California adds employment-record and, for covered businesses, applicant-privacy duties. Automated-decision rights begin in 2027.
Prevent discrimination and retain hiring records
CURRENT
When this applies
California hiring is covered by FEHA, generally including employers with five or more employees and covered employment agencies.
What your organization needs to do
Use automated selection methods without unlawful discrimination, and provide required accommodations.
Preserve covered hiring and automated-decision records. Keep relevant unsuccessful-applicant records and any records subject to a complaint or legal hold.
When: Generally four years from the record or employment action, whichever is later; longer where a complaint or hold requires it.
You process a California resident’s information and your organization is a CCPA-covered business. Coverage depends on doing business in California and revenue, data-volume, sale/sharing or related-entity criteria; hiring in California alone does not establish coverage.
What your organization needs to do
Provide the required notice at collection and privacy information, including what you collect and why.
Provide a way to exercise applicable access, correction and deletion rights. Apply lawful retention exceptions and do not retaliate for privacy requests.
When: Notice before or when collecting information. Generally respond to access, correction and deletion requests within 45 days; a permitted extension requires notice.
A CCPA-covered business processes California residents’ information using covered decision automation, sensitive personal information or regular monitoring that evaluates people’s ability, performance, reliability or behavior. Hiring in California alone does not trigger an assessment.
What your organization needs to do
Document the required privacy risk assessment, safeguards and approval. Review it at least every three years and update it within 45 days of a material change.
Assess the actual use of each tool. Human review can affect the automated-decision test, but it does not remove a separate assessment duty for sensitive information or covered monitoring.
When: Before new covered processing. Processing already underway before 2026 transitions by December 31, 2027; the first regulatory submission is due April 1, 2028.
A CCPA-covered business uses automation that replaces or substantially replaces human decision-making in significant employment decisions about California residents. Informed human review with authority to change the decision matters.
What your organization needs to do
Provide the required pre-use notice and access rights. Honor opt-outs unless a specific exception applies, including the qualifying human-appeal alternative.
When: From January 1, 2027, before covered use; respond to resulting rights requests within the applicable regulatory deadlines.
Colorado’s new automated-decision duties begin January 1, 2027. The shared hiring baseline still applies now.
Explain covered AI decisions and offer review
UPCOMING
When this applies
Your organization uses automated technology to materially influence a covered employment decision about a Colorado resident. Merely storing information or completing a nonmaterial administrative task is different.
What your organization needs to do
Give the required notice when the person interacts with the covered technology.
After an adverse outcome, explain in plain language how the technology contributed to the decision.
Provide the required access, factual-correction and meaningful human-review process. Retain compliance records for at least three years.
When: From January 1, 2027. The adverse-outcome explanation is due within 30 calendar days. Follow the Attorney General’s implementing rules for notice and request procedures.
Current duties cover nondiscrimination and covered employee monitoring. Separate automated-employment notice duties begin for specified deployments in October 2027.
Keep AI-assisted hiring free from discrimination
CURRENT
When this applies
You use automated decisions in employment covered by Connecticut’s discrimination law.
What your organization needs to do
Do not use automated hiring processes to unlawfully discriminate. Using AI does not excuse discriminatory hiring or remove accommodation duties.
A business operating in Connecticut deploys covered technology on or after October 1, 2027, and its output meaningfully alters an employment decision about someone in Connecticut.
What your organization needs to do
Disclose the automated interaction unless the statutory obvious-interaction exception applies.
Before the decision, give written notice of automated-tool use, its purpose and the decision, its trade name, personal-data categories and how they are assessed, data sources, and your contact details.
If legally protected information is withheld, explain what is withheld and the legal basis.
When: For the specified deployments from October 1, 2027. Notice precedes the decision; no consent or fixed waiting period is prescribed here.
You collect information about employees’ activities or communications on your premises using covered electronic monitoring. An applicant assessment or remote work away from your premises does not by itself meet this test.
What your organization needs to do
Give written notice of the types of monitoring and specific workplace locations before monitoring starts. A notice posted where affected employees can see it meets this prior-notice requirement.
Before employees hired on or after October 1, 2026 start work, give them a plain-language statement of activities you prohibit and when monitoring may happen without prior notice.
The airport and security or employee-safety exceptions remove only the need to list monitoring locations. A qualifying misconduct investigation can remove the prior-notice requirement, but does not remove the new-hire statement.
When: Prior notice before covered monitoring; the additional new-hire statement before employment starts. These duties do not require an employee’s consent or acknowledgment.
No general applicant AI procedure is listed here. A separate notice rule can apply if you monitor existing employees.
Give notice before covered employee monitoring
CURRENT
When this applies
You monitor an employee’s telephone, email or internet activity in circumstances covered by Delaware law. This is an employee-monitoring rule, not a general applicant AI notice.
What your organization needs to do
Choose either a one-time written or electronic notice that the employee acknowledges, or an electronic notice shown each day the employee accesses your email or internet service. Choosing daily notice is not enough: the person must receive that day’s notice.
When: Before monitoring or at the qualifying daily access point. Exclusions cover non-targeted system maintenance or protection, and a law-enforcement officer acting under a Chapter 24, Title 11 court order. An employer’s misconduct investigation alone is not an exception.
Illinois addresses discriminatory AI use and notice to covered employees. Notice details depend on the applicable adopted rules.
