AI Hiring Laws In 2027: A State-By-State Guide For Talent Acquisition Leaders

New rules in Colorado, California, Connecticut, and other states take effect over the next year, each with different deadlines and definitions. Employers can prepare for all of them by building one defensible process rather than chasing each law separately.

AI is now a routine part of hiring. According to Criteria's 2026-2027 Hiring Benchmark Report, 56% of hiring professionals said they already use AI in their hiring process. The rules governing that use are arriving fast, and they don't always agree with each other.

In the U.S., there's no federal AI hiring law. In its place, 2027 brings a patchwork of state and local requirements. Colorado's rewritten AI law and California's new privacy rules for automated decision tools both take effect January 1, 2027. Connecticut's applicant notice requirements follow in October. Illinois, Texas, and New York City already have rules in force. Each law defines covered technology differently, sets its own deadlines, and asks for slightly different things.

Several of the deadlines have already moved at least once, and more changes are possible. That makes chasing each date a losing strategy. The safer approach is to be defensible by design: know which tools influence hiring decisions, be able to explain how they work, tell candidates when they're used, document decisions, and keep a person responsible for the final call. Teams that do these five things will meet most of what any state asks for.

AI hiring laws by state: the 2027 map

The table below lists the main U.S. rules that cover AI in hiring, in order of when they took or take effect. Status is current as of November 2026.

Colorado's law is in effect, but enforcement is paused

Colorado is the clearest example of how quickly these rules can shift. The state's original 2024 AI Act was delayed twice, then challenged in federal court by xAI. In April 2026, a federal court stayed enforcement of that law and any replacement until 14 days after it rules on xAI's planned motion for a preliminary injunction. That motion is due within 28 days after the attorney general's rules are final. In May, the legislature replaced the law with SB 26-189, a narrower, notice-based framework that drops the earlier impact assessment and risk-management requirements. The attorney general held a rulemaking hearing on October 26, 2026.

The obligations still begin January 1, 2027, so employers with Colorado applicants should be ready on that date even if enforcement starts later.

The federal picture: less guidance, same liability

Federal agencies have stepped back from AI hiring oversight. The EEOC removed its AI guidance from its website in January 2025, and an April 2025 executive order directed agencies to deprioritize disparate-impact enforcement. That hasn't changed the underlying law. Title VII, the Age Discrimination in Employment Act, and the Americans with Disabilities Act still apply to AI-driven selection tools, and private plaintiffs can still bring disparate-impact claims.

The most closely watched of those claims is Mobley v. Workday, a case alleging that AI screening tools discriminated against applicants by age, race, and disability. A federal court has allowed the case to proceed on the theory that a vendor can act as an employer's agent, and the plaintiffs moved for class certification in September 2026. No court has found Workday liable, and the company denies the claims. The case is a reminder that responsibility for an AI-influenced decision doesn't stop with the software.

The administration is also trying to limit state AI laws. Executive Order 14365, signed in December 2025, created a Justice Department AI Litigation Task Force to challenge state AI laws it views as burdensome, and the United States has joined the xAI challenge to Colorado's law. But an executive order can't repeal state law on its own. Until Congress passes a preempting statute or a court strikes a law down, state requirements remain enforceable. As one National Law Review analysis puts it, compliance can't wait for constitutional clarity.

What the laws have in common

The details differ, but most of these rules have five things in common.

Tell candidates when AI is involved

Notice is the most widely shared requirement. New York City, Illinois, Colorado, Connecticut, and California's privacy rules all require some form of disclosure when an automated tool influences an employment decision. The timing and content vary, from New York City's 10-business-day advance notice to Connecticut's written pre-decision notice naming the tool and the data it uses.

Explain decisions and offer a human review

Colorado requires employers to explain adverse decisions influenced by covered tools and to offer meaningful human review. California's privacy rules give candidates a right to access information about how a tool was used and, in many cases, to opt out. Rules about human involvement show up across the board: California's ADMT regulations apply only when a tool replaces or substantially replaces human decision-making, and SB 947 bars relying solely on an automated system for discipline and firing.

Test for bias

New York City requires an annual independent bias audit. California's privacy rules require risk assessments. Where audits aren't mandated, they still matter: in a discrimination claim, the employer has to show its selection process is job-related and fair, and evidence of testing is the strongest defense available.

Keep records

California's civil rights regulations require employers to keep automated-decision data for four years. Colorado requires three years of compliance records. Teams that can't show what a tool assessed, what it recommended, and who made the final decision will struggle to defend that decision later.

Own the vendor's tool

Connecticut now states plainly that using an automated tool is not a defense to a discrimination claim. California's regulations extend liability to vendors acting for the employer, and the Mobley case is testing the same idea in federal court. Buying a tool doesn't transfer the responsibility.

How to be defensible by design

A compliance program built around one state's deadline will need rebuilding when the next state acts. A program built around those shared principles holds up across jurisdictions. Here's what that looks like in practice.

