If you put together a compliance plan for AI in hiring in late 2025, there's a real chance it's already out of date. The landscape didn't just add a few new state laws — it fractured. As of spring 2026, employers face a patchwork in which different jurisdictions impose distinct obligations around bias audits, impact assessments, candidate notice, and anti-discrimination enforcement tied to algorithmic hiring tools, with no federal framework to reconcile them. And then, in December, the federal government moved to actively contest the states' authority to regulate at all.

For a 50-to-500-person company using AI to screen resumes, score interviews, or rank candidates — which, at this point, is most of them — this isn't an abstract legal-department problem. It's an operational one, and the right response isn't to chase every statute. It's to adopt a posture that holds up regardless of how the federal-state fight resolves. This guide lays out where things actually stand and what we tell clients to do about it. It's a meaningful update to the AI-in-hiring compliance landscape we mapped in 2025, because nearly every input to that picture has shifted.

Where the Law Actually Stands in 2026

Start with what's live. Illinois House Bill 3773 took effect January 1, 2026, amending the Illinois Human Rights Act so that existing anti-discrimination standards explicitly apply to AI used in employment decisions. In practice it does two things that matter: it prohibits employers from using AI in a way that produces discrimination against a protected class — whether or not the discrimination is intentional — and it requires employers to notify applicants and employees when AI is used in employment decisions. It also bars using ZIP codes as a proxy for protected characteristics, which closes an obvious workaround.

The Illinois rules aren't fully settled, either. The state's Department of Human Rights has issued proposed rules clarifying the notice obligation — when notice must be given and how it must be delivered — with a public comment period open through late June 2026. So even the live law is still moving underneath you.

Next on the calendar is Colorado. The Colorado Artificial Intelligence Act takes effect June 30, 2026, and it's among the most comprehensive state frameworks passed so far. It regulates "high-risk" AI systems — broadly, any system that makes or substantially influences a consequential employment decision like hiring, firing, or promotion. Under it, both vendors and employers must disclose foreseeable uses and risks, complete an annual impact assessment, and maintain transparency when someone interacts with an AI system or receives an adverse decision from one. Violations are treated as unfair trade practices under Colorado's consumer protection regime, and there's a 90-day window to notify the attorney general once discrimination is discovered.

Illinois and Colorado are the headline acts, but they sit inside a wider shift. By January 1, 2026, twenty US states had comprehensive privacy laws in force, and the long-standing assumption that employee and applicant data sits outside the scope of those laws no longer holds at scale — particularly where AI or sensitive data is involved. Privacy law, civil-rights law, and AI governance are converging on the same HR data from three directions at once.

The Federal Curveball

Here's the development that scrambled everyone's 2026 planning. On December 11, 2025, the federal government issued an executive order titled "Ensuring a National Policy Framework for Artificial Intelligence," aimed at blocking state AI laws. It directs federal agencies to review existing and proposed state AI requirements and identify actions that could preempt, challenge, or restrict laws seen as interfering with national AI policy or interstate commerce.

This puts employers in a genuinely awkward position. You now have states actively expanding AI employment obligations and a federal branch actively trying to constrain them. An executive order does not, by itself, repeal a state statute — Illinois HB 3773 is in effect today regardless — and the question of how far federal preemption can reach into state civil-rights law is exactly the kind of thing that gets litigated for years. The practical reality for the next several quarters is uncertainty: the rules are real and enforceable now, and simultaneously contested at a level above the states.

The temptation in this situation is to wait and see — to assume the federal action will sweep the state laws away and that compliance work now is wasted effort. We'd caution strongly against that read. Betting your hiring practices on a favorable, fast resolution to a federal-state constitutional fight is not a compliance strategy; it's a gamble with discrimination liability on the table. The laws that are live are live.

Why Patch-By-Patch Compliance Is the Wrong Model

The instinct for a multi-state employer is to map obligations jurisdiction by jurisdiction: Illinois rules for Illinois candidates, Colorado rules once June 30 hits, something else for New York City's audit requirement, and so on. For anyone hiring across state lines — which is nearly everyone running distributed teams now — that approach collapses under its own weight almost immediately.

The problem is compounded by remote hiring. When you post a role open to candidates in multiple states, which state's law governs? Often the most protective one that touches the transaction. Patch-by-patch compliance means your actual obligation is the union of every applicable regime, reassessed every time a new law takes effect — and we've established that new laws are taking effect on a rolling basis. You'd be re-architecting your hiring process every quarter, always a step behind.

