Discrimination rules for AI in employment. On June 30, California's Civil Rights Council announced final approval of regulations clarifying that existing anti-discrimination protections under the Fair Employment and Housing Act (FEHA) apply when employers (or their vendors) use AI, algorithms, or other "automated-decision systems" in employment. The rules take effect Oct. 1.

California's privacy regulator finalized ADMT (automated decision-making) regulations. Separate from discrimination law, the California Privacy Protection Agency (CPPA) has finalized privacy rules for automated decision-making technology (ADMT). These include transparency, opt-out rights for certain high-impact uses, and risk-assessment duties — covering "significant decisions" such as hiring, promotions, compensation, and termination. Employers should work with counsel to comply with an outside deadline for businesses using ADMT before Jan. 1, 2027. Expect employee/candidate notices, access/explanation rights, and documented assessments to become table stakes.

What this means for HR: Even before Oct. 1, employers should consider 1) mapping any automated screens, assessments, chatbots, and ranking tools; 2) testing them for disparate impact; 3) contractually requiring vendors to support audits and disclosures; and 4) drafting candidate/employee notices and an appeals/human-review channel.

Toolkit: Using AI for Employment Purposes

Colorado's AI Law

Colorado's Senate Bill 24-205 (Colorado AI Act) treats employment decisions as "consequential." Delayed until the end of June 2026, developers and deployers of "high-risk" AI must use reasonable care to prevent algorithmic discrimination and follow a governance playbook: risk-management programs, impact assessments, annual reviews, consumer (candidate/employee) notices, correction rights, and human appeal of adverse decisions. The statute and official summaries make clear that employment decisions are squarely in scope.

What this means for HR: Treat any hiring or promotion model used in Colorado like a regulated system. Maintain an AI inventory, publish a plain-language statement about employer’s high-risk systems, perform impact assessments before and after deployment, and stand up a process for explanations and human appeals. Be aware, however, that the law might be scaled back next year.

New York City Bias Audits

New York City's Local Law 144 remains the most visible U.S. local ordinance specifically aimed at AI in hiring: employers cannot use an automated employment decision tool unless there is an independent bias audit within the past year, with results posted publicly and candidate/employee notices provided before use. The New York City Department of Consumer and Worker Protection's official page and FAQs remain key sources for the definitions, audit scope, and notice timelines. If you hire in New York City, even remotely, these obligations still apply. In addition, and importantly, the law requires employers to provide applicants and employees with the option to request an alternative to being evaluated by AI. While this law has been in effect since July 5, 2023, reports indicate that many employers have yet to comply. However, enforcement actions against allegedly noncompliant employers are starting to make headlines.

What this means for HR: Keep your bias audit current (within 12 months), post the summary, give 10 business days' advance notice, and make sure your vendor contract guarantees access to data needed for the audit. In addition, make sure you provide applicants and employees the appropriate notice.

Federal Picture

At the federal level, Congress has not enacted an HR-specific AI statute — but existing federal civil-rights law may apply to AI (for example, disparate-impact and disparate-treatment theories under Title VII of the Civil Rights Act of 1964).

Toolkit: Managing Equal Employment Opportunity

Practical Compliance Checklist 

Here's a compliance checklist to align with AI regulation. 

Make an AI automation map. Catalog every tool that screens, ranks, scores, interviews, schedules, monitors, or recommends compensation — internal builds and vendor products alike — and where it's used (for example, New York City, California, and Colorado). Tie each to a legal regime and understand the basis for each analysis. Ensure audits meet the requirements and are under attorney-client privilege.

Run/refresh impact testing. New York City mandates annual bias audits. California FEHA rules make clear that adverse impact from automated systems is on employers. Colorado requires impact assessments and reviews. 

Stand up notice, access/explanation, and appeal pathways. New York City requires pre-use notices. Colorado requires notices plus a human appeal for adverse decisions. CPPA ADMT rules add access/explanation and opt-out in certain cases. Build standard templates and workflows. 

Harden your vendor contracts. Require: 1) cooperation with audits and assessments; 2) disclosure of model purpose, data, and known limitations; 3) logging, testing, and change-management; and 4) Colorado/California/New York City clause addenda as applicable.

Document. Keep your risk assessments, bias audit summaries, data governance notes, and human-oversight playbooks. These are required or strongly implied under California, Colorado, and New York City laws.

Train your recruiters and human resource business partners. They should know when to escalate to human review, how to explain a decision, and how to process corrections/appeals — especially in the above referenced jurisdictions.

3 Takeaways 

If employers do only three things this quarter with respect to AI compliance, they should:

Run a fresh bias audit on their recruiting and promotion models.

Launch a standardized AI impact assessment template that meets Colorado expectations.

Update candidate/employee notices and appeal workflows with a human reviewer and align them with applicant tracking systems and human resource information systems.