What laws apply when small teams use AI in hiring?

Title VII's disparate-impact rule applies to every covered US employer. FCRA applies when you use a consumer report. NYC Local Law 144 covers NYC jobs, Illinois covers AI video interviews and, since January 1, 2026, any AI use in employment decisions. Colorado SB 26-189 starts January 1, 2027.

Does NYC Local Law 144 apply to remote companies hiring NYC candidates?

It can. DCWP says the law covers jobs located at a NYC office at least part time and fully remote jobs whose associated location is a NYC office, regardless of where the employer is headquartered. DCWP's list doesn't include a remote job tied to an office elsewhere, even if NYC residents apply.

What is the penalty for not complying with NYC Local Law 144?

Under Section 20-872, up to $500 for a first violation (and each additional violation the same day), then $500 to $1,500 for each subsequent violation. Each day an unaudited tool is used counts separately, and so does each missed notice. The law sets no cure period.

Does the EU AI Act apply to US small teams hiring EU candidates?

AI used to recruit or select people is high-risk under Annex III. As a deployer you must follow the instructions for use, assign trained human oversight, keep logs, and tell workers and candidates. Regulation (EU) 2026/1744 moved these duties to December 2, 2027, and it's already law.

AI hiring compliance for small teams: which laws apply

HR team reviewing AI hiring compliance Image: Unsplash.

This is for the founder or the one-person HR team who just switched on an AI resume screener, a ranking feature in the ATS, or a video interview tool that "scores" answers. You don't need a compliance department to get this right, but you do need to know which of the laws below reach you, because each one asks for something different: an audit, a notice, a consent, a deletion, a letter.

We read the statutes and the agency pages behind every row in the table. Where a law asks you to do something, the wording in the checklist is the law's own.

Which laws apply: the map

Law	Who it reaches	What you must do	In force
Title VII, 42 U.S.C. 2000e-2(k)	Covered US employers	Don't use a selection practice with a disparate impact you can't justify	In force
FCRA, 15 U.S.C. 1681b and 1681m	Anyone using a consumer report for an employment decision	Standalone disclosure and written authorization before the report; copy of the report and summary of rights before adverse action; adverse action notice	In force
NYC Local Law 144	Jobs at a NYC office (part time counts) or remote jobs tied to one	Bias audit within the past year, published summary, notice 10 business days before use	Enforced since July 5, 2023
Illinois AI Video Interview Act, 820 ILCS 42	Employers analyzing recorded video interviews for Illinois-based positions	Notice, explanation of how the AI works, consent; limit sharing; delete within 30 days of a request; demographic report if AI alone picks who gets an in-person interview	January 1, 2020
Illinois Human Rights Act as amended by HB 3773 (Public Act 103-0804)	Employers with one or more Illinois employees for 20+ weeks	No AI with a discriminatory effect, no zip codes as a proxy; notice to employees when AI is used for employment decisions	January 1, 2026
Colorado SB 26-189	Anyone doing business in Colorado using a covered ADMT on employees or Colorado-resident applicants	Notice before use; disclosure within 30 days of an adverse outcome; data correction; human review where commercially reasonable; 3-year records	Decisions on or after January 1, 2027
EU AI Act, Annex III point 4	Deployers of AI for recruitment or selection of people in the EU	Follow instructions for use, trained human oversight, keep logs at least six months, inform workers and the people assessed	December 2, 2027 (Regulation (EU) 2026/1744)

A remote startup with an AI screener and one Illinois hire is already under Title VII, the Illinois notice rule and, if it buys background checks, FCRA. Add a New York City office and Local Law 144 joins them.

Employment compliance checklist on desk Image: Unsplash.

The checklist, law by law

Every US employer: disparate impact under Title VII

Ask the vendor for adverse-impact results by sex and race/ethnicity for the job types you use the tool on. Title VII makes a practice unlawful when it "causes a disparate impact" and the employer can't show it's job related (42 U.S.C. 2000e-2(k)).
Keep your own records of who the tool advanced and who it rejected. You'll want them if a candidate sues; private suits don't depend on what a federal agency prioritizes.
Don't rely on the EEOC's 2023 AI guidance. The EEOC's technical assistance page on AI and adverse impact returned a 404 when we checked it on October 15, 2026. Executive Order 14281 (April 23, 2025) told agencies to "deprioritize enforcement" of disparate-impact liability, naming 42 U.S.C. 2000e-2 (Federal Register). The statute itself didn't change.

