The US Now Has Three State AI-Hiring Laws — None Require an Independent Audit

If you asked an HR leader in January 2025 what a US “AI hiring law” would require, most would have guessed some version of New York City’s Local Law 144: an independent bias audit, a public report, a mandatory scorecard. That guess would have been reasonable — NYC’s law, in force since mid-2023, was the only real precedent in the country.

It is also, as of this month, the wrong guess almost everywhere else. California’s automated-decision-system rules have been in force for a year. Illinois’s amendment to its Human Rights Act has been in force since January 1. And Connecticut’s Artificial Intelligence Responsibility and Transparency Act (SB 5 / PA 26-15) switched on its first employment provisions on October 1 — five days before this post was written. None of the three mandates an independent bias audit. All three instead build liability around disclosure, documentation, and discriminatory effect — a meaningfully different regulatory bet than the one NYC made, and one employers (and the vendors selling them AI screening tools) should understand is now the US norm, not the exception.

Three laws, one year, three different mechanisms

California: liability through record-keeping, not a testing mandate. The California Civil Rights Council’s amendments to the Fair Employment and Housing Act (FEHA) regulations took effect October 1, 2025. They apply to any employer using an “automated-decision system” — defined broadly enough to cover resume screening, structured interview scoring, and ranking tools — and require retaining ADS-related records (inputs, outputs, decision criteria, and any bias testing performed) for at least four years. Crucially, California does not require a bias audit. It does something more oblique: the regulations make the presence or absence of proactive anti-bias testing admissible evidence in a discrimination claim, as Jackson Lewis’s compliance checklist and Paul Hastings’s client alert both lay out. Run the testing and you have a defense; skip it and your silence can be used against you. It is a liability incentive wearing the clothes of a disclosure rule.

Illinois: liability through a notice requirement with teeth. HB 3773, amending the Illinois Human Rights Act, took effect January 1, 2026. It does three things, each independently actionable: it makes it a civil rights violation to use AI that has the effect of discriminating against a protected class, with no intent requirement; it separately bars using ZIP code as a protected-class proxy; and it requires employers to notify applicants and employees whenever AI is used in recruitment, hiring, promotion, discharge, or other employment decisions, in plain language and in the languages the workforce speaks, as Warden AI’s compliance guide details. The notice obligation is the sharpest edge here, because unlike most of these statutes it doesn’t require that the AI be a “substantial factor” in the outcome — simply failing to disclose that AI was used is its own violation, regardless of what the AI did.

Connecticut: the newest, and the most incremental. Connecticut’s AI Act employment provisions are staggered, per Ropes & Gray’s and Holland & Knight’s analyses. The piece that took effect October 1, 2026 amends the state’s anti-discrimination law so that an employer can no longer point to “the AI did it” as a defense against a discrimination claim, and it adds a new WARN Act disclosure requirement: employers filing mass-layoff notices must now state whether the layoffs are connected to AI or other technology adoption. The heavier obligation — written notice to every applicant and employee before an AI-assisted employment decision is made — is formally on the books now but, per Morrison Foerster’s summary, doesn’t bind tools deployed before October 1, 2027. Connecticut, in other words, chose to regulate the excuse before it regulates the tool.

Zoom out and the throughline is consistent: outside New York City, the pattern two dozen US states have been drafting toward in 2026 (Multistate’s September tracker counts roughly 155 AI-in-the-workplace bills considered this legislative session alone) is disclosure-plus-documentation, not audit-and-publish. Colorado’s AI Act, delayed to 2027, and Texas’s narrower TRAIGA statute follow the same pattern — notice and non-discrimination duties, no independent audit mandate. NYC remains, as of this writing, the only US jurisdiction that requires an annual bias audit by a party independent of both the vendor and the employer, with a public summary and a per-day penalty for non-compliance. Everywhere else, the audit is optional risk management rather than law.

Why lawmakers picked disclosure over audits — and why that's not obviously the weaker choice

It's tempting to read “no audit mandate” as regulatory softness. That undersells what's actually happening. An audit mandate is expensive to design well and politically easier to pass once, in one city, than to replicate fifty times with the rigor it needs. What California, Illinois, and Connecticut are doing instead is cheaper to legislate and arguably harder to escape: they don't ask “did you pass an audit,” they ask “can you produce four years of records,” “did you tell the candidate,” and “can a plaintiff show a discriminatory effect regardless of your intent.” A vendor whose tool produces a biased outcome doesn't get to argue “we never audited it, so we didn't know” — in California that absence actively counts against them, and in Illinois intent isn't even part of the test.

For an employer evaluating AI screening or interview tools in late 2026, the practical reading is this: the audit question (“has this been independently tested?”) is still worth asking, but it's no longer the only — or even the first — compliance question. The ones a general counsel will actually ask are closer to:

• What does this tool score candidates on, and is that scoring applied the same way to everyone?
• What records does it keep, and for how long?
• Does the product tell candidates, unprompted, that they're being evaluated by AI — or does disclosure depend on the employer remembering to add it?

A tool architecture where disclosure is optional, bolted on by whichever customer happens to configure it, is a liability surface in Illinois today and in Connecticut from 2027. A tool where every employment-facing greeting discloses AI involvement by default, with no configuration path to suppress it, is a materially different risk posture.

Where NiceHire actually stands — and where it doesn't

Two things above are true of NiceHire's own product today, and we're stating them narrowly on purpose rather than rounding up to “we're compliant,” because compliance is a legal determination for each customer's own counsel, not a vendor's marketing claim.

First: every AI screening greeting NiceHire's platform generates — across every interview language it ships and on both a candidate's first attempt and a reconnect after a dropped session — discloses that the interviewer is AI, and that disclosure cannot be suppressed by a custom greeting template. Second: every candidate screened through NiceHire is scored against the same fixed set of criteria — technical fit, communication, and cultural fit, each out of 100 — against a configurable passing threshold, rather than against criteria that drift session to session.

What we won't say, because the record doesn't support it: that this makes the product “unbiased” or “audit-ready” in the NYC Local Law 144 sense.

We have not commissioned an independent bias audit of the kind NYC requires and Illinois and Connecticut do not. Consistent criteria is a mechanism, not an outcome guarantee — it tells you the same rubric was applied to everyone, not that the rubric itself is free of disparate impact, which is exactly the thing an independent audit is built to test and a vendor's own description of its product is not. If your organization operates in a jurisdiction where an audit matters — NYC, or simply out of caution — that's a step you, or a third party you choose independently of your vendor, still have to take.

The practical takeaway

The US AI-hiring compliance landscape didn't converge this year, it diverged into a second recognizable pattern. NYC's audit model is more than three years old now and still alone. California, Illinois, and — as of five days before this post — Connecticut have each built a parallel track around disclosure, documentation, and effects-based liability: cheaper to pass, harder to argue your way out of, and now the default for any employer hiring across state lines. If you're buying or building AI hiring tools in 2026, the diligence question isn't “has this passed an audit.” For most of the country, it's “can this tool prove, in writing, four years from now, what it told every candidate and why it scored them the way it did.” That's a lower bar to clear on paper and, done honestly, a harder one to fake.