The more durable model, and the one sophisticated employers are moving toward, is to apply the highest common standard across all systems rather than patching jurisdiction by jurisdiction. You identify the most demanding requirements across the regimes you touch — notice to candidates, a bias/impact assessment, a documented human-review step, no proxy variables for protected classes — and you build those into your process everywhere. It costs a bit more in the easy jurisdictions and saves you enormously in complexity, audit-readiness, and the ability to sleep at night when the next state passes its version.

Don't Forget the Vendor Side of the Equation

One shift in the 2026 landscape gets less attention than the headline statutes but matters enormously for mid-market companies: vendor accountability has increased across recruitment and HR technology. The laws no longer treat the tool as a black box the employer can hide behind. Under Colorado's framework, for instance, the obligations attach to both developers and deployers of high-risk systems — meaning you, the employer, carry responsibility for a tool's behavior even though you didn't build it.

This has a direct, practical consequence: your compliance posture is now partly a procurement problem. When you license an ATS with built-in screening, an assessment platform, or any tool that scores or ranks candidates, you're taking on responsibility for how it makes decisions. That means the diligence questions you ask vendors have to change. Has the tool been audited for bias, and can they show you the results? What variables does it use, and can you confirm none of them function as proxies for protected classes? Will the vendor contractually support your notice and impact-assessment obligations, or are they leaving you exposed?

A surprising number of HR tech contracts signed before 2026 are silent on all of this, which means the legal risk sits entirely with the employer by default. As you renew or add tools, the contract is the place to push responsibility back toward the party that actually controls the algorithm. A vendor unwilling to stand behind their tool's compliance behavior is telling you something useful about the risk you'd be absorbing.

This also argues for consolidation where it makes sense. Every additional point-solution that touches a hiring decision is another vendor to vet, another contract to scrutinize, another algorithm whose behavior you're now accountable for. There's a real compliance case — separate from the usual efficiency case — for reducing the number of independent decisioning tools in your funnel and favoring platforms that take transparency and assessment seriously as a feature.

A Practical Posture for Mid-Market Employers

Here's the concrete version of "highest common standard" — the baseline we'd build with a client regardless of how the federal-state fight plays out, because every element of it is defensible under any of the live regimes.

First, inventory your AI tools. You can't govern what you haven't catalogued, and most companies underestimate how many points in their funnel involve algorithmic decisioning — resume screeners, assessment scorers, interview transcription and analysis, candidate ranking inside the ATS. List every tool, what decision it influences, and what data it ingests.

Second, provide notice by default. Tell candidates and employees when AI is used in decisions that affect them, everywhere, not just in Illinois. It's already required in some places, trending toward required in more, and it costs you almost nothing to standardize.

Third, run impact assessments and keep them current. Colorado will require annual assessments for high-risk systems; treat that as the floor. Document what each tool does, what bias risks it carries, and what you've done to mitigate them.

Fourth, keep a human in the loop and document it. The throughline across every one of these laws is anti-discrimination. A documented, meaningful human review step in consequential decisions is both good practice and your strongest defense if an outcome is ever challenged.

Fifth, kill the proxies. Illinois named ZIP codes explicitly, but the principle is general: any variable that correlates tightly with a protected class is a liability whether or not a statute lists it by name. Audit your tools' inputs for these.

None of this requires you to predict how the courts rule. That's the point. A hiring process built on notice, assessment, human review, and clean inputs is compliant in Illinois today, ready for Colorado in June, and resilient to whatever the federal-state fight produces. If you want help mapping your current hiring stack against this baseline — or building the assessment and notice processes into how your team actually works — that's the kind of HR function and compliance design work we do day to day.

The Bottom Line

The AI hiring compliance picture in 2026 is genuinely messier than it was a year ago: Illinois is live, Colorado lands June 30, twenty states now have privacy laws that reach HR data, and a federal executive order is actively trying to constrain the whole state-level apparatus. Chasing each statute individually is a losing game for any company hiring across state lines. The winning move is to stop patching and adopt the highest common standard — notice, impact assessments, documented human review, no proxy variables — as your baseline everywhere. It's defensible under every live regime and robust to a fight that won't resolve quickly. Build the durable process once, rather than rebuilding a fragile one every quarter.

Not sure whether your current hiring process would hold up under Illinois or Colorado scrutiny? Get in touch with our team for a clear read on where you stand and what to shore up first.