AI Hiring Tools and Automated Employment Decision Law in 2026: What Engineering Owes Legal

Most writing about AI hiring compliance addresses the people who buy the tools. This piece addresses the people who have to produce evidence when somebody asks how a decision got made, because that burden lands on engineering regardless of who signed the contract.

Three jurisdictions matter most right now, and they impose different obligations on different timelines.

New York City: Local Law 144

New York City regulates the automated employment decision tool, meaning a system using machine learning or comparable techniques to substantially assist decisions about hiring, firing, or promotion. The Department of Consumer and Worker Protection enforces it and began doing so on July 5, 2023.

Three obligations attach.

A bias audit within one year of use. An independent auditor examines whether the tool produces materially different outcomes across protected classes. The law does not prescribe auditor credentials, which places the burden of defensible auditor selection on the employer.

Candidate notice 10 business days before use. Applicants and employees learn in plain language that an AEDT will assist decisions affecting them, along with what the tool does.

Public availability of the audit results. Summary findings go where the public can read them, not into an internal compliance folder.

The audit recency requirement carries an operational consequence people miss. One year of validity means the audit becomes a recurring obligation tied to a calendar, and a model retrained in March invalidates reasoning built on an audit from the previous autumn.

Illinois: Public Act 103-0804

Illinois took a different route, amending the Human Rights Act rather than creating a disclosure regime. HB 3773 makes it a civil rights violation for an employer to use artificial intelligence discriminatorily across recruitment, hiring, promotion, renewal, training selection, discharge, discipline, tenure, and the terms of employment.

The statute goes further on proxies. An employer using predictive data analytics may not consider an applicant’s race, nor a zip code used as a proxy for race, to reject that applicant. The same act amends the Consumer Fraud and Deceptive Business Practices Act along parallel lines for creditworthiness decisions.

The law explicitly preserves using predictive analytics to support including diverse candidates, so the prohibition targets exclusion rather than analysis.

Illinois also regulates AI in video interviews separately, requiring advance notice that AI will evaluate responses and consent before that evaluation runs.

The zip-code provision deserves engineering attention specifically. Proxy discrimination rarely appears in a feature list. It emerges from correlated features nobody labeled as sensitive, which means detecting it requires deliberate testing rather than a code review.

Colorado: Moved to 2027

Colorado passed SB24-205 covering algorithmic discrimination in consequential decisions, employment among them, originally effective February 1, 2026.

That is no longer the operative law. SB26-189, signed in May 2026, repeals and reenacts those provisions with new requirements for automated decision-making technology in consequential decisions, effective January 1, 2027.

Any compliance plan still citing the February 2026 date describes a statute that no longer exists in that form. Colorado’s Attorney General maintains rulemaking materials covering automated decision-making technology.

The Federal Layer

Federal law never went quiet. The EEOC holds that anti-discrimination statutes apply to employment decisions regardless of the technology making them, and it joined the Justice Department, FTC, and CFPB in a joint statement on enforcement against discrimination in automated systems.

Federal contractors carry an additional burden. OFCCP’s AI and EEO guidance extends existing obligations to automated systems, and its compliance reviews now request documentation covering the policies, practices, and systems used to recruit, screen, and hire, including AI and algorithmic selection procedures.

What Engineering Has to Build

Compliance teams write the policy. Engineering supplies the evidence, and four capabilities carry most of the weight.

Decision provenance. For any candidate, reconstruct which model version scored them, on which features, at which threshold, on which date. A log that records an outcome without recording the deciding version answers nothing a year later.

Model version retention tied to the audit calendar. Because audits expire annually and retraining resets the analysis, version history has to outlive the model in production.

Proxy testing as a gate rather than a study. Measure outcome distributions across protected classes on every candidate-facing model before release, and treat correlated geographic features as suspect by default.

Notice plumbing. Ten business days of advance notice means the application flow has to deliver the notice, record that it went out, and record when. A policy commitment nobody instrumented produces no evidence.

Vendor contracts deserve the same rigor. If a third party scores your candidates, your obligation does not transfer with the work. Ask who performed their bias audit, when it expires, and what the contract entitles you to receive when a regulator or a plaintiff asks.

Our AI recruiting tools guide covers the tooling side for hiring managers, and our HR and talent operations guide covers the platform layer. This piece covers what those tools obligate you to prove.

Frequently Asked Questions

Does Local Law 144 apply if my company sits outside New York City? It attaches to the employment decision rather than to your headquarters, so hiring for roles in the city brings it into scope.

Does a vendor’s bias audit satisfy my obligation? Treat it as evidence rather than as transfer of responsibility, and confirm the audit covers your configuration rather than a reference deployment.

Does Illinois require notice like New York does? The Human Rights Act amendment addresses discriminatory use rather than disclosure, while the video interview statute carries its own notice and consent requirements.

What if we use AI only to rank rather than to reject? Substantial assistance to a decision brings a tool into scope, and ranking that shapes who gets reviewed assists the decision.

This piece summarizes public regulatory materials and does not constitute legal advice. Effective dates move, as Colorado demonstrated this year, so confirm current requirements with counsel before you rely on them.