Employers tracking workplace artificial intelligence (AI) regulations and legislation may know that 2026 has been eventful, but not in a way that simplifies compliance.
Several new state AI laws took effect on January 1, 2026, and state legislatures continue to consider new bills. The federal government, however, continues to push to preempt state regulation of AI, but that effort is slow-moving and faces legal and political headwinds.
What You Need to Know
|
The first half of 2026 brought significant developments in Colorado, Connecticut, and Illinois, and courts issued significant rulings in the pending AI-hiring litigation discussed below. On April 27, 2026, in xAI v. Weiser, the U.S. District Court for the District of Colorado enjoined enforcement of the landmark Colorado Artificial Intelligence Act (CAIA) pending the submission of, and decision on, a preliminary injunction to be submitted jointly by xAI, the U.S. Department of Justice (DOJ), and the Colorado Attorney General. Then, on May 14, 2026, Colorado Governor Jared Polis signed SB 26-189, which repealed and replaced the CAIA with new but more limited requirements for entities using “automated decision-making technology” (ADMT) in “consequential decisions.”
The pace has not slowed since: Colorado opened formal rulemaking in August, California’s “No Robo Bosses Act” has advanced through the legislature, and a bipartisan group in Congress released the first comprehensive federal AI framework.
The bottom line for employers: the patchwork of legislation remains, and it will likely continue to grow and change.
This Insight summarizes the key developments since January 1, 2026, and closes with a practical action list for employers in affected jurisdictions.
The Regulatory Landscape: Recent and Forthcoming State Law Changes
Colorado: The Colorado Artificial Intelligence Act
- The Original Bill: SB 24-205
As originally enacted on May 17, 2024, the CAIA would have imposed multiple obligations on employers that use AI for employment decision-making, including exercising “reasonable care” to protect applicants and employees from known or reasonably foreseeable risks of algorithmic discrimination, conducting risk assessments of such high-risk AI systems, and providing notice to consumers (including employees) when the high-risk AI system will be used to make a “consequential decision” such as a hiring or termination decision.
The CAIA as originally enacted, however, will never be enforced. In August 2025, during a special legislative session convened with the intent to substantially rewrite the original CAIA, the Colorado Legislature delayed the law’s effective date from February 1, 2026, to June 30, 2026. Subsequently, a state AI policy working group convened by Governor Polis released a draft bill that would overhaul the law and push back its effective date to January 1, 2027.
- Related Litigation: xAI v. Weiser
Litigation further blunted the impact of the CAIA. On April 9, 2026, Elon Musk’s xAI filed a complaint in the U.S. District Court for the District of Colorado seeking to enjoin the CAIA before it took effect. The lawsuit alleges the CAIA violates the U.S. Constitution’s First Amendment, Commerce Clause, Fourteenth Amendment, and Equal Protection Clause, and argues that requiring AI systems to avoid “differential treatment or impact” on protected groups effectively compels speech and unconstitutionally embeds the state’s ideological preferences into private AI systems.
On April 24, in a striking alignment of interests, xAI, the DOJ (intervening as a plaintiff for the first time in a state AI case), and Colorado Attorney General Phil Weiser filed a joint motion to suspend proceedings, pointing to the possibility that the Colorado Legislature would replace or amend the law before its June 30 effective date. On April 27, 2026, Chief Judge Daniel D. Domenico granted the motion. The court’s order (1) stayed enforcement of the CAIA pending a ruling on xAI’s forthcoming motion for a preliminary injunction, (2) canceled the June 16 scheduling conference and suspended all case deadlines, and (3) required xAI to file its preliminary injunction motion within 28 days after either the Colorado Attorney General issued final implementing regulations or the legislature passed replacement legislation. Attorney General Weiser agreed separately not to initiate any enforcement action or investigation for CAIA violations until at least 14 days after the court rules on the forthcoming preliminary injunction motion.
- The Revised Bill: SB 26-189
On May 14, 2026, Governor Polis signed SB 26-189 into law, thereby repealing and reenacting the CAIA. SB 26-189, which takes effect January 1, 2027, removes the onerous requirements of risk management programs and annual impact assessments in favor of a more targeted and procedural framework that focuses on notice and disclosure requirements.
