AI Hiring Laws in 2026: What Small Businesses Need to Know

Verified July 2026. This article is general information, not legal advice; confirm current requirements with an employment attorney before you act.

If you’re using AI to screen résumés, score candidates, or evaluate video interviews in 2026, four sets of rules matter most right now: New York City’s Local Law 144 (bias audits and candidate notice, in force), Illinois’ AI hiring amendments (notice and non-discrimination duties, in force since January 1, 2026), California’s Automated Decision Systems regulations (in force since October 1, 2025), and a patchwork of newer or delayed laws in Colorado, Connecticut, New Jersey, and the EU. None of these laws require a specific vendor or product. All of them require you to know what your hiring software is doing and be able to explain it.

Where Things Stand Right Now

Is NYC Local Law 144 Still in Effect?

Yes, and enforcement is getting more serious, not less. Local Law 144 requires any employer or employment agency using an “automated employment decision tool” to complete an independent bias audit in the prior 12 months, publish a summary of that audit on their website, and give candidates at least 10 business days’ notice before the tool is used, including what it assesses and how to request an alternative process.

The law applies based on where the job is located, not where the candidate lives: it covers a job based at (or “associated with”) an NYC office, including fully remote roles tied to an NYC office, or any employment agency headquartered in NYC. There’s no employer-size exemption, so a 20-person company outside New York hiring for an NYC-based role is covered. A December 2025 New York State Comptroller audit found the city’s own enforcement “ineffective,” and law firms are now warning of a “new phase of stringent enforcement” as the city responds, including more investigations and potentially higher penalties (the statutory range is $500–$1,500 per violation, with each day of continued non-compliance treated separately).

What Does Illinois Require?

Illinois’ amendments to the Illinois Human Rights Act (HB 3773) took effect January 1, 2026. They prohibit using AI in recruitment, hiring, promotion, discipline, or termination decisions where the AI has the effect of discriminating against a protected class, regardless of intent, and separately ban using ZIP code as a proxy for a protected characteristic. Employers must notify employees and applicants when AI is used to influence a covered employment decision.

The Illinois Department of Human Rights published proposed implementing rules in May 2026 covering notice content and timing, then withdrew that rulemaking on June 2, 2026, for further interagency review, with no new timeline announced. That pause affects only the rules, not the underlying statute: the notice and non-discrimination requirements are in force today regardless of whether formal rules exist yet.

Is the Colorado AI Act In Effect?

Not yet, and it looks different than it did a year ago. The original Colorado AI Act (SB 24-205) was delayed once via a 2025 special legislative session, then a federal court stayed its enforcement in April 2026 after a legal challenge. Rather than fight that stay, Colorado’s legislature repealed the original “high-risk AI system” framework entirely and replaced it with a narrower law, SB 26-189, signed in May 2026.

The new law drops the mandatory impact-assessment regime and instead requires, starting January 1, 2027: pre-use notice to candidates before covered automated decision technology is used, a post-decision explanation if that technology materially influenced an adverse outcome, and a consumer right to meaningful human review “to the extent commercially reasonable.” If you’ve read older coverage describing Colorado’s law as requiring formal impact assessments, that description is now out of date.

Does the EU AI Act Apply to a US Small Business?

The EU AI Act classifies AI used for candidate screening, ranking, or video-interview analysis as a “high-risk” system, which triggers conformity assessments, technical documentation, and human-oversight obligations. The original compliance deadline (August 2, 2026) was pushed back to December 2, 2027 through an amendment adopted by the EU Council and Parliament in June 2026, though as of this writing that amendment is still awaiting formal publication.

The more important question for most small businesses is scope, not timing. The AI Act applies based on where an AI system’s output is used, not where the company is headquartered. A US business with no EU employees and no EU-based candidates is very unlikely to be in scope. A business that uses AI to evaluate even one EU-based remote employee, or that recruits EU-resident candidates through the tool, likely is.

What About Other States?

California’s Automated Decision Systems regulations, in force since October 1, 2025, apply to any employer with 5 or more employees (at least one in California) and hold the employer liable for a discriminatory outcome even when a third-party vendor’s tool caused it. They also require 4-year retention of automated-decision-system data. New Jersey’s Division on Civil Rights has issued guidance and regulations confirming its existing anti-discrimination law covers algorithmic discrimination, though the state has not yet passed a dedicated AI hiring statute. Connecticut enacted a new AI employment law in 2026 with phased effective dates extending into 2027. At the federal level, a December 2025 executive order directed the Department of Justice to challenge state AI laws in court, and a June 2026 DOJ opinion rescinded the EEOC’s prior AI-bias enforcement guidance, but no state or city AI hiring law has been preempted or struck down as of this writing; employment lawyers are advising continued compliance with all of the above.