Inventory every tool that touches a hiring decision

Start with a complete list: resume screening and ranking features inside the applicant tracking system, assessment platforms, AI interview scoring, scheduling and screening chatbots, and any general-purpose AI tools recruiters use to summarize or compare candidates. Illinois's law covers AI use in employment decisions broadly, so informal uses count too. For each tool, record what it evaluates, what it outputs, and how much weight that output carries.

Make explainability a buying requirement

If a team can't explain how a tool reaches its output, it can't explain that output to a candidate, an auditor, or a court. Josh Millet, Founder and CEO of the talent signal platform Criteria, sets a simple bar for any AI that influences hiring. "The customer should be able to explain in two sentences how it works," Millet said. "And if they can't, they shouldn't use it in their hiring process."

He adds that "proprietary" is not an acceptable answer from a vendor when the decision is who gets hired. "It has to be transparent, it has to be auditable, it has to be explainable," he said. Our guide to evaluating AI hiring tools covers the questions to ask, and Colorado and Connecticut now require developers to give employers the documentation they need to comply.

Write one notice that meets the strictest standard

Rather than drafting a different disclosure for each state, write one candidate notice that covers the most demanding requirements: that an automated tool is used, what it evaluates, what data it relies on, and how a candidate can request human review or an alternative process. Deliver it early enough to meet New York City's 10-business-day window.

Keep a person responsible for the decision

Human review is easiest to defend when it's built into the process rather than added on request. Define who reviews AI outputs, what additional information they consider, and when they can override a recommendation.

Test for adverse impact, and validate the job connection

Run adverse impact analyses on every tool and selection step, not only those a law names, and repeat them as hiring volume and applicant pools change. Pair that with evidence that each step measures something the job requires, the core test under the federal Uniform Guidelines on Employee Selection Procedures. Validated pre-employment assessments and structured interviews scored against defined rubrics are far easier to defend than unexplained rankings or unstructured conversations.

Document everything, and keep it for four years

Retain tool inputs and outputs, notices sent, human review notes, and audit results. A four-year retention policy satisfies California's requirement and covers Colorado's three years.

Name an owner and track the changes

Assign one person or team, usually across TA, legal, and HR technology, to watch these laws. Colorado's final rules, Illinois's withdrawn notice rules, and the outcome of the federal challenges could all change requirements within months.

Outside the States: the EU AI Act's new timeline

U.S. employers that hire in Europe face a more comprehensive regime. The EU AI Act classifies AI used in recruitment and worker management as "high-risk," which brings requirements for risk management, data quality, human oversight, and documentation. Those obligations were due to apply on August 2, 2026. The EU's Digital Omnibus package, which entered into force on July 27, 2026, moved that date to December 2, 2027.

The delay pushes back the deadline without removing the requirements. Multinational employers that design their U.S. processes around notice, human oversight, testing, and records will be much of the way toward the EU standard as well.

FAQ

Which states regulate AI in hiring in 2027?

As of November 2026, AI hiring rules are in force in New York City, Illinois, Texas, and California, with Connecticut's first provisions in effect since October 2026. Colorado's revised law and California's privacy regulations on automated decision-making technology take effect January 1, 2027. Connecticut's applicant notice requirement follows on October 1, 2027.

When does the Colorado AI Act take effect for employers?

Colorado replaced its original AI Act with SB 26-189 in May 2026. The new law's requirements begin January 1, 2027, and the attorney general must adopt implementing rules by that date. A federal court order currently pauses enforcement until after rulemaking concludes and the court rules on a pending challenge.

What do California's ADMT regulations require of employers?

Starting January 1, 2027, CCPA-covered businesses that use automated decision-making technology to make hiring or other employment decisions without meaningful human involvement must give candidates a pre-use notice, honor opt-out requests unless an exception applies, respond to access requests, and complete a risk assessment.

Is there a federal law on AI in hiring?

No. There is no federal statute specific to AI in hiring, and the EEOC removed its AI guidance in 2025. Existing federal anti-discrimination laws, including Title VII, the ADEA, and the ADA, still apply to AI-driven selection tools.

Can the federal government override state AI hiring laws?

A December 2025 executive order directed the Justice Department to challenge state AI laws, but an executive order cannot repeal state law on its own. State AI hiring laws remain enforceable unless Congress passes a preempting law or a court strikes them down.

Do employers need a bias audit for AI hiring tools?

New York City requires an annual independent bias audit for automated employment decision tools. Most other states don't mandate one, but regular adverse impact testing remains the strongest defense against discrimination claims under federal and state law.

When does the EU AI Act apply to AI used in hiring?

The EU AI Act's high-risk requirements, which cover AI used in recruitment and employment, now apply from December 2, 2027, after the EU's Digital Omnibus package delayed the original August 2026 date.