On August 11, 2026, the Colorado Department of Labor filed proposed draft rules that would clarify and implement both SB 26-189 and another recently enacted bill, HB 26-1263, the Chatbot Safety Act, which Governor Polis signed on May 29, 2026, and which regulates conversational AI services, including requiring operators to disclose when users are interacting with AI and to implement safeguards for minor users. Stakeholders and interested parties are invited to submit comments via an online comment form through October 26, 2026.
Employers should also monitor the xAI docket closely, particularly once a final rule is adopted. While the enforcement freeze provided temporary relief for Colorado-specific compliance concerns, the litigation remains pending, with the plaintiffs authorized to submit a motion for a preliminary injunction and file an amended complaint within 28 days after final adoption of rulemaking implementing SB 26-189.
California
- CPPA Automated Decision-Making Regulations
In 2025, the California Privacy Protection Agency (CPPA) finalized regulations that govern businesses’ use of AI in significant decisions, including, but not limited to, employment decisions, such as hiring, termination, compensation, and other material terms of employment. These regulations, which impact ADMT, take effect January 1, 2027, but because of the tight compliance timeline, employers should begin preparing now to comply.
In addition, independent of the ADMT regulations under the CPPA, effective October 1, 2025, California instituted modifications to its Fair Employment and Housing Act (FEHA) regulations, which interpret the state’s anti-discrimination law. The modifications apply the FEHA directly to “automated-decision systems” (ADS), defined as computational processes that make or “facilitate” a decision regarding an employment benefit. These modifications further provide that, in investigating or adjudicating AI-related discrimination complaints, agencies may consider evidence of anti-bias testing, or the absence of such testing, as part of the determination of any discrimination allegations.
- “No Robo Bosses Act” (SB 947)
California is once again considering passage of the “No Robo Bosses Act.” In October 2025, Governor Newsom vetoed SB 7 (the original bill) citing overly broad restrictions and notification requirements. On February 2, 2026, State Senator Jerry McNerney reintroduced the No Robo Bosses Act as SB 947 with revisions addressing the governor’s concerns. The new bill would:
- bar employers from relying solely on ADS to fire or discipline workers,
- require human oversight and independent verification for termination and disciplinary decisions,
- prohibit the use of ADS for predictive behavior analysis of workers,
- require post-use notice to workers when ADS is used in termination or disciplinary decisions, and
- apply to independent contractors as well as employees.
The bill would create a private action for workers, and violations would carry a $500 civil penalty per violation, plus the opportunity for plaintiffs to recover punitive damages and attorneys’ fees.
SB 947 has advanced since its introduction. The California Legislature passed the bill at the end of August, and Governor Newsom has until September 30, 2026, to sign or veto it.
Employers should watch this bill closely in the coming weeks. California employers, particularly those with large workforces and existing AI-driven performance management tools, should treat this as a near-term operational risk if SB 947 is enacted.
Connecticut
- SB 5 and Automated Employment Decision Processes
On May 1, 2026, the Connecticut General Assembly passed SB 5. Governor Ned Lamont signed SB 5 into law on May 27, 2026, as Public Act 26-15. SB 5 is broad legislation that addresses the use of AI for employment-related decision-making from hiring to termination, and everything in between. While the most onerous aspects of the new law become operative in 2027, certain provisions of this detailed legislation take effect October 1, 2026, giving Connecticut employers a small window to come into compliance.
As explained here, SB 5 focuses on automated employment-related decision-making technology. The law excludes non-material issues, such as changes in job tasks, work responsibilities, hours, and work assignments, as well as matters concerning workplace health and safety, scheduling, planning, or productivity monitoring. Rather, it regulates decisions based on an individual’s personal data regarding hiring, promotion, discipline, training, or a material change in employment terms, including termination.
To that end, the law requires that, as of October 1, 2026, any employer executing a reduction in force that qualifies as a mass layoff under the federal Worker Adjustment and Retraining Notification (WARN) Act must provide a written notice to the Connecticut Department of Labor disclosing whether the employer’s use of AI or other technology was a contributing factor to the reduction in force. This notice requirement is not limited to disclosing the use of AI or other technology to make layoff selections. It will apply to any mass layoff or plant closing in Connecticut that triggers WARN notices.
