As Federal AI Hiring Oversight Recedes, States Build a Compliance Patchwork
Not legal advice. This article discusses legal and regulatory developments and is generated with AI assistance under human editorial review. It is provided for informational purposes only and does not constitute legal advice. Laws and regulations vary by jurisdiction and are subject to change. You should consult your own qualified legal counsel before taking or refraining from any action based on the content of this article. Read our AI Transparency statement.
The News
The US regulatory landscape for AI in hiring has split in two. At the federal level, Trump administration executive orders have withdrawn the EEOC's AI and algorithmic fairness guidance and deprioritised disparate impact enforcement. At the state level, the opposite is happening. California's Civil Rights Council enacted regulations in October 2025 making it unlawful to use automated decision systems that discriminate under FEHA. New Jersey added algorithmic discrimination provisions to its administrative code in December 2025. Illinois amended its Human Rights Act, effective January 2026, to make AI-driven discrimination a civil rights violation and ban the use of zip codes as proxies for protected characteristics. Colorado's AI Act requires bias audits and impact assessments. Connecticut has pending legislation (SB 435) that would mandate government-approved third-party bias audits. Meanwhile, a January 2026 class action against Eightfold AI advances a novel theory: that AI-generated candidate scores based on scraped public data constitute 'consumer reports' under the Fair Credit Reporting Act, opening a new frontier in AI hiring litigation.
Why It Matters
For multi-state employers, this is not a theoretical compliance exercise — it's an operational headache that gets worse with every legislative session. The same AI screening tool that's perfectly legal in Texas may require an independent bias audit in New York City, an impact assessment in Colorado, explicit candidate consent in Illinois, and algorithmic discrimination safeguards in California. The Reed Smith analysis notes that even companies relying on third-party AI vendors face liability — the 'we just bought the tool' defence does not work. The Eightfold FCRA theory is particularly significant because it sidesteps the discrimination framework entirely and goes after transparency: if AI scores are consumer reports, candidates have a right to know what's in them and dispute inaccuracies.
Taking Action
All action is situated in your corporate context. These are starting points, not prescriptions — choose what fits.
Connect
Who to talk with in your enterprise
Your employment counsel: Map every AI tool in your hiring process against the state-level requirements where you hire. Prioritise Illinois (active enforcement), NYC (bias audit requirements), and Colorado (impact assessments). Ask whether your vendor contracts include representations about bias testing, indemnification, and audit rights.
Your head of TA compliance or HRIS lead: If you use any tool that scrapes or aggregates external data about candidates (social media, 'career trajectory' scores, public records), flag it immediately. The Eightfold FCRA case suggests these may need to be treated as consumer reports with full disclosure and dispute rights.
Inspect
What to take a closer look at
Pull your last 12 months of hiring funnel data by protected characteristic for any role where AI screening was used. Run a basic adverse impact analysis using the four-fifths rule. If you can't do this because the data doesn't exist or the vendor won't provide it by demographic group, you've identified your first compliance gap — and it's one a plaintiff's attorney would love to find.
Reflect
What to think about more deeply
Federal deregulation was meant to reduce the compliance burden on employers. Instead it has produced a state-by-state patchwork that's arguably more expensive and complex to navigate than a single federal standard. Would a coherent national AI hiring framework — even a demanding one — actually be cheaper for business than fifty different ones?