Key points

• There is still no federal statute governing employers' use of AI in hiring, so the rules come from a growing mix of state and local laws, anti-discrimination law and agency guidance.
• New York City's Local Law 144 requires an independent bias audit and candidate notice before an employer uses an automated employment decision tool. Illinois amended its Human Rights Act, effective January 1, 2026, to address AI in employment decisions.
• California's civil rights regulations on automated decision systems took effect in October 2025, and Colorado's comprehensive AI law covers high-risk systems used in employment, though its effective date has been adjusted and should be confirmed.
• Employers remain liable for discriminatory outcomes even when a vendor built the tool, so vendor diligence and contract terms matter as much as policy.
• A defensible program combines an inventory of tools, bias testing, candidate notices, human review and a documented record.

A patchwork, not a framework

Employers have adopted AI at every stage of the hiring funnel. Tools now write job descriptions, source candidates, screen resumes, rank applicants, score video interviews and assess skills. Each use can affect who gets an interview, so each can raise discrimination and transparency issues. The legal framework governing these uses is not a single statute. It is a set of overlapping obligations from federal anti-discrimination law, state and local AI-specific rules, privacy statutes and consumer reporting rules, with new requirements arriving on different dates.

Anti-discrimination law is the foundation. Title VII, the Americans with Disabilities Act and the Age Discrimination in Employment Act apply to AI tools in the same way as to human decisions, including under a disparate impact theory where a facially neutral tool disproportionately screens out protected groups. Federal agencies have shifted their emphasis, and the current EEOC is less focused on AI guidance than its predecessor, but private plaintiffs and state regulators are not bound by those priorities.

The main state and local rules

New York City. Local Law 144 prohibits using an automated employment decision tool for hiring or promotion decisions in the city unless the tool has undergone a bias audit by an independent auditor within the past year, the audit summary is publicly posted, and candidates and employees are given notice. The law has been enforced since July 2023, and critics have questioned how actively the city enforces it, which has prompted calls for stronger oversight.

Illinois. An amendment to the Illinois Human Rights Act, effective January 1, 2026, makes it a civil rights violation to use AI in a way that results in discrimination in employment decisions, to use zip codes as a proxy for protected classes, and to fail to give notice to employees when AI is used for covered decisions. A separate Illinois statute has for some years regulated AI analysis of video interviews, requiring notice and consent.

California. Regulations from the California Civil Rights Council on automated decision systems under the state's anti-discrimination law took effect on October 1, 2025. They clarify that employers can be liable for discrimination caused by automated tools, address the role of vendors as agents, and extend record retention requirements. Separate privacy regulations on automated decision-making technology are also being implemented under the California Consumer Privacy Act.

Colorado. The Colorado AI Act treats systems that make or substantially influence consequential decisions, including employment decisions, as high-risk and imposes duties on deployers to use reasonable care to avoid algorithmic discrimination. The legislature delayed the effective date, and further changes have been debated. We discuss the current position in Colorado's AI Act: where things stand for deployers.

Texas and others. Texas enacted a responsible AI governance statute effective January 1, 2026, that prohibits developing or deploying AI with the intent to unlawfully discriminate, though it does not adopt a disparate impact standard. Several other states have considered or enacted narrower measures, and legislative activity continues.

Employers answer for vendor tools

A recurring misconception is that responsibility sits with the software provider. Courts and regulators have been consistent that the employer is responsible for its hiring decisions. In a prominent federal case in California, a court allowed claims against a hiring-technology vendor to proceed on the theory that it acted as an agent of employers, which means exposure may be shared, but that does not remove the employer's liability. Employers should assume they will be named in any claim.

Vendor diligence should therefore ask what the tool measures, what data trained it, what validation and adverse impact testing has been done, whether the vendor will support the employer's bias audit, and how the tool accommodates candidates with disabilities. Contracts should secure audit cooperation, notice of material model changes, data protection commitments and appropriate indemnities.

Building a defensible program

Start with an inventory. Many employers cannot say which tools their recruiters and managers are using, including features that were switched on inside an existing applicant tracking system. Classify each by function and by the jurisdictions in which candidates are located, since a single remote role can trigger several regimes.

Test for adverse impact using the four-fifths rule as an initial screen and a more rigorous statistical analysis where flagged. Document the business justification for the tool and any less discriminatory alternatives considered. Provide notices where required, and offer an alternative process or accommodation for candidates who request one. Keep a human involved in consequential decisions, with reviewers trained to question the output rather than defer to it.

Finally, maintain records. Several regimes require retention, and a documented trail of testing, notices and decisions is the best protection when a candidate, a plaintiff's lawyer or a regulator asks questions.

What to watch

Expect further state legislation, more private litigation focused on screening tools, and continued federal debate over preemption of state AI laws. Employers with national hiring should design to the most demanding standard they face, which often proves simpler than maintaining separate processes. Corvane Ryle's Artificial Intelligence practice and our Consumer Protection practice advise employers on AI governance in hiring, and Theo Abernathy can discuss how these rules apply to your program.