Starting October 1, 2027, Connecticut employers that deploy automated employment-related decision technology to directly interact with job applicants or employees must disclose that the individual is interacting with such technology in plain language. The law creates an exception when a “reasonable person would deem it obvious” but does not define this phrase, so employers should exercise caution and provide actual disclosures pending further guidance. Therefore, employers using AI or other such tools should provide job applicants and employees with written notice stating:
- that the employer uses automated employment-related decision technology;
- the purposes for which the employer is using the technology and the nature of the employment-related decision that will be affected by its use;
- the trade name of the particular automated employment-related decision technology;
- the categories of personal data concerning the job applicant or employee that the technology will analyze or process, and how the personal data will be assessed in reaching a decision; and
- the employer’s contact information.
Another provision of SB 5 prohibits relying on the use of automated employment-related decision technology to assert a defense to a discrimination action brought under the Connecticut Fair Employment Practices Act. SB 5 does allow a court to consider evidence of anti-bias testing or “similar proactive efforts to avoid the discriminatory practice.”
While all provisions of SB 5 will be in full effect on October 1, 2027, the legislation includes a grace period through December 31, 2027. Until then, the state’s Attorney General will provide employers with notice and an opportunity to cure alleged violations before initiating a formal enforcement action.
Illinois
- Amendments to the Illinois Human Rights Act
Effective January 1, 2026, Illinois HB 3773 amended the Illinois Human Rights Act (IHRA) to address AI-driven employment decisions directly. The amendment clarifies that the IHRA’s anti-discrimination protections are triggered when discrimination flows from an employer’s use of AI in decisions about hiring, firing, discipline, tenure, and training. Importantly, the law imposes an affirmative notification obligation: employers must inform employees and applicants when using AI to make any of those decisions. Failure to provide notice, even absent a discriminatory outcome, constitutes a compliance gap that plaintiffs’ counsel may seek to exploit.
The scope of the notice required remains unsettled. On May 15, 2026, the Illinois Department of Human Rights (IDHR) issued a Notice of Proposed Amendments to introduce proposed regulations that would govern the type and method of notice required by the law. As detailed here, any time an employer uses AI to influence or facilitate a covered employment decision, the proposed regulations would have required the employer to identify the product, developer, the employment decision impacted, the purpose of using AI in the employment decision, the categories of personal data collected, and the type of job positions for which the AI will be used. On June 2, 2026, however, the IDHR withdrew these proposed regulations and canceled a public hearing that had been scheduled to discuss them. As the IDHR has not published a rescheduled rulemaking timeline or a second draft of the proposed regulations, the withdrawn regulations currently offer the best roadmap for employers to comply with the notice requirements of the law.
Texas
- The Texas Responsible Artificial Intelligence Governance Act
Also effective January 1, 2026, the Texas Responsible Artificial Intelligence Governance Act (TRAIGA) prohibits Texas employers from using AI tools in employment decisions with the intent to discriminate against members of protected classes. Unlike Illinois and Colorado, however, TRAIGA does not impose liability based solely on disparate impact or unintentional discrimination; a plaintiff must show discriminatory intent. This meaningful distinction could affect how employers in Texas approach AI governance documentation and vendor due diligence.
The Federal Counterweights
Executive Order 14365 and the National Policy Framework
The federal government has been active in response to state regulation, but its practical impact on employers remains limited, for now.
On December 11, 2025, President Trump signed Executive Order (EO) 14365, “Ensuring a National Policy Framework for Artificial Intelligence.” EO 14365 identified “excessive state regulation” as an obstacle to U.S. AI leadership and set in motion a multi-agency effort to challenge, preempt, or defund state AI laws this administration views as burdensome. On January 9, 2026, the U.S. Attorney General formally established an AI Litigation Task Force, but, as of the date of this Insight, the Task Force has not initiated litigation against any state AI law.
On March 20, 2026, the White House released its National Policy Framework for Artificial Intelligence (“Framework”)—a four-page set of legislative recommendations to Congress. The Framework is not binding law. The central policy objective seeks broad federal preemption of state AI laws that “impose undue burdens,” while preserving certain baseline state powers (consumer protection, child safety, generally applicable laws). The Framework covers seven policy areas, including child protection, free speech, innovation, AI infrastructure, intellectual property, workforce preparation, and preemption. The administration has signaled it wants Congress to act in 2026, but near-term comprehensive federal legislation remains uncertain, if not unlikely.
