AI hiring laws by state in 2026: what a staffing agency has to do now

Why staffing firms carry double exposure

Title VII makes it unlawful for an employment agency to fail or refuse to refer anyone, or to classify or refer people, because of race, color, religion, sex or national origin. Disparate impact liability is written into the statute at section 703(k). A staffing firm acts as an employment agency when it refers candidates to clients, and it is usually also the employer of the temps it places. AI used in either role carries those duties with it.

State and city rules add duties on top of that federal base, from candidate notices to bias audits. Several staffing platforms now sell AI inside the ATS, so a firm can be using AI in recruiting before anyone there chose to buy it.

We checked each rule against the sources cited here on 21 October 2026, and each status gives the date of its latest source. This guide is general information, not legal advice. Have an employment lawyer review your own tools before you rely on it.

Where each rule stands, by dated source

The table covers the rules a US staffing firm is most likely to meet. Colorado's dates moved twice in a year, so check the current status before you rely on any date here.

New York City: Local Law 144 covers employment agencies

Local Law 144 applies to employers and to employment agencies. The city's Department of Consumer and Worker Protection (DCWP) says it reaches an agency located in the city, and a job located at least part time in a city office, including a remote job tied to one. A Dallas agency filling a role in a Manhattan client's office can be covered.

The law covers an automated employment decision tool. DCWP's FAQ describes one as a tool that uses machine learning, statistical modeling, data analytics or AI to help make employment decisions and that 'substantially assists or replaces discretionary decision-making'. Screening counts as an employment decision, so a tool can be covered without making the final hire. Using a tool to scan a resume bank or to reach out to potential candidates falls outside it.

Before using a covered tool, the employer or agency needs a bias audit by an independent auditor, done within the year before use, and a published summary of its results. Candidates who live in the city must get notice at least 10 business days ahead, including how to ask for an accommodation. A vendor's audit can help, but the law puts the duty on the employer or the agency.

Penalties run up to $500 for a first violation and for each additional violation on the same day, then $500 to $1,500 for each later violation. Enforcement has been light. A New York State Comptroller audit published in December 2025 found that DCWP had received two complaints about these tools between July 2023 and June 2025, and had found one case of non-compliance among 32 companies it reviewed, where the auditors saw at least 17 potential problems. Light enforcement does nothing to stop a candidate's discrimination claim.

A match score that recruiters sort candidates by is the kind of tool the law targets. Removing scores narrows the question without settling it. For a write-up with no score, counsel should assess whether its content and the way recruiters rely on it bring it within the definition.

Illinois: notice for AI used in recruiting

Public Act 103-0804, passed as HB 3773, amended the Illinois Human Rights Act and took effect on 1 January 2026. For recruitment, hiring and other employment decisions, an employer may not use AI that has the effect of subjecting employees to discrimination on the basis of protected classes, or use zip codes as a proxy for them. The statute also makes it a violation to fail to give employees notice that the employer uses AI for those purposes. The law's definition of artificial intelligence includes generative AI, so a drafting tool can be in scope.

The Illinois Department of Human Rights has to adopt rules on how and when notice is given. It published proposed rules on 15 May 2026, then withdrew and postponed them on 2 June 2026. Bright Defense reported in its 21 September 2026 update that no new timeline had been published. The duty to give notice is in the statute and applies anyway.

Staffing firms meet the Illinois law in two roles. A firm that employs its temps is an employer under the amendment. The Human Rights Act also makes it a violation for an employment agency to accept a job order that makes or has the effect of making unlawful discrimination. The notice wording names employees, so ask counsel how it applies to applicants. Notifying applicants as well is a prudent step, for example in job postings and on your website.

A separate, older Illinois law covers AI analysis of recorded video interviews for positions based in Illinois. The employer must explain how the AI works and get the applicant's consent beforehand, and must delete the videos within 30 days of a request. A staffing firm that asks candidates to record one for an Illinois role is likely the employer asking.

Colorado: the 2024 law was replaced before it started

Colorado's SB 24-205 was due to take effect on 1 February 2026. SB 25B-004, approved on 28 August 2025, moved that date to 30 June 2026. SB 26-189 was signed on 14 May 2026, before the new date arrived. It repeals and reenacts those provisions as a narrower law on automated decision-making technology, so SB 24-205 never took effect.

The replacement covers technology used to materially influence a consequential decision, and employment decisions count, including pay. A deployer must give clear notice at the point of interaction and explain the technology's role in plain language within 30 days after an adverse outcome. People can ask to access and correct their data and to get meaningful human review and reconsideration. Records must be kept for three years. The Attorney General enforces the law and there is no private right of action. Until 1 January 2030, the Attorney General must give 60 days' notice and a chance to cure before bringing an action, where a cure is possible.