A Practical Compliance Checklist for Small Businesses

1. Inventory every AI tool touching your hiring pipeline. Résumé screeners, video-interview scorers, chatbot pre-screeners, and skills assessments all count, even ones you didn’t think of as “AI.”
2. Ask vendors for bias-audit or testing documentation. A vendor that can’t produce this is a real red flag. Under California and New Jersey rules, you (the employer) are liable for a vendor’s discriminatory outcome, not just the vendor.
3. Give candidates clear notice. Plain-language notice before AI evaluates them, what it assesses, and how to request an alternative, is required in NYC and Illinois today and will be standard practice everywhere within a couple of years.
4. Keep a human in the loop. Make sure someone can meaningfully review and override an AI-driven rejection. This is an explicit right under Colorado’s incoming law and the EU AI Act.
5. Retain your records. Four years is a reasonable baseline (it’s California’s minimum) for AI inputs, outputs, and any testing results.
6. Update vendor contracts to include audit-sharing and compliance obligations; you generally can’t contract away liability for a vendor’s tool.
7. Revisit this at least twice a year. Illinois paused its rules mid-cycle, Colorado’s law was replaced outright, and the EU’s deadline moved. A one-time compliance review isn’t enough in this environment.

When you’re evaluating a vendor against this checklist, look for one that publishes how its AI application review works, supports clear candidate notice, and keeps a human reviewer in your hiring loop by default rather than as an afterthought. That transparency is part of what Plural’s AI-assisted application review is built around, alongside the résumé screening signals worth watching for on the candidate side of the equation.

FAQ

Does NYC Local Law 144 apply to small businesses outside New York?

Yes, but only if the job is located at (or associated with) an NYC office, or the employment agency is based in NYC. It applies based on the job’s location, not the candidate’s home address, and there’s no employer size threshold, so a small out-of-state business hiring for an NYC-based role is covered.

Is Illinois’ AI hiring law actually in effect?

Illinois HB 3773 amendments to the Illinois Human Rights Act took effect January 1, 2026. As of June 2026, the Illinois Department of Human Rights withdrew its proposed implementing rules for further review, but the underlying statutory notice and non-discrimination requirements remain in force regardless of the rulemaking pause.

Is the Colorado AI Act in effect yet?

No. The original Colorado AI Act (SB 24-205) was stayed by a federal court in April 2026 and then repealed and replaced by SB 26-189, a narrower law focused on notice and human review rather than mandatory impact assessments. The new law takes effect January 1, 2027.

Does the EU AI Act apply to a US small business?

Mostly no. The EU AI Act’s territorial scope is based on where an AI system’s output is used, not where the company is based. A US small business with no EU employees and no EU-resident candidates is unlikely to be in scope; one that evaluates even a single EU-based remote employee or candidate with AI likely is.

What should a small business do to stay compliant right now?

Provide clear notice before using AI to evaluate a candidate or employee, ask vendors for their bias-audit or testing documentation, keep a human able to review and override AI-driven decisions, and retain records of AI inputs, outputs, and testing results for at least a few years in case of a future claim.

Sources

• NYC Local Law 144, official DCWP guidance: nyc.gov: Automated Employment Decision Tools
• NYC enforcement escalation: DLA Piper: Critical audit of NYC’s AI hiring law
• Illinois HB 3773 bill status: Illinois General Assembly
• Illinois rulemaking withdrawal: Seyfarth Shaw: IDHR withdraws proposed AI rules
• Colorado SB 26-189 official text: Colorado General Assembly: SB26-189
• Colorado law replacement analysis: Finnegan: Colorado replaces landmark AI Act
• EU AI Act Digital Omnibus delay: Council of the EU press release, June 29, 2026
• EU AI Act territorial scope: EU AI Act Service Desk, Article 2
• California FEHA Automated Decision Systems regulations: Duane Morris: California ADS regulations now in effect
• Federal EEOC guidance rescission: Jackson Lewis: DOJ opinion on EEOC disparate-impact guidelines
• Compliance best practices: SHRM: How State AI Laws Are Changing the Way Companies Hire