AI Hiring Laws in 2026: A Plain-English Compliance Guide for Small Businesses

Which US States Regulate AI Hiring in 2026?

Four jurisdictions have binding AI hiring rules you must follow right now. New York City requires annual bias audits and candidate notice under Local Law 144. Illinois requires notice and bans discriminatory AI under HB 3773, effective January 1, 2026. California treats a discriminatory automated decision system as a civil rights violation under FEHA regulations that took effect October 1, 2025. Texas bans AI deployed with intent to discriminate under HB 149, also effective January 1, 2026. Colorado's AI Act, after two delays, does not take effect until January 1, 2027.

Most coverage of these laws is written for enterprise legal departments. This guide is for a 10 to 50 person company that wants to keep using AI screening in its ATS without ending up in a complaint file. No legal jargon, just what applies to you and what to do about it.

Quick definition: An AI hiring law is a state or city rule that controls how employers use automated tools to screen, rank, or select job candidates. Most require three things: telling candidates the tool is in use, testing it for bias against protected groups, and keeping records that prove your hiring process is fair.

What Does NYC Local Law 144 Require?

If you hire for roles based in New York City and your software scores, ranks, or filters candidates automatically, Local Law 144 applies to you. It has been enforced by the Department of Consumer and Worker Protection since July 5, 2023, according to the official NYC DCWP guidance.

Three obligations matter:

• Annual bias audit: an independent auditor must test the tool's selection rates by race and sex every year.
• Public posting: a summary of the audit results must sit on your careers page.
• Candidate notice: candidates must be told at least 10 business days before the tool is used on them.

Penalties start at up to $500 for a first violation and run $500 to $1,500 for each one after that, per day, per LegalClarity's breakdown of the penalty structure. Each candidate who never got notice counts as a separate violation, so small mistakes multiply fast.

The practical move for a small company: ask your ATS vendor for their latest bias audit summary. If they cannot produce one, do not use their automated ranking for NYC roles.

What Does Illinois HB 3773 Require Starting January 1, 2026?

Illinois amended its Human Rights Act, and the change reaches almost everyone: it covers any employer with one or more employees in the state, as Ogletree Deakins explains. There is no small business exemption.

As of January 1, 2026, you may not:

• Use AI that has a discriminatory effect in recruitment, hiring, promotion, discipline, discharge, or terms of employment.
• Use zip codes as a proxy for protected classes.
• Use AI in those decisions without notifying the applicant or employee.

Note the wording: discriminatory effect. You can violate this law without intending to. If your screening tool quietly filters out older applicants, good intentions will not save you.

One wrinkle worth knowing: the Illinois Department of Human Rights proposed detailed rules, then temporarily withdrew them, per Seyfarth Shaw. The statute still applies. Do not wait for final regulations to add a notice to your job postings.

Illinois also has an older law, the AI Video Interview Act, in force since 2020. If you use AI to analyze recorded video interviews for Illinois roles, you need consent, an explanation of how the AI works, and deletion of the video within 30 days of a candidate's request.

What Happened to the Colorado AI Act?

Short version: it keeps moving. The Colorado AI Act was set for February 2026, pushed to June 30, 2026, and then pushed again. On May 14, 2026, Governor Polis signed SB 26-189, which delays it to January 1, 2027 and scales the law back to notice and recordkeeping duties, as reported by Hunton Andrews Kurth.

Plenty of articles published in early 2026 still list the June date. If a vendor or consultant quotes it, they are working from stale information. For now, Colorado employers should track the rewrite but have nothing new to implement until 2027. Discrimination claims under existing Colorado law remain fully available in the meantime.

What Do California's New AI Rules Require?

California folded AI into its existing civil rights framework. Effective October 1, 2025, the FEHA regulations on automated decision systems apply to employers with five or more employees, per the Jackson Lewis compliance checklist.

The rules do four things a small employer should care about:

1. Using an automated decision system that discriminates by a protected category is a FEHA violation, same as if a human did it.
2. You must keep ADS records, selection criteria, and applicant data for at least four years.
3. Anti-bias testing counts as evidence in your defense if you get accused. No testing, weaker defense.
4. The vendor who built the tool can be treated as your agent, but that does not remove your own liability.

The four-year recordkeeping rule is the sleeper issue. If your ATS deletes rejected candidate data after 12 months, you are already out of step for California roles.

What About Texas and Federal Law?

Texas passed HB 149, the Responsible AI Governance Act, effective January 1, 2026. For employers, the key provision bans deploying AI with intent to unlawfully discriminate, and the attorney general enforces it, as summarized in DISA's state-by-state review. The intent standard makes it narrower than Illinois or California, but it signals where red states are heading too: nobody is exempting hiring tools.

