Key takeaways
- There is no federal AI hiring statute; state and local laws govern, and they apply based on where the candidate is located, not your headquarters, so one national tool can trigger a dozen regimes.
- New York City's Local Law 144 remains the most stringent enforced rule: an independent bias audit, published results, and candidate notice at least ten business days out.
- California's automated decision-making rules, in force since October 1, 2025, require retaining automated-decision and employment records for at least four years, turning a typical 12 to 24 month ATS purge into a compliance gap.
- Illinois now expressly covers AI in employment decisions, and Connecticut's Senate Bill 5 makes clear that using automated decision technology is not a defense to a discrimination claim.
- Price the full rollout, not the tool: bias audits per tool, multi-state legal review, a candidate-notice workflow, and multi-year record retention, then take it to employment counsel.
You rolled out an AI tool to screen candidates, rank applicants, or flag performance, and it works. The problem is no longer technical. It is legal, and it landed this year. There is no federal AI hiring law, so the rules now differ in every state your applicants live in, and the newest wave of them is taking effect right now. The tool was one decision. The compliance is fifty.
Start with the rule that catches people off guard.
The rule most teams get wrong
State AI employment laws apply based on where the candidate is located, not where your company is headquartered. If you hire remotely, your funnel touches the rules of every state your applicants sit in. A single AI screening tool, used nationally, can put you under a dozen different obligations at once. That is the part that turns a clean vendor rollout into a compliance project.
What is actually in force
The map is uneven, and it moved this year. The pieces you need on your desk:
New York City’s Local Law 144, in effect since 2023, requires an independent bias audit before you deploy an automated employment decision tool, publication of the results, and candidate notice at least ten business days out. It remains the most stringent rule actually enforced.
Illinois amended its Human Rights Act, effective January 1, 2026, to expressly cover AI in employment decisions, on top of consent and disclosure rules for AI video interviews it has had since 2020.
California is the one most likely to trip you on records. Its automated decision-making rules took effect on October 1, 2025, and require employers to retain automated-decision and employment records for at least four years. If your applicant-tracking system purges candidate decision logs after 12 or 24 months, that default is now a compliance gap for any California-touching role. The advancing No Robo Bosses Act would further bar relying solely on AI to fire or discipline.
Connecticut passed Senate Bill 5 on May 1, with obligations phasing in from October 2026, and it makes clear that using automated employment decision technology is not a defense to a discrimination claim, though documented anti-bias testing can mitigate.
Where the map breaks
Three things make this harder than a checklist. The rules conflict in scope and timing, so a process that satisfies New York may miss California’s retention rule. Some are moving under you: Colorado’s comprehensive AI Act was set for June 30, then challenged in court and stayed, the same preemption fight now playing out between Washington and the states, and in May the state repealed and replaced it outright, with the successor framework not in force until 2027, so building to it today is building on sand. And the federal “go easy on AI” signal does not lower your exposure, because state and local restrictions are multiplying regardless, with trackers counting hundreds of active bills across dozens of states. The landscape is evolving, not receding.
What it costs
Price the whole thing, not the tool. The line items the vendor quote never mentions: an independent bias audit per tool, legal review across the states you hire in, a candidate-notice workflow wired into your funnel, and a records system that retains decision logs for years rather than months. None of that is optional once a single AI tool sits in your hiring path, and all of it lands on whoever owns the rollout.
What to do Monday
Inventory every AI tool across the hiring lifecycle, sourcing, screening, ranking, performance flags, because you cannot comply for tools you have not listed. Commission or confirm a bias audit on each. Fix two things first: candidate notice and record retention, since those are concrete, already in force, and cheap to get wrong. Map your obligations by where candidates live, not where you sit. Then put this in front of employment counsel, because this is a compliance call, not a software one, and nothing here is legal advice. The tool made hiring faster. The work now is making sure faster does not become a four-year records subpoena you cannot answer.
The Counter Brief — one email, every Monday.
The week's AI-for-revenue moves in a 5-minute read: which tools are worth the budget and which to skip, plus what to do this week. Source-checked, no vendor decks.
Edited by Aditya Marin Gasga
Free. One click to unsubscribe.
Frequently asked questions
Is there a federal law on using AI in hiring?
No. There is no federal AI hiring statute, so obligations come from a patchwork of state and local laws that differ in scope, notice, audit, and retention requirements, generally applying based on where the candidate is located.
What does NYC Local Law 144 require?
Employers using an automated employment decision tool must conduct an independent bias audit before deployment, publish the results, and notify candidates at least ten business days before the tool is used. It is the most stringent AI hiring rule currently enforced.
Why does California matter even if I'm not based there?
California's automated decision-making rules took effect October 1, 2025 and require retaining automated-decision and employment records for at least four years. Because the rules follow the candidate's location, hiring any California-based applicant can trigger them, and a typical 12 to 24 month ATS purge becomes a compliance gap.
Is Colorado's AI Act in effect?
Not currently. The comprehensive Colorado AI Act was challenged in federal court and enforcement was stayed, leaving it unenforceable for now, so its requirements are in flux and should not be treated as settled.