AI Hiring Tool Compliance: NYC, Colorado, Illinois, and the EU AI Act

Why hiring AI has more regulation than any other AI use case

Legislators focused on hiring AI first because the stakes are clear: a biased algorithm can systematically exclude qualified candidates based on gender, race, age, or disability. The harm is measurable (denied employment), the cause is traceable (the algorithm), and historical precedent is extensive (decades of employment discrimination law).

If your company uses any AI tool in hiring — CV screening, interview analysis, assessment scoring, resume ranking, or automated shortlisting — you are likely subject to at least one of these laws.

NYC Local Law 144 (in effect since July 2023)

The most prominent hiring AI law in the US. It applies to employers and employment agencies that use "automated employment decision tools" (AEDTs) to screen candidates or employees in New York City roles.

What it requires:

• Bias audit: An independent bias audit of the AEDT must be conducted at least annually by an independent auditor. The audit must calculate selection rates by gender and race/ethnicity.
• Public summary: The audit summary must be published on your website.
• Candidate notice: You must notify candidates or employees at least 10 business days before using an AEDT that an AEDT will be used, what job qualifications it will assess, and how to request an alternative process.
• Alternative process: Candidates who do not live in NYC or who request it can access an alternative evaluation process.

Who is an AEDT? NYC's definition is broad: "any computational process, derived from machine learning, statistical modeling, data analytics, or artificial intelligence, that issues simplified output, including a score, classification, or recommendation, that is used to substantially assist or replace discretionary decision making for making employment decisions."

If you use any scoring tool for candidates — even if a human makes the final call — it likely qualifies.

Penalties: Civil penalties of $500 for a first violation, rising to $500–$1,500 for each subsequent violation. The NYC Department of Consumer and Worker Protection enforces this.

Colorado ADMT Law — SB 26-189 (effective January 1, 2027)

Colorado repealed its original AI Act (SB 24-205, which never took effect) and replaced it with SB 26-189, a narrower transparency law for "automated decision-making technology" (ADMT) — technology that processes personal data and materially influences a consequential decision. Employment (hiring, promotion, compensation, termination) is one of the law's covered decision categories, with no size, revenue, or headcount threshold for deployers.

What it requires for hiring AI:

• No impact assessment: Unlike the repealed SB 24-205, SB 26-189 does not require an annual impact assessment or a formal risk-management program.
• Pre-use notice: Give clear and conspicuous notice, before the ADMT materially influences a decision, that ADMT is or will be used — a prominent public notice at points of candidate interaction satisfies this.
• Adverse-outcome disclosure: Within 30 days of an adverse hiring decision, provide a plain-language description of the decision and the ADMT's role, plus the tool's name, version, developer, and the data categories/sources used.
• Correction and human review: On request, let the candidate correct inaccurate personal data used in the decision, and provide meaningful human review with authority to override the outcome, to the extent commercially reasonable.
• Record retention: Keep compliance records for at least 3 years per decision.

Penalty: Enforced exclusively by the Colorado Attorney General as a deceptive trade practice — civil penalties up to $20,000 per violation (up to $50,000 if committed against an elderly person), with a 60-day AG cure opportunity that itself sunsets January 1, 2030. No private right of action.

Illinois AI Video Interview Act — AIVIA (in effect since 2020) + HB 3773 (eff. Jan 1, 2026)

One of the oldest AI hiring laws. AIVIA (820 ILCS 42) requires employers using AI to analyze video interviews to: notify candidates AI will be used, explain how the AI works and what traits it evaluates, obtain consent before analysis, and limit who can view the interviews. AIVIA itself has not been amended since 2020.

A separate law, HB 3773 (signed August 9, 2024, effective January 1, 2026), amends the Illinois Human Rights Act rather than AIVIA: it bars AI that has a discriminatory effect on a protected class anywhere in the employment lifecycle (recruitment, hiring, promotion, discharge, discipline), bars using ZIP codes as a proxy for protected characteristics, and requires notice when AI is used for a covered employment decision. It applies well beyond video interviews.

Penalty: AIVIA itself sets no monetary-penalty schedule — its only enforcement mechanism is an annual demographic-reporting duty to the Illinois Department of Commerce and Economic Opportunity. HB 3773 is enforced by the Illinois Department of Human Rights through the Human Rights Act's existing civil-rights remedies (cease-and-desist orders, damages, back pay, attorney's fees, and civil penalties that scale with prior violations) rather than a flat per-violation dollar figure.

EU AI Act — High-risk AI in employment (deferred to December 2027)

The EU AI Act classifies "AI systems used for recruitment or selection of natural persons, notably for advertising vacancies, screening or filtering applications, evaluating candidates" as high-risk AI under Annex III. If you deploy hiring AI to EU residents, you face the EU AI Act's full high-risk requirements:

• Conformity assessment before deployment
• Technical documentation (purpose, training data, accuracy, limitations)
• Comprehensive logging of system behavior for audit purposes
• Human oversight mechanism that allows a human to monitor, intervene, and override
• Bias testing across protected characteristics before and during deployment
• Registration in the EU AI database
• Clear instructions for use provided to deployers

Comparing the laws

What to do if you use AI in hiring

1. Identify every AI tool in your hiring process. This includes ATS platforms with AI scoring (Greenhouse, Lever, Workday), video interview tools (HireVue, Spark Hire), LinkedIn Recruiter AI features, and any custom scoring systems.
2. Check if the vendor is compliant. Your vendor (HireVue, Workday) may handle some requirements on your behalf — but you, as the deployer, are still responsible. Get compliance documentation from every vendor.
3. Implement candidate notice. Add disclosure language to your job applications and hiring communications — required in NYC, Colorado, and Illinois.
4. Set up human review. Ensure every AI screening decision can be reviewed and overridden by a human recruiter.
5. Commission a bias audit. If you are in NYC, this must be done by an independent auditor and published. For other jurisdictions, internal bias testing and documentation is a starting point.
6. Update your contracts. Illinois requires vendor compliance in contracts. Colorado requires you to document your deployer obligations. Update vendor agreements accordingly.

Further reading

• NYC Local Law 144 Deep Dive
• Illinois AI Video Interview Act Explained
• EU AI Act Annex III: High-Risk AI Categories
• AI Hiring Tool Compliance Checklist