Prevent discriminatory AI use and give covered notices
CURRENT
When this applies
Your organization uses AI for employment purposes covered by the Illinois Human Rights Act.
What your organization needs to do
Do not use AI that unlawfully discriminates against protected groups or use ZIP codes as a substitute for protected traits.
Notify employees when AI is used for covered employment purposes. The statute directs the Department of Human Rights to specify notice circumstances, timing and delivery in rules.
When: In effect from January 1, 2026. Follow applicable adopted notice rules; this guide does not treat a proposed rule as a new consent or waiting-period requirement.
If your organization conducts covered employee surveillance, explain it during interviews and give employees the required notices.
Explain covered employee monitoring during hiring
CURRENT
When this applies
Your organization conducts covered electronic surveillance of employees in Maine. The notice during hiring concerns that employee monitoring; an applicant assessment alone does not establish it.
What your organization needs to do
Tell prospective employees during interviews that you conduct employee surveillance. Notify employees before surveillance begins and give current employees written notice at least once each calendar year.
Honor an employee’s right to decline surveillance applications on personal devices.
When: In effect from July 29, 2026. Specific safety-camera, employer-vehicle safety-device and personal-care-setting exceptions apply.
Existing New Jersey discrimination protections apply to automated hiring. The state guidance explains those duties.
Apply existing discrimination protections to AI
CURRENT
When this applies
Hiring is covered by the New Jersey Law Against Discrimination.
What your organization needs to do
Avoid discriminatory treatment or unjustified discriminatory effects when using automated hiring tools, and provide required accommodations. The employer remains responsible when it uses a vendor’s system.
When: Throughout hiring. State guidance explains existing duties; it does not itself add a universal independent AI audit, consent form or appeal.
Check New York City separately. Its audit and notice rules apply to covered screening, not every New York State hire.
New York City: audit and notice before covered screening
CURRENT
When this applies
A covered automated employment decision tool screens people for hiring or promotion: its score is the sole criterion, outweighs every other criterion, or overrides other conclusions. NYC coverage depends on the work location, an associated NYC office for remote work, or the agency using the tool being in NYC. New York State alone is not enough.
What your organization needs to do
Ensure an independent bias audit covering the tool and applicable use was completed within the preceding year. Publish the required summary and distribution date before use.
Give covered NYC residents notice of the tool and the qualifications it assesses, with instructions for requesting an alternative process or accommodation.
Publish required information about collected data, its sources and retention, or provide it within 30 days of a qualifying written request.
When: Audit and public summary before covered use. Required notices at least 10 business days before screening; keep the published audit summary available for six months after the tool’s last use.
New York: notify employees about covered monitoring
CURRENT
When this applies
A private employer with a New York place of business monitors employee telephone, email or internet activity within the statute’s scope.
What your organization needs to do
Give employees hired from May 7, 2022 the required written or electronic monitoring notice and obtain their acknowledgment. Post a notice where all affected employees can readily see it, including those hired earlier.
When: Individual notice upon hiring, before monitoring. The exclusion covers email, voicemail or internet processes that manage type or volume, do not target a person and serve only system maintenance or protection. A misconduct investigation alone is not an exception.
Texas prohibits intentional unlawful discrimination through AI. It does not add a general organization AI certification for these tools.
Do not use AI to intentionally discriminate
CURRENT
When this applies
Your organization develops or deploys covered AI for use in Texas.
What your organization needs to do
Do not use AI with the intent to unlawfully discriminate against a protected group. Other employment discrimination laws continue to apply, including their separate standards for discriminatory effects.
When: Throughout use. This Texas law does not add a general private-employer AI consent, annual bias audit or organization AI certificate for these hiring tools.
These apply alongside state requirements when your organization and activity are covered.
Use fair, job-related selection criteria
CURRENT
When this applies
Your organization is covered by federal employment discrimination law. State protections may also cover smaller employers.
What your organization needs to do
Do not use scores or other results to discriminate against protected groups. A selection method that disproportionately excludes a protected group must meet the applicable legal justification.
Assess the selection method for the job and purpose where you use it. Using a vendor’s tool does not transfer your hiring responsibilities to that vendor.
When: When choosing a selection process and throughout its use.
A qualified applicant or employee needs an adjustment to participate, and your organization is covered by the relevant accommodation law.
What your organization needs to do
Respond to requests for help or an adjustment to the assessment. Provide a reasonable accommodation unless the applicable legal exception, such as undue hardship, applies.
Do not reject someone because an inaccessible assessment measures their disability instead of their ability to do the job.
When: Before and during the affected assessment or hiring activity.
Your organization has recordkeeping duties under federal employment discrimination law.
What your organization needs to do
Keep covered applications, selection records and hiring decisions for the required period. Preserve records relevant to a discrimination charge until its final resolution.
Apply any longer state, record-specific or legal-hold period before deleting records.
When: The usual EEOC employment-record floor is one year; other record types and circumstances can require longer.
A guide for private employers and staffing agencies using Evidize for resume analysis, candidate ranking, security collection and integrity reports. It covers hiring-AI requirements, not every employment law.
This is a reference, not a completed setup or legal-compliance certification. Reading or selecting a state
does not change your organization’s settings or unlock tools. The setup wizard checks your actual
circumstances.