The law is scheduled to take effect on 1 January 2027, and the Attorney General must adopt rules by the same date. Eckert Seamans reported in June 2026 that a federal court stay entered on 27 April 2026 extends to the replacement law, and that enforcement depends on rulemaking, which had not formally begun when it wrote. Confirm the current court order and rulemaking status before you rely on any date. Under the bill's own dates, plan for 1 January 2027 at the earliest.

California and Texas

California's Civil Rights Council regulations on automated-decision systems took effect on 1 October 2025. As Mayer Brown summarizes them, an automated-decision system is a computational process that makes a decision or facilitates human decision making about an employment benefit. Liability reaches an employer's agent, meaning anyone acting on the employer's behalf, which can include a staffing firm. Records must be kept for at least four years, and evidence of anti-bias testing is relevant to a defense.

That definition may be broad enough to reach a tool that drafts submittals, because the draft facilitates a recruiter's decision. Keep four years of what the tool produced and what the recruiter changed, and avoid any output that sorts or excludes candidates. Separately, the California Privacy Protection Agency's regulations took effect on 1 January 2026. For businesses subject to the CCPA, covered uses of automated decision-making technology must comply from 1 January 2027. Assess that coverage separately from the employment rules above.

Texas passed TRAIGA, HB 149, which took effect on 1 January 2026. It prohibits developing or deploying AI with the intent to unlawfully discriminate against a protected class, and it says disparate impact alone cannot show that intent. Only the Texas Attorney General can enforce it, and there is no private right of action. Federal discrimination law still applies to outcomes in Texas.

What changed at the EEOC, and what stayed the same

After Executive Order 14179 of 23 January 2025, the EEOC removed its May 2023 technical assistance on AI and Title VII and its May 2022 technical assistance on AI and the ADA from its website. Cooley's February 2025 analysis made the point that anti-discrimination laws at every level still apply to AI use.

Ogletree Deakins noted in July 2026 that Title VII disparate impact remains enforceable by private plaintiffs and state agencies.

Private suits are where the exposure shows. In Mobley v. Workday, the federal court on 16 May 2025 granted preliminary certification of a nationwide age discrimination collective of applicants aged 40 and over, on a disparate impact theory about Workday's applicant screening. The ruling was preliminary and made no finding of liability. It shows how one claim about a screening tool can grow into a case on behalf of many applicants.

Worked example: an AI inventory for a firm in four states

This is an illustrative example with assumed numbers, not a client result. Take a firm with 60 internal staff, offices in Dallas and Chicago, light industrial placements in Illinois, IT contractors at two New York City clients and a few remote roles in California. The owner asks each team which AI tools they use and finds five.

The time math is small. Assume two hours per tool to document it and write the notices, so about 10 hours for the first pass. After that, assume three hours a quarter to review the list, plus an hour per tool in scope to check its records. The match score is the costly line. Its bias audit and notice period make it the most expensive tool on the list to keep.

For this firm the cheapest first AI project is one that scores nobody. Removing scores narrows the legal questions, and counsel should still check whether the drafts' content and use bring audit or notice duties.

Controls for a first AI project in recruiting

These are the rules we build into staffing projects. They are also fair questions to put to any vendor.

• The agent prepares documents and drafts messages. It never scores, ranks, screens out or rejects a candidate, and it does not run or rate interviews.
• The agent never infers age, race, disability or similar traits, and it ignores zip codes and graduation years.
• Job orders with wording that suggests national origin or age bias, such as 'no accents' or 'young and energetic', go to a person before the order is accepted.
• Notice goes out wherever the law asks for it. In Illinois we suggest telling applicants as well as employees, because the AI definition there includes generative AI.
• Records keep each draft next to the version the recruiter sent, for at least four years to cover California.
• Anything that would act as a decision tool, such as a match score, stays out of the first scope. Adding one later needs counsel and a bias audit plan for New York City roles.

Starting small with a compliant first project

Start with an inventory of the AI already switched on in your ATS and the tools around it, then pick a first project that prepares work and decides nothing. Candidate submittals fit well, because a recruiter edits and sends every one and a factual write-up ranks nobody.

Our five-day AI Workflow Sprint costs $2,500 and can include that inventory alongside a working prototype on your redacted documents. It comes with a full refund if we do not find 10 staff hours a week, and if you go ahead, the fee comes off the build. Builds start from $7,500 per workflow, half to start and half when the acceptance criteria pass.

Common questions