The AI Hiring Rules a Small Staffing Agency Should Know in 2026

Summarizes, in the words of law-firm sources, the NYC, California, Illinois and Colorado AI hiring rules and gives a tool-inventory checklist for counsel.

This is general information drawn from law-firm summaries, not legal advice. Talk to an employment lawyer about your agency.

Two of the most-watched AI hiring rules name staffing and recruiting agencies directly, according to the law-firm summaries below. If your desk uses any AI, the first question is not which state you are in. It is what your tools do.

Start here: does the tool draft, or does it decide?

New York City's law defines an automated employment decision tool as a computational process derived from "machine learning, statistical modeling, data analytics, or artificial intelligence" that is used to "substantially assist or replace discretionary decision making." DLA Piper adds that the city's rules treat a tool as doing so when an employer relies solely on its output, weighs it more heavily than other criteria, or uses it to overrule human judgment (DLA Piper, Jan 2026). Colorado's new law excludes tools "used solely to summarize, organize, translate, draft, route, or present information for human review" (Constangy, Jul 2026).

So sort your tools into two groups:

Drafting tools: submittal write-ups, job ads, outreach drafts, call-note summaries that a recruiter reviews.
Scoring or screening tools: screening interviews that produce scores, match rankings, filters that drop candidates automatically. Bullhorn, for example, describes Amplify's async screening as including scoring (Bullhorn, May 2025, vendor).

The second group is where most of the duties below apply. Not every rule draws the line at scoring, though. Illinois requires notice when AI is used in covered decisions, and Littler describes California's rules as addressing AI tools used to facilitate human decision-making. Put drafting tools on the list for your lawyer too.

New York City: Local Law 144

As DLA Piper describes it (Jan 2026), Local Law 144 "imposes bias evaluation and transparency obligations on employers and employment agencies" that use these tools to screen candidates or evaluate employees for promotion in New York City. It requires:

an annual bias audit by an independent auditor, evaluating potential disparate impact by sex, race or ethnicity using selection and scoring rates and impact ratios
posting a summary of the most recent audit "clearly and conspicuously" on the website, whether maintained by the employer or an employment agency
"clear and timely notice" to New York City candidates that the tool will be used, naming the qualifications and characteristics it assesses and explaining the right to request an alternative selection process or reasonable accommodation
civil penalties of "up to $1,500 per violation per day"

Enforcement has been weak so far, but that may change. A December 2025 New York State Comptroller audit called the city's enforcement "ineffective": 75% of test calls to the 311 hotline about these tools were misrouted, and the city found one compliance issue in 32 posted audits where the Comptroller found at least 17 potential issues (DLA Piper, Jan 2026; audit PDF).

California: automated-decision system regulations

As Littler describes it (Jul 2025), California's Civil Rights Council gave final approval on June 30, 2025, to revisions to Title 2 of the California Code of Regulations, which "take effect on October 1, 2025." Points that matter for an agency:

Automated-decision systems include systems "derived from and/or use artificial intelligence, machine-learning algorithms."
An employment agency is one "undertaking, for compensation, the procurement of job applicants."
An "agent" is narrowed to those who "exercise a function traditionally exercised by the employer."
Record-retention requirements "continue to extend four years."
"Evidence, or lack of evidence, of anti-bias testing or similar proactive efforts" is relevant to claims and defenses.

Illinois: House Bill 3773

As Foley & Lardner describes it (Feb 2025): "Under House Bill 3773, effective January 1, 2026, Illinois will protect prospective and current employees from discriminatory AI practices" across recruitment, hiring, promotion, discharge, discipline, tenure and other terms of employment. Employers "are required to notify employees of the use of AI" at these points, though the amendment "does not provide specific notice requirements." It "also prohibits the use of zip codes as a proxy for protected classes." At the time of writing, Foley said the Illinois Department of Human Rights "will adopt rules to implement and enforce these new standards at an undefined future date."

A later secondary explainer reports that the Department published draft rules in May 2026 and withdrew them in June 2026, with no new timeline, while the law itself stays in force (beancount.io, Sep 2026, secondary).

Foley's summary speaks of employers and does not address agencies specifically. Ask your lawyer how it applies to your desk.

Colorado: a new law from January 1, 2027

Colorado's original 2024 AI Act never took effect as written. Proskauer reports its effective date was pushed to June 30, 2026; xAI sued on April 9, 2026; the US Department of Justice moved to intervene on April 24; and a federal magistrate stayed enforcement on April 27 (Proskauer, May 2026).

Then, as Constangy describes it (Jul 2026), Governor Polis signed Senate Bill 26-189 on May 14, 2026, repealing and replacing the 2024 act. The new law "generally applies to consequential decisions made on or after January 1, 2027." For employers using covered automated decision-making technology:

"clear and conspicuous notice that covered ADMT was or will be used"
an additional disclosure "within 30 days after making the decision" when the outcome is adverse
"the opportunity to correct any factually incorrect or materially inaccurate personal data"
a right to request review, where the reviewer "may not simply default to the automated output"
records kept for at least three years after the decision

Constangy says the law "creates no new private right of action"; the Colorado Attorney General enforces it, and until January 1, 2030, generally must give notice and a 60-day chance to cure, except for knowing or repeated violations. Constangy's summary does not mention a small-business exemption.

Federal

As K&L Gates describes it (Jan 2025), the Equal Employment Opportunity Commission (EEOC) removed its May 2023 AI technical-assistance guidance on January 27, 2025, and the Department of Labor flagged its own AI best-practices documents as possibly outdated. The withdrawn guidance does not change the city and state rules above.

Utah

Our research did not find a Utah statute specific to AI in hiring. If you recruit for jobs or candidates in New York City, California, Illinois or Colorado, ask your lawyer whether those rules reach your desk. Being based in Utah does not settle the question.

A checklist to take to your lawyer

Inventory every tool that touches candidate data: ATS features, add-ons, sourcing tools, notetakers, and any chat app recruiters use.
Mark each one as drafting-only or scoring, ranking or screening.
Note where the candidates and jobs each scoring tool touches are located.
Keep AI in a drafting role where you can, with a named recruiter making each decision.
Draft candidate notice language with counsel for any tool your lawyer says is in scope.
Set a records rule. The summaries above mention four years for California and three for Colorado.
Never filter by zip code. Foley notes Illinois bars zip codes as a proxy for protected classes.
Keep candidate data in tools with business privacy terms, never personal chat accounts.

Lunan's one-page AI-use rule and tool-inventory sheet follows this list; it is a worksheet for your lawyer, not a legal opinion.

The short version

AI that drafts, with a recruiter who decides, is the lowest-friction setup under every rule above, though Illinois-style notice duties may still apply. AI that scores or screens can be worth it, but plan for audits, notices and records before you switch it on.