US State AI Employment Laws: What Actually Applies to Your Hiring Process

"AI employment law" is not one law. It is a patchwork of state and city statutes, each triggered by different AI use cases — hiring and candidate screening, promotion decisions, performance monitoring, and scheduling or shift assignment — and each applying to employers above different size thresholds that vary by state.

No single company-size number applies everywhere. Illinois HB 3773 applies to any employer with at least one employee in the state; NYC Local Law 144 applies to any employer using an automated employment decision tool (AEDT) for a covered decision, regardless of headcount; Colorado's law and California's ADMT rules are scoped by the type of decision more than by a fixed employee count. Check the state-by-state section below rather than assuming a single "50+ employees" or "100+ employees" threshold covers you everywhere.

The use cases these laws cover typically include résumé screening and candidate ranking, interview scoring or analysis, promotion recommendations, AI-assisted performance or sentiment monitoring, and in some scopes, automated scheduling that affects hours or shift assignment. A tool that only drafts job postings or answers internal HR policy questions is a materially different risk profile than one that scores or ranks real candidates or employees — the laws below are written around decisions that affect a specific person, not general-purpose AI assistance.

Select the states where you employ people and the AI use cases you actually run to see which laws likely apply, their effective-date reference, and the artifact each one typically requires. This runs entirely in your browser — nothing is submitted anywhere, and this is not legal advice.

Each entry below covers what the law regulates, an effective-date reference, and an explicit note to verify current status before relying on it — treat the verify note as the actual point of each row, not boilerplate.

On December 11, 2025, the federal government signed Executive Order 14365, "Ensuring a National Policy Framework for Artificial Intelligence," directing agencies to work toward a uniform federal AI policy that would preempt state laws viewed as inconsistent with it. A "National Policy Framework for Artificial Intelligence" following from that order was published March 20, 2026, and it recommends that Congress preempt state laws seen as imposing "undue burdens" — but a recommendation to Congress is not itself a change in law.

The executive order does not, and legally cannot, override existing state law on its own. Only an act of Congress or a court ruling can actually preempt a state statute. Until either of those happens, Colorado, California, Illinois, Texas, and New York City's obligations remain enforceable exactly as described in the table above, and a company that stops complying based on the executive order alone is taking on real, current legal exposure for a preemption that has not actually happened yet.

The explicit operational guidance here: do not stop complying with any state AI employment law on the strength of an executive order alone. Treat the order as a signal worth monitoring — particularly if you operate in a state whose law might be challenged or modified by future federal legislation — not as a reason to pause your compliance work today.

Across the states above, the operational requirements cluster into five recurring categories. State-specific detail lives in the table above; this section covers what each category generally involves.

Running the AI model on your own infrastructure — self-hosted, on-premises, or air-gapped — does not remove any of the notice, discrimination, or audit obligations above. Every one of the laws in the table is triggered by the fact that an AI system materially influenced a decision about a real person, not by where the model's inference happens or which vendor built it.

This is worth stating plainly and early because it is the single most common and costly misconception HR technology teams bring into a local-LLM deployment decision. Self-hosting genuinely solves a different set of problems — it keeps candidate resumes and performance data off a third-party vendor's servers, and it removes a vendor as a data-sharing risk. It does not touch the legal trigger for notice, audit, or human review, because that trigger is "an AI system influenced a decision about a person," which is true regardless of deployment model.

A vendor-hosted AI hiring tool and a self-hosted open-weight model performing the same résumé-screening function carry the same state-law obligations. The deployment decision changes your data-privacy and vendor-risk posture; it does not change your employment-law posture.

What it changes: a self-hosted deployment removes a third-party vendor from your data flow map for candidate and employee data, which is a genuine reduction in vendor-risk and cross-border data-transfer exposure — particularly relevant for a US company with EU employees, where GDPR's international-transfer rules add another layer on top of the employment-law obligations above.

What it does not change: the notice obligation to the candidate or employee, the requirement for a human-review path on adverse decisions, the record-retention duty, and (where applicable) the independent bias-audit requirement. None of those are vendor-dependent — they attach to the decision itself.

The practical sequencing most HR technology teams land on: treat local deployment as a data-governance and cost decision made independently from the compliance checklist above, then build the notice/audit/human-review artifacts the same way regardless of which deployment model you choose.

Everything above covers the US state-level patchwork. For a US-headquartered company with EU employees, the EU angle applies in parallel and, in several respects, is currently stricter than any single US state: employment-related AI (candidate screening, performance monitoring, staff scheduling) is classified as "high-risk" under Annex III of the EU AI Act, and while that specific high-risk obligation was deferred from August 2, 2026 to December 2, 2027 by the "Digital Omnibus" package adopted in June 2026, three older regimes already apply in full without delay — GDPR Article 22 (automated decision-making, in force since 2018), AI Act Article 4 (AI literacy, in force since February 2, 2025), and works-council co-determination in Germany, Austria, and the Netherlands for systems that monitor performance or behavior.

This section is general orientation, not legal advice. Confirm applicability with employment counsel for your specific states, industries, and use cases before finalizing a compliance plan.