AI in employment is now regulated at every level of government: federal (Title VII, ADA, ADEA), state (California, Colorado, Texas, Illinois), local (NYC), and international (EU AI Act). The Biden-era AI executive order was rescinded and the EEOC removed its 2023 AI guidance from its website — but this does not reduce employer liability. Title VII, ADA, and ADEA still apply in full force. If AI produces disparate impact, the employer is liable regardless of whether federal guidance documents exist. As an HR ops leader, compliance with AI regulations is a present-day operational requirement.

High-profile cases: Amazon’s biased hiring AI, HireVue’s facial analysis controversy, the iTutorGroup EEOC settlement, and the Eightfold AI class action (Jan 2026) — alleging secret applicant scoring dossiers that may violate FCRA — put AI bias squarely on lawmakers’ radar.

State momentum: California CRD regulations (Oct 2025), Colorado AI Act (delayed to June 2026), and Texas HB 149 (Jan 2026) represent the most detailed state-level AI employment regulations yet. Federal legislation is expected by late 2026 or early 2027 to harmonize the state patchwork.

Public awareness: Employees and candidates increasingly know that AI is making decisions about them — and they expect transparency.

Title VII of the Civil Rights Act prohibits employment discrimination based on race, color, religion, sex, or national origin. The EEOC’s 2023 guidance on AI in hiring was removed from its website following the rescission of the Biden-era AI executive order. However, the underlying law has not changed. Title VII applies to AI-driven decisions just as it does to human decisions. If your AI screening tool disproportionately rejects candidates from a protected class, that’s a potential Title VII violation — regardless of whether federal guidance documents exist.

Emerging litigation: The Eightfold AI class action (January 2026) alleges the platform created secret applicant scoring dossiers without disclosure, potentially violating the Fair Credit Reporting Act and California consumer reporting laws. This case signals a new front for AI hiring liability beyond Title VII.

Disparate treatment: Intentionally treating people differently based on protected class. Rare in AI, but possible if protected characteristics are used as input features.

Disparate impact: A facially neutral practice that disproportionately affects a protected group. This is the primary AI risk. An algorithm doesn’t need to “intend” to discriminate — if the outcome is discriminatory, you have a legal problem.

California CRD Regulations (effective October 2025): The most detailed state AI employment regulations yet. Unlawful to use automated decision systems that discriminate on protected traits. Requires meaningful human oversight, proactive bias testing, 4-year recordkeeping, and alternative assessments for candidates. This is now the strictest state standard.

Colorado AI Act / SB 24-205 (delayed to June 2026): Covers “high-risk” AI in employment. Requires annual impact assessments, transparency, documentation, and appeal processes. Violations constitute an unfair trade practice.

Texas TRAIGA / HB 149 (January 2026): Focuses on government agencies but establishes that AI cannot be used with intent to discriminate. Notably rejects disparate impact as standalone liability — diverging from California and other states.

Illinois AI Video Interview Act (2020): Employers must notify candidates that AI is analyzing their video interview, explain how the AI works, and obtain consent.

Maryland HB 1202 (2020): Bans the use of facial recognition in job interviews unless the applicant signs a waiver.

NYC Local Law 144, effective July 2023, regulates automated employment decision tools (AEDTs) — any AI system that “substantially assists or replaces” hiring or promotion decisions. The requirements are specific:

1. Annual bias audit: An independent third party must conduct a bias audit annually, analyzing selection rates by race/ethnicity and sex.

2. Published results: The audit summary must be publicly posted on the employer’s website.

3. Candidate notification: Candidates must be notified at least 10 business days before the AEDT is used, told what job qualifications the tool assesses, and given the option to request an alternative process.

The EU AI Act, which began phased enforcement in 2024, classifies AI systems by risk level. Employment AI is explicitly classified as “high-risk,” meaning it faces the strictest requirements. This applies to any AI used in: recruitment, resume screening, job advertising, interview evaluation, promotion decisions, termination decisions, task allocation, and performance monitoring.

If your organization employs people in the EU, or uses AI tools that process EU residents’ data, this applies to you.

Here is the most important legal principle in AI compliance: if your vendor’s AI tool discriminates, you — the employer — are liable. Not the vendor. Not the developer. You. The EEOC has made this clear: employers cannot outsource their Title VII obligations. A vendor’s AI is your tool once you deploy it. If it creates adverse impact, it’s your problem in court.

Before signing: Request bias audit results, model documentation, and data governance practices. If they can’t provide these, walk away.

During contract: Negotiate audit rights, indemnification clauses, and transparency requirements.

After deployment: Conduct your own bias monitoring. Don’t rely solely on vendor assurances.

1. Inventory: Catalog every AI tool in use across HR — including AI features embedded in your ATS, HRIS, and other platforms that you may not think of as “AI tools.”

2. Classify: Assign a risk level to each tool based on what decisions it influences: high (hiring, firing, compensation), medium (scheduling, routing, categorization), low (drafting, summarization, search).

3. Assign ownership: Every AI tool needs a named owner responsible for compliance, monitoring, and incident response.

4. Schedule audits: High-risk tools need bias audits at least annually. Medium-risk tools need periodic review. Low-risk tools need annual inventory confirmation.

5. Document everything: Every decision about AI deployment, every audit result, every incident — documented and retained.

AI risks are different from traditional HR technology risks. They involve model drift (performance degrades over time), emergent bias (bias that appears only at scale), and regulatory velocity (laws changing faster than your compliance cycle). A dedicated AI risk register, integrated with your existing risk management framework, gives you visibility and control.

Each AI tool should have an entry tracking: what it does, what data it uses, what decisions it influences, who owns it, when it was last audited, and its current compliance status across all applicable jurisdictions.