Congressional Action: The Great American Artificial Intelligence Act
On June 4, 2026, Representatives Jay Obernolte (R-CA) and Lori Trahan (D-MA) released a 269-page bipartisan discussion draft of the Great American Artificial Intelligence Act of 2026 (GAAIA), the most comprehensive federal AI framework proposed to date. The draft has not been formally introduced; its sponsors released it to solicit feedback before introduction. GAAIA is organized into four titles: (1) Frontier AI Governance, (2) Workforce, (3) Cybersecurity, and (4) Research, Development, and International Cooperation. The bill would impose binding disclosure, third-party audit, and whistleblower-protection obligations on “large frontier developers” (companies with $500 million or more in annual revenue that have trained a frontier AI model).
Notably for employers, GAAIA’s preemption provision is narrower than earlier federal proposals: it would bar states from enacting or enforcing laws “specifically regulating the development” of AI models for three years but would preserve state authority to regulate the use of AI systems in specific contexts, including employment. Existing employment-focused AI laws in California, Colorado, Connecticut, and Illinois, as well as New York City’s Local Law 144 of 2021 (titled “Automated Employment Decision Tools”), most likely would remain intact even if GAAIA were enacted as drafted. The bill’s Workforce title also includes a provision directly relevant to employers: it would require additional disclosures under the WARN Act when AI is a “substantial factor” in a covered mass layoff, echoing the approach Connecticut adopted in SB 5, discussed above. The draft has drawn both bipartisan co-sponsorship and criticism, and its ultimate scope and prospects for passage remain uncertain.
In practice, employers must recognize that the federal government remains committed to deregulating in the AI space, but its efforts have not significantly impacted the state legal and regulatory landscape. Until Congress acts or courts strike down specific state statutes, existing state obligations remain in force. Employers that delay compliance in anticipation of federal preemption may face consequences at the state or local level.
Key Litigation Updates
- Mobley v. Workday, Inc., No. 3:23-cv-00770 (N.D. Cal.)
This flagship AI hiring bias case has continued to generate significant rulings in early 2026. Filed in February 2023 in the U.S. District Court for the Northern District of California, the plaintiff in Mobley alleged that Workday’s AI-powered applicant screening tools, which purportedly rank and score candidates, discriminate against job applicants on the basis of race, age, and disability in violation of Title VII of the Civil Rights Act of 1964, the Age Discrimination in Employment Act (ADEA), and the Americans with Disabilities Act (ADA). The central theory—that Workday itself is directly liable as an “agent” of the employers using its tools, rather than merely a software provider—survived a motion to dismiss in July 2024. The practical stakes are substantial: Workday serves more than 11,500 global clients, including more than 60 percent of the Fortune 500.
In May 2025, Judge Rita Lin granted preliminary certification of a nationwide collective action on the age discrimination claim, opening the opt-in period for similarly situated applicants. The case then moved to the next major legal dispute: whether the ADEA’s disparate impact protections extend to job applicants at all.
On March 6, 2026, Judge Lin rejected Workday’s argument that the ADEA’s disparate impact prohibitions do not extend to job applicants. Workday had contended that Congress’s unsuccessful attempts to amend the ADEA to expressly cover applicants meant the statute did not reach them and that the U.S. Supreme Court’s Loper Bright decision eliminating Chevron deference meant the U.S. Equal Employment Opportunity Commission’s (EEOC’s) contrary interpretation no longer carried weight. Judge Lin rejected both arguments. She did, however, grant Workday’s motion as to certain California state law claims and one individual plaintiff’s disability discrimination claim. The plaintiffs filed an amended complaint on March 30, 2026, reasserting those claims with additional factual allegations to cure the identified deficiencies.
The parties are now engaged in discovery. In a discovery dispute decided May 28, 2026, Magistrate Judge Laurel Beeler held that certain AI bias-testing data Workday prepared at counsel’s direction may be shielded from discovery by the attorney-client privilege, while the underlying factual data about the tools’ performance remains discoverable. The ruling offers employers and vendors some protection for bias audits conducted through counsel but underscores that privilege has limits: the data used to build and evaluate an AI hiring tool is not automatically protected merely because a bias study was performed.
