The rules on AI in hiring changed more in the last twelve months than in the five years before, and two of the biggest deadlines moved.
If your hiring team uses AI to source, screen, call, rank or schedule candidates, you are inside at least one legal regime, probably several. The rules are not hidden. They just keep moving. Colorado rewrote its law in May. The EU pushed back its high-risk deadline in July. The UK switched on new rules for automated decisions in February.
This guide sets out where things stand on 12 October 2026, jurisdiction by jurisdiction, in plain language.
> Not legal advice. This article is a general overview for hiring teams, not legal advice. Laws and dates change, and how they apply depends on your facts. Check the primary text and speak to an employment lawyer before you rely on any of it.
Across every jurisdiction below, the same four expectations keep appearing:
If your process already does those four things well, most of what follows is detail.
There is still no federal statute written specifically for AI in hiring. Existing anti-discrimination law applies to automated decisions just as it does to decisions made by people. The long-standing federal "four-fifths" guideline, under which a selection rate for any group below 80% of the highest group's rate is generally regarded as evidence of adverse impact, is still the yardstick most bias audits use.
On 11 December 2025, the President signed an executive order challenging state AI laws and directing federal agencies to push for a national framework. An executive order does not repeal a state statute. Until a court or Congress says otherwise, the state and city rules below remain the ones to plan around.
New York City was first. Since enforcement began in July 2023, employers using an "automated employment decision tool" for candidates in the city must:
Penalties run per violation, per day. In December 2025 the New York State Comptroller published an audit calling the city's enforcement "ineffective": according to DLA Piper's summary, 75% of test calls to 311 about these tools were misrouted, and the Comptroller found at least 17 potential issues in audits where the city regulator had found one. The likely consequence is more enforcement, not less.
The Artificial Intelligence Video Interview Act has applied since 2020. If you use AI to analyse recorded video interviews, you must tell the applicant beforehand, explain how the AI works and what it looks for, and get their consent. On request you must delete the video within 30 days and instruct anyone you shared it with to do the same.
HB 3773, which amended the Illinois Human Rights Act, took effect on 1 January 2026. It makes it a civil rights violation to use AI that has a discriminatory effect in recruitment, hiring, promotion and other employment decisions, bars the use of zip codes as a proxy for protected characteristics, and requires employers to give notice when AI is used for those decisions.
Colorado's original AI Act (SB 24-205) was the most ambitious state law in the country. It never took effect. After one delay in 2025, the legislature passed SB 26-189, signed on 14 May 2026, which repeals and replaces it with a narrower law effective 1 January 2027.
The new law drops the duty of reasonable care, the risk management programme and the annual impact assessments. What remains is centred on transparency: notice to people when a covered automated decision system is used; a disclosure within 30 days when it materially contributes to an adverse decision, including how to seek reconsideration; a right to meaningful review by a person; rights to access and correct data; and three years of records. Enforcement sits with the Attorney General.
Civil Rights Council regulations under FEHA took effect on 1 October 2025. They confirm that an automated decision system that discriminates, directly or through disparate impact, can make the employer liable, even when a person makes the final call. Vendors acting for the employer can count as its "agent". Relevant data must be kept for four years.
CPPA regulations on automated decisionmaking technology (ADMT) under the CCPA require compliance by 1 January 2027 for covered businesses using ADMT that replaces or substantially replaces people's decision-making on hiring and other significant decisions. Expect pre-use notices, opt-out and access rights (with exceptions, including a genuine appeal to a person with authority to overturn), and documented risk assessments.
A broader bill, SB 7 (the "No Robo Bosses Act"), was vetoed in October 2025. Watch for new versions.
Under the AI Act, AI used in recruitment and selection is listed in Annex III as high-risk. Three dates matter for hiring teams:
The delay is a deferral, not a repeal. When the high-risk rules apply, employers as "deployers" must, under Article 26, use the system as instructed, assign oversight to people with the competence and authority to act, monitor it, keep logs for at least six months, inform workers' representatives before using it at work, and tell candidates when a high-risk system is helping to make decisions about them.
The UK has no AI-specific hiring statute. The Equality Act 2010 and UK GDPR do the work. The important change this year: the Data (Use and Access) Act 2025 replaced the old Article 22 with new Articles 22A to 22D on automated decision-making, in force from 5 February 2026. Solely automated significant decisions are now permitted more widely, provided safeguards are in place.
The ICO made clear what those safeguards mean in recruitment. On 31 March 2026 it published its Recruitment rewired report and draft guidance: test regularly for bias, tell candidates when automated decisions are used and how they work, and tell them how to challenge a decision and ask for review by a person.
At MetaDay we built our AI recruiter around the four expectations above, because they are where every regime converges.
Is it legal to use AI in hiring in 2026?
Yes, in the US, EU and UK. What the law regulates is how you use it: notice, bias testing, records and access to review by a person.
When do the EU AI Act's high-risk rules apply to recruitment?
From 2 December 2027, after the Digital Omnibus moved the original 2 August 2026 date. The AI transparency duty in Article 50 has applied since 2 August 2026.
Does the Colorado AI Act apply yet?
No. SB 26-189 replaced the original law, and the new version takes effect on 1 January 2027.
The laws differ in detail, but they all ask the same question: can you show your work?
Every step, call and score is visible to your team. You make the final decision.
See a real hiring runMetaDay AI Ⓒ 2026. All rights reserved.
By using this website, you agree to the storing of cookies on your device to enhance site navigation, analyze site usage, and assist in our marketing efforts. View our Privacy Policy for more information.
I understandEverything MetaDay runs.
From sourcing to signed offer — one execution engine.
