A VP of Talent Acquisition at a 4,000-person company opens the Q1 2027 planning deck and finds a new line from legal: every screening tool that touches candidates in Colorado, Illinois, California or New York City needs a compliance owner by year-end. Nobody on the TA team has ever been asked who owns the vendor's bias testing. The reqs don't stop while that gets sorted out.

US AI hiring laws in 2027 are a patchwork of state and city rules that apply when automated tools influence employment decisions. They generally require some mix of candidate notice, bias testing, record retention and human review, and they apply based on where the candidate is, not where your company is headquartered. Screening teams need to know which rules are live, which are still settling, and what evidence they should be able to produce on request.

Colorado replaced its AI Act, and the new one starts January 1, 2027

Colorado's original AI Act is gone, and its narrower replacement takes effect at the start of 2027. According to Nixon Peabody's analysis of SB 26-189, the bill repealed the 2024 law's duty of care, impact assessments and risk management program requirements in favor of a disclosure model, and it takes effect January 1, 2027. It covers automated decision-making technology that materially influences a consequential decision, and employment is one of the named categories.

That is lighter than what many teams budgeted for, but it is not nothing. Deployers still need to be able to tell candidates when such a tool is in play, and developers owe deployers documentation on intended uses, limitations and human review. The Attorney General's rulemaking is still shaping the details, and a pending legal challenge to the original law adds uncertainty about timing. Treat the date as firm for planning and the specifics as moving.

Illinois already prohibits discriminatory effect, with notice rules unsettled

Illinois is the one most teams underestimate because it is already in force. HB 3773 amended the Illinois Human Rights Act, and as Epstein Becker Green's summary explains, it regulates AI used in employment decisions and sits alongside the state's earlier AI Video Interview Act and its Biometric Information Privacy Act. The amendments took effect January 1, 2026.

The standard is effect, not intent. A tool can be built with good intentions and still create liability if it produces discriminatory outcomes, and zip codes cannot be used as a proxy for protected classes. The statute also requires notice to candidates, but the Illinois Department of Human Rights is responsible for the detailed notice rules, and reporting suggests those rules have not settled. Check the Department's current guidance before you finalize notice language.

California puts four years of records and anti-bias testing in play

California's rules came through the Civil Rights Council and took effect October 1, 2025. Per Proskauer's breakdown, employers must keep automated-decision system data for at least four years, and an employer's anti-bias testing, or lack of it, is relevant to its defense in a discrimination claim.

The practical consequence sits with the person who owns the vendor relationship. If a candidate challenges a rejection three years from now, the question is whether you can show what the tool did, what it was tested for, and what a human reviewed. A vendor that cannot export that history is a risk you inherited.

New York City has a law on the books and an enforcement gap

NYC Local Law 144 requires an annual independent bias audit, a published summary and candidate notice for automated employment decision tools. Enforcement has been thin, but that is changing the conversation, not ending it. In its December 2025 audit of the city's enforcement, the New York State Comptroller found that the city's consumer protection department identified a single issue of non-compliance across 32 companies, while auditors reviewing the same companies found at least 17 potential instances.

A regulator being criticized for missing violations tends to look harder next time. Candidates also talk, and a published audit summary that doesn't hold up is easy for anyone to spot.

What screening teams should be able to show

Across the four jurisdictions, the evidence requests look similar. Build a single file per tool rather than four separate programs:

  • An inventory: every tool that scores, ranks, screens or recommends candidates, and which locations it touches.
  • Candidate notice: where and when candidates are told, in plain language.
  • Bias testing: the most recent results, who ran them, and what changed afterward.
  • Human review: who looks at the output and what they can override.
  • Retention: four years of tool data that you can actually retrieve.

Structured screening makes this file easier to build, because every candidate answers the same questions against criteria the recruiter set in advance. Our post on what AI candidate screening actually does and doesn't do covers where that consistency helps and where the decision stays with people, and the volume angle is in AI candidate screening for high-volume IT recruiting. Sia, the Eximius screening agent, collects responses against job-specific criteria and the recruiter reviews and decides. That reduces inconsistency; it does not remove the need for testing or oversight, and no vendor can promise that it does.

Frequently Asked Questions

Which AI hiring laws apply to a company headquartered outside these states?

These rules generally apply based on where the candidate or employee is located, so a company based elsewhere can be covered when it screens candidates in Colorado, Illinois, California or New York City.

Does the Colorado AI Act still exist in 2027?

The original 2024 act was repealed and replaced by SB 26-189, a narrower disclosure-focused law that takes effect January 1, 2027, with Attorney General rulemaking still shaping details.

Does a human making the final decision exempt us?

Not necessarily. California's rules reach tools that facilitate human decision making, and Illinois focuses on discriminatory effect, so human sign-off alone is not a safe harbor.

What should we ask AI screening vendors?

Ask for recent bias testing results, how candidate notice is supported, what data can be exported for four-year retention, and where human review sits in the workflow. This is general information, not legal advice, so have counsel confirm your obligations.

Start with the inventory this quarter, because every other requirement depends on knowing which tools touch which candidates. Then ask each vendor for the evidence file before a regulator or a plaintiff does.

Want to see what structured screening looks like on your req volume? Book a demo and we'll run your next role through the Eximius workflow.