On June 22, 2026, Judge Lin largely denied Workday’s motion to dismiss the Third Amended Complaint. Most significantly, the court held that California’s FEHA may reach Workday’s screening tools even as applied to applicants for jobs located outside California. The court found that plaintiffs adequately alleged that Workday designs, develops, and operates the challenged tools from its California headquarters. The court also allowed one plaintiff’s ADA claim to proceed, based on allegations that the tools treat employment-history gaps correlated with medical leave as a disability proxy. The FEHA ruling, if it survives further review, has implications well beyond Workday: it suggests that a vendor’s California nexus for developing an AI tool, not merely the location of the affected applicant or employee, may be sufficient to trigger California law, a theory multistate employers using California-based AI vendors should watch closely.
The employer-facing lesson from the court’s decisions in the case so far is clear: any AI tool that scores, ranks, or filters applicants—rather than merely implementing rote, employer-defined knockout criteria—may expose both the vendor and the employer-deployer to discrimination liability under federal civil rights statutes.
- Kistler, et al. v. Eightfold AI Inc., No. 3:26-cv-01768 (N.D. Cal.)
Filed January 20, 2026, Kistler raises a different and novel theory of AI hiring liability—one that does not depend on proving algorithmic bias. The plaintiffs allege that Eightfold acts as a consumer reporting agency (CRA) and, therefore, must comply with the Fair Credit Reporting Act (FCRA).
Two California-based job applicants, Erin Kistler and Sruti Bhaumik, allege that Eightfold’s hiring platform secretly assembled extensive personal data on applicants—including social media profiles, location data, internet and device activity—and used it to generate a “likelihood of success” score on a 0-to-5 scale for employer-clients. The suit alleges that this process constitutes the operation of an unregistered CRA in violation of the FCRA and California’s Investigative Consumer Reporting Agencies Act (ICRAA). The case was brought by former EEOC Chair Jenny Yang, now in private practice, and the nonprofit Towards Justice.
The plaintiffs’ FCRA theory is notable because it sidesteps the discrimination framework entirely. It requires only a showing that Eightfold compiled “consumer reports” without following the FCRA’s mandatory disclosure, authorization, adverse action notice, and dispute-correction procedures, obligations that have applied to consumer reporting agencies since 1970. The threshold legal questions the court will need to resolve are as follows: (1) whether Eightfold qualifies as a “consumer reporting agency” under the statute, (2) whether its AI-generated scores constitute “consumer reports” subject to FCRA coverage, and (3) whether the FCRA’s exemption for information “solely as to transactions or experiences between the consumer and the person making the report” applies.
The Consumer Financial Protection Bureau issued guidance in 2024 stating that the FCRA covers algorithmic employment scores, but the Trump administration rescinded that guidance in 2025. Rescinding guidance, however, does not change the statute, and the case will turn on the court’s interpretation of the FCRA.
Initially filed in Contra Costa County Superior Court, Eightfold removed the case to the Northern District of California. Eightfold denies the allegations, stating its platform “operates on data intentionally shared by candidates or provided by our customers.” Employers whose vendor agreements cap liability for subscription fees while disclaiming compliance warranties should pay close attention: while the current lawsuit targets only Eightfold, employer-users of its platform may be drawn in as the litigation develops, particularly if the court holds that FCRA obligations were triggered by Eightfold’s scoring of candidates for those employers’ job openings.
Eightfold’s motion to dismiss, which argued, among other things, that its Match Score is not a “consumer report” and that Eightfold is not a “consumer reporting agency” under the FCRA, was fully briefed by July 9, 2026, and Judge Yvonne Gonzalez Rogers heard oral arguments on August 4, 2026. As of the date of this Insight, the court has not yet ruled. Employers using vendor-generated applicant scores should continue to monitor this case, as a ruling for the plaintiffs would create a significant new compliance track, separate from bias-based discrimination theories, for any AI tool that compiles applicant data from third-party sources.
Practical Action List: What Employers Should Do Now
Against this kaleidoscopic backdrop, we recommend that employers—both those operating in regulated jurisdictions today and those preparing for legislation elsewhere—consider taking the following steps:
- Conduct an AI tool inventory. Identify every AI or automated decision-making system currently used in employment-related decisions—hiring, screening, compensation, performance management, discipline, and termination. Map each tool to the jurisdictions in which the company uses it. Do not overlook vendor-supplied tools embedded in human resources (HR) platforms; the laws apply to both developers and deployers.
