AI hiring laws by state: a dated summary for recruiters

There is no general federal AI hiring law in the United States as of September 2026. Federal anti-discrimination law already covers selection procedures, whoever or whatever produced them, and on top of that a short list of states and cities have AI-specific rules: New York City requires bias audits and notices for automated employment decision tools, Illinois regulates AI analysis of recorded video interviews and AI in employment decisions generally, Maryland requires consent for facial recognition in interviews, California adds privacy and civil rights rules, and Colorado and Connecticut have transparency regimes that start in 2027.

This page is a summary with the dates and links, so you can see the whole map on one screen and then read the detail where it affects you. It is not a substitute for the statutes it cites or for advice in your states.

The map in one table

What is in force today

New York City: bias audits and 10 business days' notice

Local Law 144 bars using an automated employment decision tool to screen candidates for NYC-linked roles unless it has had an independent bias audit within the past year, a summary of the results is published, and candidates get notice at least ten business days ahead. The definition turns on "simplified output" that substantially assists or replaces discretionary decision making, and DCWP's rules say that phrase does not cover output from tools that transcribe an interview. Employment agencies have their own obligations. Detail, including the three ways a score counts as substantially assisting, is in the Local Law 144 guide.

Illinois: two different laws

The Artificial Intelligence Video Interview Act has applied since January 1, 2020 to employers that ask applicants to record video interviews and use AI to analyze them for Illinois-based positions: notice, explanation, consent, sharing limits and deletion within 30 days of a request. Separately, the Human Rights Act amendment in force since January 1, 2026 reaches any AI used in recruitment, hiring and other employment decisions. The common error that the video interview act started in 2026 confuses the two. See the Illinois guide, which also covers voiceprints under the Biometric Information Privacy Act.

Maryland: consent for facial recognition in interviews

Maryland's statute is narrow and easy to comply with: an employer may not use a facial recognition service to create a facial template during an applicant's interview unless the applicant consents by signing a waiver that states their name, the interview date, that they consent, and that they read the waiver. If your video interview vendor offers any face analysis, this is the question to ask before a Maryland interview.

California: two regimes, both live

The Civil Rights Council's regulations, effective October 1, 2025, apply existing discrimination law to automated-decision systems and require employment records, including automated-decision data, to be kept for at least four years. Separately, applicants have full CCPA rights, which means a notice at collection, retention periods and 45-day responses; interview notes, recordings and AI summaries are all personal information. The CCPA guide for applicant data has the notice template and the January 2027 ADMT dates.

Texas: intent, not impact

The Texas Responsible Artificial Intelligence Governance Act, in force since January 1, 2026, prohibits developing or deploying an AI system "with the intent to unlawfully discriminate against a protected class," and says a disparate impact is not by itself sufficient to show that intent. It is enforced by the attorney general with a 60-day cure period. It is a lighter regime than Colorado's, and it does not displace federal law, which does recognize disparate impact claims.

What is coming

Colorado, January 1, 2027

Colorado repealed its 2024 AI act and replaced it with rules on automated decision-making technology in consequential decisions, which include employment. If a covered ADMT materially influences a hiring decision about a Colorado applicant, you owe a notice before use, a disclosure within 30 days of an adverse outcome, correction and human review rights, and three years of records. The attorney general is required to adopt rules by January 1, 2027, so the detail will move. See the Colorado guide.

Connecticut, October 2026 and October 2027

Public Act 26-15 defines "automated employment-related decision technology" as technology whose output is "a substantial factor used to make or materially influence an employment-related decision," excluding software used incidentally and purely descriptive, diagnostic or statistical information that is not relied on. From October 1, 2026, using such technology is not a defense to a discrimination complaint under section 46a-60, and the commission or a court may consider evidence of anti-bias testing, including its quality, recency and scope. For deployments on or after October 1, 2027, a deployer must disclose when a candidate is interacting with the technology and, before the decision, give a written notice covering: that it is deployed, the purpose and the nature of the decision, the trade name of the technology, the categories of personal data it will analyze and how they will be assessed, the sources of that data, and contact details. Enforcement is by the attorney general as an unfair trade practice, with a 60-day cure for violations occurring on or before December 31, 2027, and no private right of action.

