The rules for AI in hiring, as of September 2026.

Several places where you might hire now regulate AI in hiring, and most of the rules ask for the same things: tell candidates, explain the tool, keep a person in charge and check for bias. This guide summarizes where the main rules stand as of September 24, 2026, then gives a checklist for AI interviews. It is not legal advice. Rules change quickly, so check the sources and talk to a lawyer before relying on it.

The short version

United States

No federal law is written specifically for AI in hiring, but existing anti-discrimination law applies to decisions made with AI. A December 11, 2025 executive order told the Justice Department to challenge some state AI laws. It can’t repeal them by itself, so the rules below stand unless a court or legislature changes them.

New York City: Local Law 144

Who: employers and agencies using an “automated employment decision tool” for jobs in New York City: software that produces a score, classification or recommendation used to substantially assist or replace a hiring decision.

What: an independent bias audit within the year before use, a public summary of the results, and notice to candidates at least 10 business days before use, covering what the tool assesses and how to request an alternative process or accommodation.

Status: enforced since July 5, 2023, with penalties of $500 to $1,500 per violation. A December 2025 State Comptroller audit called enforcement ineffective. Whether an AI interview tool is covered depends on how heavily its output drives decisions, which isn’t settled.

Illinois: AI Video Interview Act

Who: employers that use AI to analyze recorded video interviews for Illinois-based positions. I couldn’t confirm whether audio-only interviews are covered.

What: before the interview, tell applicants AI may analyze the video, explain how it works and what general characteristics it evaluates, and get consent. Share videos only with people needed to evaluate them, and delete them within 30 days of a request, including copies others hold. Employers relying solely on AI to pick who gets an in-person interview must report applicants’ race and ethnicity to the state each year.

Illinois: HB 3773

Who: employers covered by the Illinois Human Rights Act.

What: don’t use AI in a way that discriminates against protected groups in recruiting, hiring, promotion, discipline or firing, even unintentionally. Don’t use zip codes as a proxy for protected characteristics. Tell applicants and employees when AI is used in those decisions.

Status: in force since January 1, 2026. The state published proposed notice rules in May 2026 and withdrew them in June. With no final rules, exactly what the notice must say is unsettled, but the law applies.

Colorado: SB 26-189

The original Colorado AI Act (SB 24-205) was delayed from February to June 30, 2026, then paused in April under a federal court order in a lawsuit challenging it. The legislature replaced it with SB 26-189, signed May 14, 2026, which applies from January 1, 2027.

What, per the legislature’s summary: clear notice when an automated tool is used for consequential decisions such as employment; a plain-language description of the tool’s role within 30 days of an adverse outcome; a way to access and correct data; human review and reconsideration on request; and records kept for three years. The attorney general enforces it, with a 60-day chance to fix problems until 2030, and there’s no private right to sue. I couldn’t confirm size thresholds or whether further rules will follow.

California

Civil Rights Council rules (in force October 1, 2025) apply employment discrimination law to automated-decision systems, for employers with five or more employees. Vendors acting for you can share liability. Anti-bias testing, including what you did about the results, is relevant evidence if you’re challenged, and its absence can count against you. Keep related records for four years.

CCPA automated decision-making (ADMT) rules apply from January 1, 2027 to CCPA-covered businesses (for example, for-profit businesses above an inflation-adjusted revenue threshold of about $25 million) using technology that replaces or substantially replaces human decisions about hiring. Human review only counts if the reviewer understands the output and can change the decision. Covered uses need a pre-use notice, an opt-out (with exceptions, such as a human appeal), access rights and a risk assessment.

European Union

Under the AI Act, systems used to recruit, filter applications or evaluate candidates are “high-risk.” It reaches employers in the EU and organizations outside it whose AI output is used there. Employers will need to use such systems as instructed, assign trained people to oversee them, keep logs for at least six months, inform workers’ representatives, tell people a high-risk system is used in decisions about them, and support data protection impact assessments.

