The Workplace Ahead.

Almost certainly yes. These laws regulate the employer that uses the tool, not just the developer that builds it. If software scores, ranks, filters, or recommends candidates — even as one input among many — it generally qualifies as an automated employment decision tool under NYC Local Law 144, a tool making a “consequential decision” under Colorado’s SB 26-189 (effective January 1, 2027), and “artificial intelligence” under Illinois HB 3773. “The vendor handles compliance” is not a defense anywhere.

As of August 2026, 22 tracked laws are enacted and in effect — most significantly Illinois HB 3773 (effective January 1, 2026), NYC Local Law 144, California’s FEHA automated-decision regulations and CPPA ADMT regulations (effective January 1, 2026, with an employer compliance deadline of January 1, 2027), Maryland’s facial-recognition consent law, and the biometric statutes (Illinois BIPA, Texas CUBI, Washington HB 1493). Four more are enacted but not yet effective — Colorado’s SB 26-189 arrives January 1, 2027 and Connecticut’s employer obligations October 1, 2027. The map above shows the full picture, and the at-a-glance panel tracks the counts.

A formal annual independent bias audit is legally required only under NYC Local Law 144 today. But regular adverse-impact testing is rapidly becoming the de facto standard: California’s FEHA regulations impose a four-fifths-rule analysis duty, Illinois exposes untested tools to discrimination liability, and plaintiffs in Mobley v. Workday are using the absence of testing as evidence. If your tool touches hiring at scale, test it — under privilege, with counsel directing the methodology.

Under 12 of the tracked entries, yes — and Illinois BIPA, covered in the privacy-crossover section of this tracker, is the most dangerous: $1,000–$5,000 per person per violation, now on a per-person basis after the 2024 amendment, with settlements like Rogers v. BNSF at $75 million. Some of the newer AI-specific statutes route enforcement through the attorney general — Colorado’s SB 26-189 gives the AG exclusive enforcement — but Illinois HB 3773 amends the Human Rights Act, so complainants can pursue a civil action after the IDHR charge process (775 ILCS 5/7A-102). And Title VII, the ADEA, and the ADA always provide a private path if the tool produces discriminatory outcomes.

No. Every regime on this tracker places the compliance duty on the deploying employer, and a vendor’s own audit rarely satisfies a statute’s specific requirements — NYC’s bias audit, California’s adverse-impact analysis, and Colorado’s human-review regime each demand different things. Mobley v. Workday shows the vendor can be liable alongside you, not instead of you. What actually protects you: contractual audit rights, data-access and cooperation clauses, AI-specific indemnification, and representations about training data and adverse-impact testing.

Not on any realistic horizon, though the pressure is building. The Senate stripped the proposed 10-year state-AI moratorium from the 2025 reconciliation bill 99–1, and the White House’s March 2026 framework is advisory only. The bipartisan Great American AI Act discussion draft (June 2026, Reps. Obernolte and Trahan) would preempt for three years only state laws specifically regulating AI model development — as drafted it would not reach post-deployment employment laws like most of those on this tracker — and it has not yet been introduced as a bill. Federal agencies have actually pulled back — the EEOC’s current enforcement plan de-emphasizes disparate impact. The practical planning assumption for the next several years is state-by-state regulation, with California, Colorado, Illinois, and New York setting the pace.

No — build one AI governance program to the strictest applicable standard. In practice that means California’s FEHA testing duty, Colorado’s notice and human-review obligations arriving January 1, 2027, NYC’s audit requirement if you hire there, and Illinois’s discrimination framework. A single program — tool inventory, pre-deployment testing, candidate notice, human review of adverse decisions, retention of audit records — satisfies the strict states and exceeds the rest. That is materially cheaper than tracking 30 minimums.

Different, older laws reach this first. Biometric statutes (BIPA, CUBI, Washington HB 1493) cover face-geometry timeclocks and voice analysis. New York and Connecticut require written notice of electronic monitoring. The NLRA protects concerted activity — algorithmic management that chills it draws NLRB attention regardless of state law. And several tracked bills (Michigan, Massachusetts, New Jersey) would restrict AI-driven productivity data in discipline decisions. If you deploy monitoring analytics, treat it as its own compliance workstream.

Five steps: (1) inventory every tool that scores, ranks, or filters people — including features inside your ATS and HRIS you may not know are on; (2) map the inventory against the states where you hire (start with the map above); (3) stand up candidate notice where required — it is the cheapest obligation to satisfy and the most visible to regulators; (4) renegotiate vendor contracts for audit rights and indemnification; (5) assign one owner — legal, not IT — for AI employment compliance. Talk to us about sequencing the rest.