The AI hiring rules everyone braced for got delayed. The one that didn't is the boring one.

You applied for a job. A person never saw your résumé. Software read it, scored it, and put you in a pile.

That is now the default rather than the exception. And in a small but growing number of places, the employer is legally required to tell you it happened.

If you run hiring — especially across state or national borders — 2026 was supposed to be the year this got complicated. It did, but not in the direction almost anyone predicted.

How AI hiring tools create compliance risk in 2026

2:00

The rules everyone prepared for moved

For two years the message to employers was that sweeping AI regulation was arriving and that recruiting tools would be near the top of the list. Companies budgeted for bias audits, risk assessments, and documentation programmes. Then most of it slipped.

The European Union classifies AI used for recruitment, selection, promotion, termination, task allocation, and performance monitoring as high-risk — the strictest tier short of outright prohibition. Those obligations were scheduled to apply from 2 August 2026. Under the Digital Omnibus, approved by the Council in June 2026, the standalone high-risk deadline moved to 2 December 2027 — a sixteen-month deferral. The stated reason is practical rather than political: the harmonised technical standards employers would need in order to *demonstrate* compliance were not finished.

Colorado went further. Its AI Act, SB 24-205, was the first comprehensive US state AI law, originally due to take effect on 1 February 2026. It was pushed to 30 June 2026, and then pushed again to 1 January 2027 and substantially rewritten. The rewrite removed the duty of care to avoid algorithmic discrimination, the deployer risk-management programme requirement, the impact-assessment requirement, and the attorney-general reporting requirement.

What survived in Colorado is disclosure: telling people when an automated system materially influenced a consequential decision about them, providing a route to human review, and retaining records. Enforcement sits with the attorney general alone. There is no private right of action.

Read those two together and a pattern emerges. Regulators did not abandon AI hiring rules. They retreated to the part that is cheap to write, cheap to enforce, and hard to argue with: telling people.

The rule that is live right now

Illinois amended its Human Rights Act through HB 3773, effective 1 January 2026. Employers must notify applicants and employees when AI is used in covered employment decisions, and may not use ZIP codes as a proxy for protected characteristics. The statutory duty is in force — though the Illinois Department of Human Rights withdrew its proposed implementing rules and cancelled the associated hearing, which leaves the shape of a compliant notice unsettled while the obligation itself is not.

New York City has been here since the beginning. Local Law 144 took effect on 1 January 2023 and has been enforced since 5 July 2023. If an automated employment decision tool substantially assists or replaces a human decision to advance or reject a candidate, the employer must commission a bias audit within the prior twelve months, publish a summary of it, and notify candidates at least ten business days before use.

The part that catches people

This is the structural feature worth internalising, because it is not unique to New York and it is spreading. Employment rules increasingly attach to the worker's location. Distributed hiring means distributed exposure — you inherit the obligations of every jurisdiction you hire into, whether or not you knew you were hiring into it.

Almost nobody complies, and that is about to matter

Compliance with Local Law 144 has been poor since day one. A Cornell University study recruited 155 student investigators to check employer compliance, spending up to thirty minutes per employer — roughly what a motivated job seeker might invest. Across 391 employers, they found 18 that had posted the required bias audit results and 13 that had posted a transparency notice. Data was collected between 24 October and 9 November 2023.

The enforcement side was no better. In December 2025 the New York State Comptroller published an audit of how the NYC Department of Consumer and Worker Protection had enforced the law between July 2023 and June 2025. DCWP had surveyed the websites and bias audits of 32 companies and identified a single instance of non-compliance. The Comptroller's auditors reviewed the same companies and identified at least 17 instances of potential non-compliance.

DCWP had argued the law was structurally hard to police: the posting obligation only triggers if an employer concludes it must comply, which makes silent non-compliance nearly invisible. Following the audit, the agency agreed to adopt most of the Comptroller's recommendations and to move away from purely complaint-driven enforcement toward proactive review.

Penalties are modest per instance and unbounded in aggregate: up to $500 for a first violation and $500–$1,500 for each subsequent one, with each day a tool is used without a valid audit counting separately, and each failure to give notice counting separately.

A rule that went under-enforced for two years, attached to a compliance rate in the single digits, whose regulator has just publicly committed to going and looking, is not a rule to be casually behind on.

What this actually means operationally

The picture heading into 2027 is not "AI hiring is regulated" or "AI hiring is unregulated." It is fragmentation.

• Different obligations in different places.
• On different timelines, several of which have already moved more than once.
• Some substantially rewritten between announcement and effect.
• Triggered by where your candidate lives rather than where you are.

Nobody hiring in more than one jurisdiction can hold that in their head, and it will not stop moving. That is an infrastructure problem rather than a policy-reading problem — the same category as payroll tax or worker classification. Something has to track which rules attach to which worker in which place, and update when they change.