Two dates carry most of the work for hiring teams in 2027. California’s rules on automated decisionmaking technology (ADMT) reach their compliance date on January 1, and Colorado’s SB26-189 takes effect the same day. The EU AI Act’s high-risk rules for AI used in recruitment and worker management apply from December 2. The EU date is adopted law. Regulation (EU) 2026/1744 was published in the Official Journal on July 24, 2026. It moved the date from August 2, 2026. Colorado’s SB26-189 is signed law and reaches employment decisions, because the signed act lists “employment or an employment opportunity” as a covered domain. The Attorney General’s rules are still drafts. Status is as of October 27 and 28, 2026.
All 16 dates on this pageIn date order, each with who it affects, what to do and the source
July 2023Passed1 change
New York City automated employment tool law enforcement begins
New York City's Department of Consumer and Worker Protection began enforcing Local Law 144 on automated employment decision tools on July 5, 2023. The law covers a computer-based tool that uses machine learning, statistical modeling, data analytics or AI and substantially assists or replaces discretionary decision-making. The tool needs a bias audit within the past year, and candidates who live in the city get notice.
- Who
- Employers and employment agencies that use an automated employment decision tool (AEDT) for jobs located in New York City, including fully remote jobs tied to an NYC office
- Do
- Check whether each tool substantially assists or replaces discretionary decision-making. If it does, confirm it had a bias audit within the past year and give notice 10 business days before use.
February 2025Passed1 change
AI Act general provisions and prohibitions apply
The Commission timeline says the AI Act's general provisions (definitions and AI literacy) and its prohibitions apply from this date.
- Who
- Providers and deployers of AI systems in the EU
- Do
- Check each HR tool against the AI Act's list of prohibited practices before you buy or renew it.
October 2025Passed1 change
California automated-decision system regulations take effect
California Civil Rights Council regulations make clear that using an automated-decision system may violate California law if it harms applicants or employees based on protected characteristics, such as gender, race, or disability. Employers and covered entities must keep employment records, including automated-decision data, for at least four years.
- Who
- California employers and covered entities that use automated-decision systems in employment
- Do
- Review automated-decision tools used for applicants and employees, and keep employment records, including automated-decision data, for at least four years.
January 2026Passed3 changes
California CPPA regulations on automated decisionmaking take effect
California Privacy Protection Agency regulations on automated decisionmaking technology (ADMT), risk assessments and cybersecurity audits took effect January 1, 2026. ADMT duties for significant decisions start later.
- Who
- Businesses subject to the California Consumer Privacy Act
- Do
- Start mapping the automated tools you use for hiring, pay and termination decisions ahead of the January 1, 2027 ADMT compliance date.
Ontario job posting AI disclosure begins
Ontario's job posting rules under the Employment Standards Act began January 1, 2026. If an employer uses artificial intelligence to screen, assess or select applicants for a publicly advertised job posting, it must disclose that use in the posting.
- Who
- Ontario employers with 25 or more employees that publicly advertise jobs
- Do
- Add the AI statement to Ontario job postings where AI is used to screen, assess or select applicants (also when a third party does it for the employer).
Texas AI governance act takes effect
Texas HB 149, the Texas Responsible Artificial Intelligence Governance Act, took effect January 1, 2026. It bars developing or deploying an AI system with the intent to unlawfully discriminate against a protected class, and says disparate impact alone does not show intent. The Act defines consumer to exclude an individual acting in a commercial or employment context, and its text does not mention employers or hiring.
- Who
- Persons covered by Section 551.002, which includes those who conduct business in Texas or develop or deploy an AI system in Texas
- Do
- Document the intended purpose of each AI tool used in HR. The ban turns on intent to unlawfully discriminate.
February 2026Passed1 change
UK automated decision-making rules in force
Section 80 of the Data (Use and Access) Act 2025 replaces UK GDPR Article 22 with new Articles 22A to 22D on automated decision-making. The legislation.gov.uk page shows section 80 in force on February 5, 2026. A saving provision in SI 2026/82 leaves earlier decisions under the old safeguards.
- Who
- UK controllers that take decisions about data subjects
- Do
- Check whether any tool takes significant decisions about staff or applicants based solely on automated processing, then apply the safeguards in Articles 22B and 22C.
May 2026Passed1 change
Colorado signs SB26-189 to replace its AI Act
Colorado Senate Bill 26-189 was signed on May 14, 2026, the date on the General Assembly's Signed Act. The Attorney General says it repeals and reenacts the earlier SB24-205 provisions on automated decision-making.
- Who
- Developers and deployers of automated decision-making technology in Colorado
- Do
- Treat SB26-189 as the operative Colorado law and update plans built on the SB24-205 timeline.
July 2026Passed1 change
Digital Omnibus on AI enters into force
Regulation (EU) 2026/1744, dated July 8, 2026 and published in the Official Journal on July 24, 2026, amends the AI Act and moves the high-risk start dates to December 2027 and August 2028. Recital 46 states that it should enter into force on the third day after publication, and EUR-Lex lists July 27, 2026. It is adopted law, not a proposal.
- Who
- Providers and deployers of high-risk AI systems in the EU, including employers using hiring AI
- Do
- Plan high-risk compliance for employment AI around December 2, 2027, and recheck the Annex III date before each deadline.