California ADMT rules, January 1, 2027

Businesses using automated decisionmaking technology to make significant decisions, which expressly include hiring, must comply with pre-use notice, opt-out and access requirements by January 1, 2027, with risk assessments on their own schedule.

What did not happen, and why that matters

• Colorado's 2024 act, once treated as the model for state AI regulation, was delayed twice and then repealed and reenacted in a much narrower form before it ever applied.
• California's SB 7, which would have restricted automated decision systems in employment, was vetoed, and the veto was sustained on March 2, 2026.
• Plenty of widely reported bills in other states died in committee.

The practical lesson: build your process around what the output does and who decides, not around one jurisdiction's checklist. A process with a named human decision-maker, a written record of how tool output is used, notices you can adapt, and a retention schedule satisfies most of these regimes with local edits.

Recording consent is a separate question

None of these laws is about recording as such. Whether you may record or transcribe an interview at all is governed mostly by state wiretap statutes, and the answer does not change because no AI is involved. Start with is it legal to record a job interview, the table in two-party consent states, and recording calls across state lines for interviews where the recruiter and candidate are in different states. If you hire in the UK or the EU, data protection comes first: see recording interviews under UK GDPR and the EU AI Act guide.

Working out your own exposure

Four questions decide which rows of the table apply to a given process:

1. Where is the job? Illinois' video act keys off positions based in Illinois; NYC's rule keys off roles tied to a city office, including fully remote roles associated with one.
2. Where is the candidate? Colorado's rules reach Colorado-resident applicants, California's privacy rules reach California residents, and consent law follows the people on the call.
3. What does the tool output? A transcript, a summary, a rating, a ranking, a recommendation. Every statute here is written around output that influences an outcome.
4. Who actually decides? Colorado's "materially influence," Connecticut's "substantial factor," California's "substantially replace human decisionmaking" and NYC's "substantially assist or replace" are four ways of asking the same thing. A named human reviewer with authority, who sees more than the score, is the common answer.

Keep the answers in one register rather than in four people's memories:

AI hiring tool register (one row per tool feature)

Tool and feature:        [vendor, feature, version]
What it outputs:         [transcript / summary / rating / ranking / recommendation]
Who sees the output:     [roles]
Weight in the decision:  [sole factor / one of several / advisory only]
Human decision-maker:    [named role, trained on date]
Can it be overridden:    [yes/no, by whom, evidenced how]
Jurisdictions in play:   [job location(s), candidate location(s)]
Notices given:           [careers page / posting / invitation / pre-use notice]
Audit or testing:        [bias audit date, auditor, or anti-bias testing done]
Records kept:            [what, where, how long]
Vendor answers on file:  [documentation, limitations, training data, deletion]
Reviewed:                [date, by whom, next review]

Federal law still does the heavy lifting

Title VII, the ADA and the ADEA apply to a selection procedure however it is produced, and the Uniform Guidelines on Employee Selection Procedures (29 C.F.R. part 1607) apply to tests and other selection procedures used as a basis for employment decisions. A tool that screens out candidates with disabilities, or that scores an accent, creates federal exposure regardless of which state rule applies. Two habits reduce that risk more than any notice: run a structured process where every candidate is asked the same core questions and scored against defined criteria, and keep evidence for each rating. The methods are in evidence-based interview feedback and how to reduce bias in interviews.

Interview Signal is built for that pattern: a transcript and a scorecard whose ratings carry the candidate's own words, with the decision left to the people in the room. Whatever tool you use, the register above and a human who can explain the decision are what these statutes keep asking for.