US hiring AI regulations

Know what your hiring AI must prove, law by law.

NYC Local Law 144 was only the start. AI hiring tools now answer to federal anti-discrimination law and a growing set of state rules in California, Illinois, New Jersey, Colorado, Connecticut and Texas. Download our obligations matrix to see what each law requires you to test, when, and who owns it.

  • ✓11 tests and audits mapped to federal, state and city law
  • ✓Developer vs. deployer duties, cadence and key artifacts
  • ✓Mandated, effectively required, incentivized or conditional
ISO/IEC 42001 & 27001 certified · Featured in IDC ProductScape 2025 · UK Government AI assurance portfolio
US HR AI System Obligations & Hiring Regulations

A two-page reference for counsel, HR and AI teams: every test and audit mapped to its legal driver, responsible party, cadence and required-vs-recommended status. Updated September 2026.

Download the PDF

PDF · 2 pages · No form required

The obligations, law by law

What US law requires of AI hiring tools

Obligations in effect, or with a confirmed effective date, as of September 2026. Each one names who owns it: the developer that builds the tool or the deployer, the employer that uses it.

MandatedEffectively requiredIncentivizedConditional
Mandated

NYC Local Law 144

Independent bias audit of automated employment decision tools: selection rates and impact ratios by sex, race/ethnicity and intersectional categories. Public results summary and 10-business-day candidate notice.

Deployer · Before use, then annually

Effectively required

Title VII and the Uniform Guidelines

Adverse-impact analysis and a validation study of questions, rubrics and scoring. The validation file is your business-necessity defense; Mobley v. Workday keeps vendors in scope.

Developer and deployer · Every release, plus monitoring

Incentivized

Illinois HB 3773, New Jersey LAD, Connecticut SB 5

Disparate-impact and proxy-variable testing (ZIP codes, employment gaps, availability). No audit mandate, but liability attaches to unintentional discriminatory effects.

Deployer; developer documentation in Connecticut · Pre-release, then periodic

Incentivized

California FEHA automated-decision regulations

Anti-bias testing, with vendor liability as the employer’s agent. Testing, or its absence, is admissible evidence. Retain inputs, outputs, criteria and results for at least four years.

Developer and deployer · Recurring

Effectively required

ADA, GINA and state inquiry laws

Screen every generated interview question for disability and medical probes, family medical history, age markers, salary history and criminal-history timing. A prohibited question is a violation even when outcomes are balanced.

Developer and deployer · Continuous filter, plus a red-team suite per release

Effectively required

ADA screen-out and accommodation

Test accessibility of the interview flow, alternative formats, and whether scoring penalizes disability proxies such as gaps or speech patterns. A documented accommodation pathway is the core defense.

Developer and deployer · Per release

Conditional

Illinois AI Video Interview Act and BIPA

Consent and explanation flows, plus demographic reporting of screened-out versus advanced candidates. Biometric consent if voice or facial analysis is used.

Deployer; developer under BIPA · Annual report to Illinois

Mandated

California CCPA automated decision-making rules

Pre-use risk assessment for significant employment decisions, with notice, opt-out and access flows. In-use technology must comply by January 1, 2027.

Deployer; developer as service provider · Before use

Mandated

Connecticut SB 5 and Colorado ADMT Act

Validate adverse-decision explanations: the AI’s contribution, data types and sources, and correction rights. Colorado from January 1, 2027; Connecticut from October 1, 2027.

Developer and deployer · Per release

Incentivized

Texas Responsible AI Governance Act

Map your governance program to the NIST AI RMF or ISO/IEC 42001. Substantial compliance is an affirmative defense; penalties reach $200,000 per violation.

Developer and deployer · Ongoing

Conditional

Fair Credit Reporting Act

Screen whether third-party data enrichment makes outputs “consumer reports”, which brings disclosure, authorization and adverse-action duties.

Developer and deployer · Before feature launch

Get the full matrix

Legal drivers, what actually gets tested, cadence and key artifacts for all 11 obligations, in one two-page PDF.

Download the PDF

This summary reflects obligations in effect, or with a confirmed effective date, as of September 2026. Verify current status before relying on it for a compliance decision. It is a compliance-planning reference, not legal advice.

Where it applies

Top HR tech use cases.

Resume screening

AI tools that scan and filter resumes against criteria such as skills, qualifications and experience.

Video interview analysis

Systems that assess verbal and non-verbal cues, such as tone and word choice, to provide insights into candidates.

Performance appraisals

Tools that analyze performance data over time to identify trends and areas for improvement or recognition.

Retention and turnover prediction

Predictive analytics that forecast turnover risk and suggest interventions to improve retention.

How Asenion helps

One set of controls for every hiring law

Asenion turns these obligations into reusable control objectives and context-aware controls for your hiring AI, by jurisdiction and by role, then verifies them and keeps the evidence.

Asenion Assess

Know which laws apply

Inventory each hiring AI system, map it to the jurisdictions your candidates are in, and run the CCPA risk assessment and NIST AI RMF or ISO/IEC 42001 conformance mapping.

Asenion Verify

Test before every release

Independent NYC Local Law 144 bias audits, adverse-impact and proxy-variable testing, accessibility checks, and a red-team suite for prohibited interview questions.

Asenion Witness

Control it in production

Jurisdiction-aware runtime filtering of generated questions, consent and explanation records, and tamper-resistant evidence retained for as long as each law requires.

Take action today

Know what your hiring AI must prove.

Download the US HR AI obligations matrix: every test and audit mapped by legal driver, responsible party, cadence and required-vs-recommended status. Updated September 2026.