If you use background checks or any consumer report: FCRA

Before you pull the report: give a clear written disclosure "in a document that consists solely of the disclosure" and get written authorization (15 U.S.C. 1681b(b)(2)).
Before you reject based on it: send a copy of the report and the written summary of rights (1681b(b)(3)). The statute names no fixed number of days to wait; give the candidate a real chance to dispute before you finalize.
After you reject: send the adverse action notice (15 U.S.C. 1681m(a)).
Check the automation. If your ATS rejects automatically after a background-check result, make sure it waits for the pre-adverse step instead of skipping it.

Full checklist: FCRA and AI Hiring: The Disclosure Requirements Most Companies Miss

NYC jobs: Local Law 144

Check whether the job is "in the city." DCWP reads that as a job located at a NYC office at least part time, or a fully remote job whose associated location is a NYC office (DCWP FAQ). Promotion decisions for employees in those jobs count too.
Bias audit within the past year, by an independent auditor. DCWP's FAQ is blunt about it: employers "can only rely on a bias audit for one year from the date it was conducted."
Publish the summary of the latest audit and the date you started using the tool, on the employment section of your site or by a link.
Notify candidates and employees who live in NYC no less than 10 business days before use. The notice must let them request an alternative selection process or accommodation; the law doesn't promise they'll get one (Local Law 144).
Know the exposure: Section 20-872 sets up to $500 for a first violation, then $500 to $1,500 for each later one. Every day of use without an audit is a separate violation, and there's no cure period.

Page 3 of the NYC DCWP AEDT FAQ: what the published bias audit summary must include, and that a bias audit can be relied on for one year Screenshot: NYC Department of Consumer and Worker Protection, Automated Employment Decision Tools FAQ (June 29, 2023), page 3.

If you rely on the audit your vendor commissioned, check that the auditor isn't the vendor itself and that the audit covers the job category you hire for.

Full guide: NYC Local Law 144 AI Bias Audit: Employer Guide 2026

Illinois video interviews: the AI Video Interview Act

This applies when you ask applicants for Illinois-based positions to record video interviews and use AI to analyze them (820 ILCS 42). The Act speaks only of interviews the applicant records; it says nothing about live calls.

Before the interview, notify the applicant that AI may be used to analyze the video and consider their fitness for the position (Sec. 5(1)).
Explain how the AI works and "what general types of characteristics it uses to evaluate applicants" (Sec. 5(2)). Get this paragraph from your vendor in writing.
Get consent before the interview. Without it, you can't use AI to evaluate that applicant (Sec. 5(3)).
Limit sharing of the videos to people whose expertise or technology is needed to evaluate the applicant (Sec. 10).
Delete on request: within 30 days after an applicant asks, delete their interviews and tell everyone you shared them with, including backups, to delete too (Sec. 15). The Act ties deletion to the request, not to your hiring decision.
Report demographics if AI alone decides who gets an in-person interview: race and ethnicity of applicants advanced, not advanced and hired, sent to the Department of Commerce and Economic Opportunity by December 31 each year (Sec. 20).

Any AI in employment decisions in Illinois: HB 3773

Since January 1, 2026, the Illinois Human Rights Act makes it a civil rights violation to use AI "that has the effect of subjecting employees to discrimination" in recruitment, hiring, promotion, training selection, discharge, discipline or terms of employment, or to use zip codes as a proxy for protected classes (Public Act 103-0804). It's also a violation to fail to give employees notice that you're using AI for those purposes.

Give notice of AI use in those decisions. The Act leaves the timing and form of the notice to rules from the Illinois Department of Human Rights, and the Department's rules page listed no AI rules when we checked on October 15, 2026. Until it does, put a plain notice at the point of application and in the employee handbook.
Check your scoring inputs for zip code or anything standing in for it.
Know that size won't exempt you: the Act counts any employer with one or more Illinois employees during 20 or more calendar weeks.

Full guide: Illinois AI Employment Disclosure Law 2026

Colorado: SB 26-189, from January 2027

Governor Polis signed SB 26-189 on May 14, 2026 (bill page). It replaces the 2024 Colorado AI Act and applies to consequential decisions made on or after January 1, 2027. "Consumer" explicitly includes employees and job applicants who are Colorado residents.

Page 5 of Colorado SB 26-189 as signed: "Consumer" includes an employee and a job applicant who is a Colorado resident; definition of covered ADMT Screenshot: Colorado SB 26-189, signed act, page 5 (section 6-1-1701), Colorado General Assembly.