Status: the Digital Omnibus on AI entered into force July 27, 2026 and moved these obligations from August 2, 2026 to December 2, 2027. Some rules already apply: emotion recognition in the workplace has been banned since February 2, 2025 (apart from narrow medical and safety uses), and transparency rules for AI that talks with people applied from August 2, 2026. The GDPR applies now, including limits on solely automated decisions.

United Kingdom

The UK has no AI-specific hiring law, but two sets of rules apply.

Data protection. Since February 5, 2026, new Articles 22A to 22D of the UK GDPR allow solely automated decisions with significant effects on more legal grounds, except where special category data such as health data is involved. You must still tell people, let them give their side, offer human intervention and let them contest the decision. In March 2026 the Information Commissioner’s Office said many employers are probably making solely automated recruitment decisions and set out its expectations: bias monitoring, transparency and a clear route to human review. I couldn’t confirm whether its updated guidance, consulted on until May 29, 2026, is final.

Equality Act 2010. A tool that disadvantages a protected group without good justification can be indirect discrimination, and disabled candidates are owed reasonable adjustments, such as another format or more time.

India

The Digital Personal Data Protection Act 2023 covers digital personal data processed in India, and some processing abroad tied to offering goods or services in India. The DPDP Rules, notified in November 2025, phase in: consent managers from November 2026 and most duties from May 2027. A reported plan to shorten this had not been notified as of September 2026.

Once in force, you’ll need a clear notice of what you collect and why, and consent or a recognized “legitimate use.” One legitimate use covers employment, but whether it covers candidates who aren’t yet employees is debated, so many employers ask for consent for recorded interviews. Add security, breach reporting, deletion when the purpose is served, and rights to access, correct and erase data. There’s no AI-specific hiring law.

A checklist for AI interviews

1. Map where you hire. Your jobs’ and candidates’ locations decide which rules apply.
2. Give notice first. Say AI runs the interview, it’s recorded, what it evaluates and how results are used. In NYC, allow 10 business days for covered tools. Sample: “This interview is conducted by AI. It’s recorded, and your answers are scored against the skills below. A person on our team reviews the results and makes every decision.”
3. Explain what’s assessed in plain words.
4. Get consent where required, such as AI-analyzed video in Illinois, and keep a record.
5. Keep a person in charge. Reviewers should understand the output and be able to change it. If a tool sets candidates aside below a cutoff, treat that as a decision: review a sample and let candidates ask for human review.
6. Offer another route, including accommodations for disabled candidates.
7. Monitor for bias. Compare pass rates across groups where you lawfully can, act on gaps and keep records.
8. Set retention and deletion rules. Honor deletion requests (30 days for Illinois video) and check them against duties like California’s four-year records.
9. Ask your vendor: What is scored, and from what? Do you analyze faces or emotions? What bias testing have you done? Where is data stored, for how long, and is it used for training? How do deletions work? What do candidates see?

If you use LessRounds: before starting, candidates are told the interview is AI-run, recorded and evaluated, and asked to agree. A person on your team makes decisions; candidates below your pass mark are set aside, never emailed, and can be moved back. Every score comes with reasoning and a transcript quote. Recordings are kept up to three years or deleted on request to privacy@lessrounds.ai. These help with notice and human review, but the obligations above are yours. See our approach to responsible AI and telling candidates about AI interviews.

Sources

• NYC DCWP: AEDT rules
• NY State Comptroller: Local Law 144 audit
• Illinois: AI Video Interview Act
• Reinhart: Illinois HB 3773
• Techné AI: IDHR rulemaking tracker
• Colorado: SB 26-189
• Colorado: SB 25B-004
• McDermott: Colorado AI law in flux
• California Civil Rights Council
• Jackson Lewis: California ADS rules
• Littler: California ADMT rules
• European Commission: AI Omnibus
• Gibson Dunn: AI Omnibus agreement
• AI Act Article 26
• ICO: Data (Use and Access) Act 2025
• ICO: Recruitment rewired
• Travers Smith: UK automated decisions
• legislation.gov.uk: Equality Act 2010
• PIB: DPDP Rules notified
• dpdprules.org: DPDP timeline