressly relevant evidence.

If my vendor says its tool is compliant, am I covered?

No. Liability sits with the employer for the tools it uses, whether built in-house or bought, and California's rules extend aiding-and-abetting exposure to parties that design or implement such tools. A vendor attestation is useful evidence, not a transfer of risk. Verify it and contract for cooperation.

How long do I have to keep records?

California requires four years of automated-decision system data for decisions affecting employment benefits, extended from two. Colorado's SB 26-189 will require at least three years of compliance documentation from 1 January 2027. Four years applied uniformly is the simplest defensible setting.

What is still uncertain going into 2027?

Several things, and we would not plan as though they were settled: Colorado's rulemaking and the outstanding injunction litigation, the form of the Illinois notice after the June 2026 withdrawal of proposed rules, federal preemption efforts and the DOJ task force's targets, and whether vendor liability theories such as the one in Mobley survive final rulings.

For AI in hiring, or any regulated workflow in the US market, the sequence that works is inventory, then jurisdiction mapping, then notices and testing, then retention and contracts — with legal review at each step. Our US privacy compliance page covers the data-protection side of the same problem, our United States hub sets out how we work with US clients from our base in Gurugram, India, and technology strategy is where the build-or-skip decision gets made. Written by the Stratgik team.

Sources:NYC Department of Consumer and Worker Protection, Automated Employment Decision Tools; Colorado General Assembly, SB 26-189; Ogletree Deakins on California's algorithmic discrimination rules; Epstein Becker Green, workplace AI regulation in 2026; K&L Gates on TRAIGA; Seyfarth Shaw on Mobley v. Workday; Ropes & Gray on federal preemption efforts.