AI Hiring Laws in the US: A Compliance Checklist for Employers

There is no single US law on AI in hiring. What exists is a layer of long-standing federal civil rights law that applies to any hiring tool, plus a growing set of city and state rules that depend on where the candidate or the job is. The mistake most employers make is checking only the newest AI-specific rule and missing the older law that carries the larger exposure. This checklist goes in the order that avoids that.

Step 1: Start with federal law, which already applies

Title VII, the Americans with Disabilities Act and the Age Discrimination in Employment Act apply to employment decisions whether a person or a program made them. Two points carry most of the weight:

• A vendor's tool is your tool. The EEOC's now-withdrawn guidance said an employer can be liable for a selection procedure's disparate impact even if a vendor built and ran it. Withdrawing the web page did not change the statutes. See what the EEOC guidance said and what still governs.
• Disabilities and accommodations. A tool that screens out candidates who need an accommodation, or that cannot offer an alternative way to be assessed, is an ADA problem independent of any AI-specific law.

Step 2: If you hire in New York City, check Local Law 144

Local Law 144 applies to automated employment decision tools used to screen candidates or employees for hiring or promotion in the city. Before using one, the employer must make sure the tool has been the subject of an independent bias audit within the past year, publish a summary of the results, and give candidates notice. The city's enforcement agency has taken the position that the employer, not the tool's vendor, is responsible for compliance.

Enforcement has been thin. The New York State Comptroller's December 2025 audit criticized the city for not enforcing proactively, and law firms expect a stricter phase. Penalties are charged per violation, and sources differ on the exact schedule, with the Comptroller's audit citing $500 to $1,500 per day. Check the agency's current schedule. For the state-level rules that sit beside this one, see our New York breakdown.

Step 3: If you hire in Illinois, check HB 3773

Illinois HB 3773 amended the Illinois Human Rights Act. It is a civil rights violation to use AI in a way that has a discriminatory effect on employment decisions, to use zip codes as a proxy for a protected class, or to fail to notify employees or applicants when AI is used for specified employment decisions. It requires notice, not consent, and there is no opt-out. The Illinois Department of Human Rights proposed notice rules in May 2026 and withdrew them in June, so the form of the notice is still unsettled. If your tool scores faces or voices in video interviews, the separate biometric privacy law may apply too. See our Illinois breakdown.

Step 4: If you hire in California, check the FEHA regulations

The California Civil Rights Council's regulations on automated-decision systems under the Fair Employment and Housing Act took effect on October 1, 2025. They apply to employers using automated-decision systems in employment decisions, including where a human makes the final call, and extended the retention period for employment records to four years, covering data from the systems themselves. Evidence of anti-bias testing, or the lack of it, may bear on available defenses. The California Privacy Protection Agency's separate automated decision-making rules for significant decisions apply from January 1, 2027. See our California coverage.

Step 5: If you hire in Colorado, plan for January 1, 2027

Employment is one of the categories of consequential decisions under SB 26-189, which replaced Colorado's original AI Act. From January 1, 2027, developers must give deployers documentation, deployers must give notice at the point of interaction and a plain-language explanation within 30 days after an adverse decision, and consumers can request human review. See our Colorado page for the details and what we have not verified.

Step 6: Build one process that covers all of them

The rules differ in detail but ask for the same underlying things. A single process can cover most of them:

1. Inventory every tool that scores, ranks, filters or recommends candidates, including features inside your applicant tracking system.
2. Ask each vendor what adverse-impact testing it has done, and get the answer in writing.
3. Run or commission your own testing on your actual applicant data. Document it. This serves federal law, NYC's audit, and California's defense point at once.
4. Write the candidate notice once, then adjust by location.
5. Offer an alternative route for candidates who need an accommodation, and a way to request human review.
6. Keep records for four years, the longest period among these rules, including tool inputs and outputs.

What this checklist is not

This is a summary of publicly available law and regulator material, not legal advice, and several of these rules are moving. The Illinois notice rules are unsettled, New York City enforcement is changing, and Colorado's attorney general rules are still to come. Confirm the current position for each location before relying on it.

Not sure which of these applies to you? Use our Which AI laws apply to me? checker.