AI in Hiring: What the Laws, Lawsuits and Real Cases Say

Official sources checked: November 9, 2026. AI-assisted draft, pending editor review.

Cover labeled AI Hiring Laws over resumes and a magnifying glass — AI-generated image

If a software tool helps you screen, rank or select job candidates, some places now have specific rules about it, and the older anti-discrimination laws apply everywhere. This article summarizes four jurisdictions from their official pages. It is a map, not a compliance plan: rules in this area change often, and some are still being written.

A balance scale and a gavel beside a stack of resumes under a magnifying glass — AI-generated image · Illustration made for this article

At a glance

Place	What it requires	Status on the official page
New York City, Local Law 144	A bias audit within one year before use, a public summary of the results, and notice to NYC-resident candidates and employees at least 10 business days before use	Effective January 1, 2023; enforcement began July 5, 2023
Illinois, HB 3773	No use of AI that results in discrimination against a protected class, no ZIP codes as a proxy for protected classes, and notice to employees; the details of notice are being set by rulemaking	Effective January 1, 2026
California, Civil Rights Council regulations	Use of an automated-decision system can violate California law if it harms applicants or employees on protected grounds; keep employment records, including automated-decision data, for at least four years	Effective October 1, 2025
Colorado, SB 26-189	New requirements for automated decision-making technology in consequential decisions, replacing the earlier SB 24-205	Signed May 2026; effective January 1, 2027 per the Attorney General's page

New York City: bias audit and notice

New York City's Local Law 144 covers an "automated employment decision tool": a computer-based tool that uses machine learning, statistical modeling, data analytics or AI, issues a simplified output such as a score, classification or recommendation, and substantially assists or replaces discretionary decision-making in employment decisions. The city's Department of Consumer and Worker Protection (DCWP) says the law applies when the job is in an office in New York City, including a fully remote job associated with such an office.

Bias audit: an impartial evaluation by an independent auditor, relied on for one year from its date. An auditor is not independent if they work for the employer or the tool's vendor, or have a financial interest in either.
Public summary: the date of the latest audit, the data source, and the selection or scoring rates and impact ratios, plus the tool's distribution date.
Notice: to New York City resident candidates and employees, at least 10 business days before use, saying a tool is used and what qualifications or characteristics it assesses, with instructions to request a reasonable accommodation. A job posting, mail, email, or a notice on the employment section of the website can carry it.

Illinois: no discriminatory use, and notice

Illinois HB 3773 amends the Illinois Human Rights Act. The state's April 2026 training materials describe it as prohibiting employers from using AI in a way that results in discrimination against a protected class. It covers recruitment, hiring, promotion, renewal of employment, selection for training, discipline and discharge, and defines AI broadly, including generative AI. The law also bars using ZIP codes as a proxy for protected classes and requires employers to notify employees when they use AI for these purposes. It took effect January 1, 2026. Those materials do not describe a bias-audit requirement. They say rulemaking on the details of notice was under way, with proposed notice to current employees within 30 days of adopting or substantially updating a tool and annually. Check whether those rules have been finalized.

California: records and responsibility

The California Civil Rights Council's regulations on automated-decision systems took effect October 1, 2025. The Council says they make clear that using such a system may violate California law if it harms applicants or employees based on protected characteristics, and that employers must keep employment records, including automated-decision data, for at least four years.

Colorado: a law that moved

Colorado's first AI law, SB 24-205, was delayed more than once. The Colorado Attorney General's page, updated in October 2026, says SB 26-189 was signed in May 2026, repeals and re-enacts those provisions with new requirements for automated decision-making technology in consequential decisions, and takes effect January 1, 2027. The General Assembly's summary of the enacted bill says a "consequential decision" includes decisions about employment, so a hiring tool can fall under it. According to that summary, from January 1, 2027 a deployer must give notice at the point of interaction with a covered tool, a plain-language description of the tool's role within 30 days after an adverse decision, and a way to request meaningful human review. Developers and deployers must keep compliance records for at least 3 years. The Attorney General enforces the act and must give a 60-day chance to cure before 2030, and is to adopt rules on the post-decision disclosures. If you hire in Colorado, read the act and the Attorney General's rulemaking page.