Notice before use: a clear and conspicuous notice before a covered tool materially influences the decision. A public notice at the point of application counts (signed act).
Adverse outcome disclosure within 30 days of the decision, sent without waiting for a request: a plain-language description of the decision and the tool's role, how to ask for the tool's name, version, developer and data sources, and the person's rights.
Correction and review: let people correct inaccurate personal data used in the decision, and offer meaningful human review "to the extent commercially reasonable."
Keep records for at least three years after each decision.
Note the enforcement pause. In xAI v. Weiser, the Attorney General agreed not to start enforcement or investigations under the old law or any replacement until 14 days after the court rules on xAI's preliminary injunction motion (order, ECF 24). That delays enforcement; it doesn't change the start date.

SB 26-189 has no size threshold for deployers and no impact-assessment duty. Drafting and summarizing tools used only to present information for a human reviewer are outside it.

Full guide: Colorado SB 26-189 AI Law: Employer Guide 2027

EU candidates: the AI Act

AI "intended to be used for the recruitment or selection of natural persons," including filtering applications and evaluating candidates, is high-risk under Annex III point 4(a) of the AI Act. As the employer using a vendor's tool, you're the deployer. Article 26 asks you to:

Use the tool according to its instructions for use (Art. 26(1)).
Assign human oversight to people with "the necessary competence, training and authority" (Art. 26(2)).
Keep the logs the system generates, where they're under your control, for at least six months (Art. 26(6)).
Tell workers' representatives and affected workers before using a high-risk system at the workplace (Art. 26(7)), and tell candidates they're subject to it (Art. 26(11)).

The fundamental rights impact assessment in Article 27 is narrower than many summaries say: it applies to public bodies, private entities providing public services, and deployers of credit-scoring and insurance-pricing systems. A private employer screening candidates isn't on that list.

The date is settled. Regulation (EU) 2026/1744, the Digital Omnibus, was published in the Official Journal on July 24, 2026 and moved Annex III high-risk obligations to December 2, 2027.

Full guide: EU AI Act Compliance for Small Teams

Vendor liability: what Mobley v. Workday shows

On May 16, 2025, Judge Rita Lin granted preliminary certification of a nationwide age-discrimination collective in Mobley v. Workday (N.D. Cal., No. 23-cv-00770): applicants aged 40 and over who applied through Workday's platform since September 24, 2020 and were denied employment (order, Dkt. 128). The court described the claim as turning on whether Workday's AI recommendation system has a disparate impact on applicants over forty.

First page of the May 16, 2025 order granting preliminary collective certification in Mobley v. Workday, Case No. 23-cv-00770-RFL Screenshot: Mobley v. Workday, Inc., order granting preliminary collective certification, Dkt. 128, U.S. District Court for the Northern District of California (via GovInfo).

The defendant there is the vendor, not the employers. The lesson for a small team is narrower: the theory that got past Workday's motion to dismiss was that customers "delegate traditional hiring functions, including rejecting applicants" to the algorithm. If you let a tool reject people without a person looking, you're the one who delegated. We read the certification order, not every later filing; the case is still open.

Keep a human decision on every rejection the tool recommends, and log who made it.
File what the vendor gave you: the bias audit or adverse-impact results, the instructions for use, and the contract terms on data and indemnity, with the date you received each.

Vendor vetting checklist: AI Vendor Due Diligence Checklist 2026

What this checklist doesn't cover

State laws we haven't mapped here, including New Jersey's and Connecticut's, and California's ADMT rules: see California ADMT employer templates.
Biometric data from video or voice under Illinois BIPA: see BIPA and AI Hiring.
The Illinois Department of Human Rights' notice rules for HB 3773, which weren't on its rules page when we checked. This post will change when they're adopted.

We looked for a community thread worth embedding. The r/humanresources posts we found on Local Law 144 and HB 3773 had been removed by the subreddit's moderators, so there's no embed here.

Correction (October 15, 2026): Earlier versions of this guide understated the NYC first-violation penalty and claimed a 30-day cure period that Local Law 144 doesn't have; they also misstated which remote jobs are covered and said candidates are guaranteed an alternative process (DCWP FAQ). The Illinois section said videos must be deleted within 30 days of the final hiring decision; the Act ties deletion to the applicant's request, and we've added the explanation, sharing and reporting duties plus HB 3773. We presented the EEOC's 2023 AI guidance as current; that page has been taken down. We said the EU's December 2, 2027 date wasn't yet binding; Regulation (EU) 2026/1744 made it law in July 2026, and we'd wrongly told private employers to run a fundamental rights impact assessment. We also replaced a Colorado "developer documentation" duty that isn't in SB 26-189 and removed an FCRA waiting period the statute doesn't set.