- Conduct a jurisdictional compliance gap analysis. For each AI tool identified, assess what obligations apply in light of the changes discussed above, such as in California (ADMT regulations’ notice and risk assessment), Colorado (notice and disclosure), Illinois (notice and anti-discrimination), and Texas (intent-focused anti-discrimination), as well as other laws already in effect, such as New York City Local Law 144 (notice and bias audits). Flag any compliance gaps and prioritize remediation.
- Develop and implement employee/applicant notification protocols. New York City and Illinois, for instance, require notice when AI is used in covered employment decisions. Develop template notices for each jurisdiction, integrate them into your hiring workflows and HR processes, and train HR personnel on when and how notices must be delivered. This is not merely a legal formality; documented, timely notice is likely to be among the first items a regulator or plaintiff’s counsel requests.
- Conduct or update algorithmic impact assessments. If it becomes effective, the CAIA will require deployers of high-risk AI systems to conduct documented impact assessments. Even where not yet legally required, impact assessments are the foundation of a defensible AI governance posture. Assess each high-risk tool for potential disparate impact on protected classes and document the methodology and findings.
- Review and update vendor contracts. Many employers deploy AI through third-party HR technology vendors. Review vendor agreements to confirm (1) what representations the vendor makes about bias testing and compliance, (2) whether the vendor agrees to cooperate with bias audits, (3) what data the vendor retains and for how long, and (4) how liability for discriminatory outcomes is allocated. Be aware that silence in vendor contracts is itself a compliance risk.
- Preserve human decision-making checkpoints. California’s SB 947, if enacted, and the emerging federal proposals would all require meaningful human involvement in AI-assisted termination and disciplinary decisions. Begin now to ensure that your AI-assisted decision processes include human review checkpoints and that those reviews are documented. Do not allow AI recommendations to become rubber stamps.
- Address remote hiring exposure. Employers recruiting and hiring in California, Colorado, Illinois, or New York City—even if they are not physically located there—may be subject to those jurisdictions’ AI laws. Audit your recruiting footprint and ensure compliance in every jurisdiction in which candidates reside.
- Prepare for California’s automated decision-making rules. The CPPA regulations, effective January 1, 2027, will require opt-out rights (or documented reasons for exception) and enhanced disclosures when automated technologies replace human decision-making in employment decisions. Begin preparing for the January 2027 deadline well in advance.
- Monitor xAI v. Weiser and the Colorado rulemaking process, as well as the broader federal preemption landscape. As described above, the xAI case remains stayed while the Colorado Attorney General completes rulemaking (comments due October 26, 2026). xAI’s preliminary injunction motion is not due until 28 days after final rules are adopted. If your company is located in or recruiting in Colorado, continue compliance preparation in order to move quickly once final rules issue or the litigation resumes. More broadly, the DOJ’s intervention in this case represents the Trump administration’s first litigation step to limit state AI regulation, and the outcome could influence the trajectory of AI employment law across many other states. Also track the GAAIA discussion draft in Congress, mentioned above, and build flexibility into your AI governance framework.
- Develop and maintain an AI governance policy. Adopt a formal, written AI governance policy covering what tools may be used in employment decisions, how those tools must be vetted and monitored, what documentation must be maintained, and who is accountable. Review the policy at least annually and whenever a new AI tool is deployed or a relevant law takes effect.
The available tools and the regulatory landscape for workplace AI continue to rapidly change. Moreover, the tension between an assertive state-law patchwork and a federal deregulatory push likely will not be resolved in the near term. But employers that build robust, documented AI governance programs now will be better positioned to both adapt as the landscape evolves and defend against the discrimination claims, regulatory investigations, and litigation that will inevitably follow in this space.
* * * *
For additional information about the issues discussed in this Insight, or for assistance with compliance assessments, vendor contract review, impact assessment design, or governance policy development, please contact the attorney(s) listed on this page or the Epstein Becker Green Employment, Labor & Workforce Management attorney who regularly handles your legal matters.
Staff Attorney Elizabeth A. Ledkovsky contributed to the preparation of this Insight.