What the cases show

Rules did not appear from nowhere. Each one answers something that already happened.

Case	Facts	Why it matters
Amazon (2014 to 2017)	A recruiting tool trained on past resumes learned to penalize the word "women's" and to downgrade graduates of two all-women's colleges. Engineers edited it, executives lost hope, and the team was disbanded. Amazon says recruiters never used it to evaluate candidates	A model trained on past hires copies past patterns, which is why audits test results by group
iTutorGroup (settled 2023)	Application software was programmed to reject women aged 55 or older and men aged 60 or older, rejecting more than 200 qualified U.S. applicants. The EEOC settlement paid $365,000 and requires five years of monitoring	A hard-coded rule is as unlawful as a human one. The decree also bars asking applicants for birth dates
Mobley v. Workday (filed 2023)	A job seeker who says he applied to more than 100 jobs since 2017 and was rejected every time sued over the screening features of a vendor used by employers. Claims: race (Title VII), age (ADEA), disability (ADA). In May 2025 the court granted conditional certification of a collective action on the age claim. On May 28, 2026 a federal judge held that AI bias-testing data may be protected from discovery by attorney-client privilege. Class certification on the other claims was pending. SHRM reported on July 1, 2026 that on June 22 a federal judge denied Workday's motion to dismiss a proposed collective action under California's Fair Employment and Housing Act	A vendor, not only the employer, can be sued. Ask counsel how to structure bias testing; privilege is fact-specific, and underlying data may still be discoverable
University of Washington study (October 2024)	Researchers varied 120 first names on more than 550 real resumes and had three open-source language models rank them against more than 500 job listings, over three million comparisons. The models favored white-associated names 85% of the time versus Black-associated names 9%, and male-associated names 52% versus female-associated names 11%	Not an employer's tool, but evidence that models can rank people differently by name. It tested research models, not commercial products

How often three research models preferred each group of names

View the numbers as a table

White-associated names favored	85%
Male-associated names favored	52%
Female-associated names favored	11%
Black-associated names favored	9%

From the University of Washington study in the table above: over 3 million comparisons of resumes that differed only by name. Research models, not commercial products.

Federal and state: a moving target

On December 11, 2025, President Trump signed Executive Order 14365, "Ensuring a National Policy Framework for Artificial Intelligence." It directs the Attorney General to set up an AI Litigation Task Force to challenge state AI laws that the administration considers inconsistent with its policy, including on interstate commerce and preemption grounds. An executive order does not by itself repeal a state law, so the rules above stay in effect unless a court, a legislature or the rule-making body changes them. At the same time, Texas's Responsible AI Governance Act took effect January 1, 2026. It prohibits developing or deploying AI with the intent to unlawfully discriminate (the Texas Attorney General's page says a disparate impact alone is not enough to show intent), provides a 60-day cure period before enforcement, and has provisions that credit organizations that follow recognized frameworks such as the NIST AI Risk Management Framework. The exact conditions are in the statute.

The practical result for a small employer: do not wait for the federal-state question to settle. These steps are conservative practices, not a legal requirement everywhere, but they line up with what the rules and cases above point to: know which tools you use, test them, tell people, keep a human in the decision and keep records.

A checklist if you use a screening or ranking tool

List every tool that touches applicants: job boards, resume parsers, chat screeners, video interview analysis, scoring.
Ask each vendor what it does, what data it was tested on, and whether an independent bias audit exists.
Find your places. Where are the jobs, and where do the candidates live? Note any city or state rules.
Give notice where required, and say how to ask for an accommodation.
Keep a person in the decision and write down who reviewed what.
Keep records. California requires at least four years for automated-decision data, and Colorado's new act at least three years. Keep what your own rules and lawyer say.
Ask counsel how to structure any bias testing. A May 2026 ruling in the Workday case turned partly on privilege, but privilege is fact-specific and underlying data may still be discoverable.

General information, not legal advice. These rules are changing; confirm the current text with the official source or a lawyer.