At the federal level there is still no AI hiring statute. Title VII of the Civil Rights Act and the ADA apply to any hiring decision, whether a person or an algorithm made it, and the employer stays responsible either way, a point DarrowEverett's 2026 analysis stresses. Federal enforcement priorities have shifted under the current administration, but private lawsuits under these statutes have not gone anywhere.

AI Hiring Laws at a Glance: The Table

JurisdictionLawIn effectWho is coveredWhat you must do New York CityLocal Law 144Enforced since July 5, 2023Employers using automated tools for NYC rolesAnnual independent bias audit, post summary publicly, give candidates 10 business days' notice IllinoisHB 3773 (Human Rights Act amendment)January 1, 2026Employers with 1+ Illinois employeeNotify candidates and employees of AI use, no discriminatory effect, no zip code proxies IllinoisAI Video Interview ActSince 2020Employers using AI on video interviewsConsent, explanation, delete video within 30 days of request CaliforniaFEHA ADS regulationsOctober 1, 2025Employers with 5+ employeesNo discriminatory ADS, keep records 4 years, run anti-bias testing TexasHB 149 (TRAIGA)January 1, 2026Employers deploying AI in TexasDo not deploy AI with intent to discriminate ColoradoColorado AI Act (as amended by SB 26-189)January 1, 2027To be finalized; narrowed to notice and recordsNothing yet, watch the rewrite

What Should a 10 to 50 Person Company Actually Do?

You do not need a compliance department. You need five habits:

1. Inventory your tools. List every product that touches hiring decisions: ATS ranking, resume parsers, one-way video scoring, chatbot screeners. If it filters or scores people, it counts.
2. Add a notice line. Put one sentence in job postings and application confirmations: "We use software, including AI-assisted tools, to help review applications." That single line covers the core Illinois duty and most notice rules being drafted elsewhere.
3. Get the vendor's paperwork. Ask for their bias audit or adverse impact testing results. Keep the reply in a folder. Under California's rules, evidence of testing is your defense.
4. Keep a human on the reject button. Configure your ATS so AI recommends and a person decides, especially for auto-rejections. Candidates already know how screening works; many are actively gaming AI resume screening, which is one more reason a human should sanity-check the output.
5. Stop deleting candidate data early. Set retention to four years if you hire in California, and at least two everywhere else.

If this feels familiar, it should. It is the same patchwork playbook employers just ran for pay transparency laws: a few strict states set the bar, and following the strictest one keeps you safe in the rest.

Which Questions Should You Ask Your ATS Vendor?

Your vendor carries most of the technical burden, but you carry the legal one. Before you buy or renew, ask:

• Which of my screening features count as an automated employment decision tool?
• Do you have a current independent bias audit I can post for NYC roles?
• Can I turn off auto-rejection while keeping AI-assisted ranking?
• Can I set candidate data retention to four years?
• Will you notify me when a new state law changes what your tool must do?

A vendor that answers all five in writing is doing its job. A vendor that stalls is a liability. Compliance posture belongs on your scorecard when you compare an applicant tracking system for a small business, right next to price.

Where Does This Leave a Small Team?

AI screening is still legal in all 50 states. The laws do not ban the tools; they ban using them blindly. Disclose, keep records, test for bias, and keep a human in the loop, and a 20-person company is in better shape than most enterprises with a policy binder nobody reads.

The easiest path is picking software that bakes the guardrails in. TracefyHR's hiring pipeline keeps AI screening assistive rather than autonomous, with human review built into every stage, and you can see how the hiring and ATS features handle notice and candidate records before you commit to anything.

Frequently Asked Questions

Is it illegal to use AI to screen resumes?

No. AI screening is legal in every state. Laws in NYC, Illinois, and California regulate how you use it: disclosure, bias testing, and recordkeeping.

What is NYC Local Law 144?

A New York City law requiring an annual independent bias audit, a public audit summary, and 10 business days' candidate notice before using an automated employment decision tool.

Does Illinois HB 3773 apply to small businesses?

Yes. It covers any employer with one or more employees in Illinois, so even a two-person company must give notice when AI touches employment decisions.

What is an AI bias audit?

An independent test of whether a hiring tool selects candidates at meaningfully different rates by race, sex, or other protected traits, usually measured against the four-fifths rule.

Do AI hiring laws apply to remote candidates?

Generally the candidate's location controls. A remote role open to NYC or Illinois applicants can pull you into those rules even if your office is elsewhere.

Can my company be sued if the ATS vendor's AI discriminates?

Yes. Under federal law and California's FEHA rules, the employer stays liable for discriminatory outcomes even when a third-party vendor built the tool.

When does the Colorado AI Act take effect?

January 1, 2027, after two delays. SB 26-189, signed in May 2026, also narrowed the law to notice and recordkeeping duties.