October 2026Passed1 deadline
Colorado Attorney General hearing on proposed ADMT rules
The Colorado Attorney General's page, modified October 27, 2026, says a public formal rulemaking hearing took place on October 26, 2026 on the ADMT rules and that it considers comments received on or before 11:59 p.m. MST that day. The signed act directs the Attorney General to adopt rules on post-adverse-outcome disclosures and consumer rights on or before January 1, 2027. No adopted or final rules are posted as of October 28, 2026.
- Who
- Developers and deployers of ADMT used to materially influence a consequential decision in Colorado
- Do
- Read the interim draft rules of October 6, 2026 now, and recheck the Attorney General's page for the adopted version before January 1, 2027.
December 2026In 34 days2 changes
AI Act adds bans on sexual deepfakes and abuse material
New AI Act prohibitions on AI systems that generate non-consensual sexual deepfakes and child sexual abuse material start to apply.
- Who
- Providers and deployers of AI systems in the EU
- Do
- Check that no AI tool used in the organization can generate this content, and ask vendors to confirm.
Australia automated decision transparency obligation starts
Changes to privacy obligations for APP entities come into effect on December 10, 2026. The OAIC fact sheet covers decisions that could reasonably be expected to significantly affect an individual's rights or interests.
- Who
- Australian Privacy Principles (APP) entities that use computer programs in decisions affecting individuals
- Do
- Identify AI tools that rank staff or support employment decisions, and update the privacy policy before December 10, 2026.
January 2027In 64 days2 changes
California ADMT compliance date for significant decisions
Businesses that use ADMT to make significant decisions must comply with the CPPA's ADMT requirements beginning January 1, 2027.
- Who
- Businesses covered by the CCPA that use ADMT to make significant decisions
- Do
- Map hiring, pay, promotion and termination tools that replace human decisionmaking, then draft the pre-use notice that section 7220 requires.
Colorado automated decision-making law takes effect
Colorado's SB26-189 became law in May 2026 and takes effect January 1, 2027, except provisions that took effect on passage, including three rulemaking subsections. It sets requirements for developers and deployers of automated decision-making technology (ADMT) used to materially influence a consequential decision. The signed act lists employment or an employment opportunity as a covered domain, defines consumer to include an employee and a job applicant who is a Colorado resident, and applies to consequential decisions made on or after January 1, 2027. No employer size exemption appears in the act's text.
- Who
- Developers and deployers of ADMT used to materially influence a consequential decision
- Do
- Check whether any tool you use for hiring or other employment decisions is ADMT under the Act. Read the Attorney General's final rules before January 1, 2027, once they are posted.
December 2027In 399 days1 change
AI Act high-risk rules apply to employment systems
Regulation (EU) 2026/1744 sets December 2, 2027 as the date from which the high-risk rules apply to AI systems classified as high-risk under Article 6(2) and Annex III. The date was August 2, 2026 before the Omnibus.
- Who
- Providers and deployers of AI systems used for recruitment, selection or worker management that are classified as high-risk under Annex III
- Do
- Work back from December 2, 2027: list hiring and worker-management AI, assign trained human oversight, keep logs for at least six months where you control them unless other Union or national law provides otherwise, and inform workers before use.
August 2028In 643 days1 change
AI Act high-risk rules apply to AI in regulated products
The Commission timeline lists August 2, 2028 as the date the rules for high-risk AI embedded in regulated products covered by Annex I apply.
- Who
- Providers and deployers of high-risk AI embedded in regulated products covered by Annex I
- Do
- Ask suppliers of regulated equipment whether embedded AI falls under Annex I.
What each rule covers
| Rule | Covered employers and tools | Decisions covered | Status |
|---|---|---|---|
| EU AI Act, Annex III, as amended by Regulation (EU) 2026/1744 | Providers and deployers of high-risk AI systems. A deployer is a person or body using an AI system under its authority | Recruitment or selection of people (targeted job advertisements, filtering applications, evaluating candidates), and decisions on the terms of work relationships, promotion or termination, task allocation by behavior or traits, and performance monitoring | Enacted. Applies from December 2, 2027 |
| California Privacy Protection Agency, ADMT regulations | Businesses covered by the CCPA that use ADMT: technology that processes personal information and uses computation to replace or substantially replace human decisionmaking | Hiring, allocating or assigning work for employees, pay, promotion, and demotion, suspension and termination | Enacted. Comply from January 1, 2027 |
| Colorado SB26-189 | Developers and deployers of ADMT used to materially influence a consequential decision | Employment is a covered domain in the signed act (employment or an employment opportunity). No employer size exemption appears in the act | Enacted, effective January 1, 2027. The Attorney General’s rules are proposed |
| California Civil Rights Council regulations | Employers and covered entities using automated-decision systems | Use that may violate California law if it harms applicants or employees based on protected characteristics. Employment records, including automated-decision data, are kept at least four years | In force since October 1, 2025 |
| New York City Local Law 144 | Employers and employment agencies using an automated employment decision tool (AEDT): a process derived from machine learning, statistical modeling, data analytics or AI that issues a simplified output used to substantially assist or replace discretionary decision making. DCWP covers jobs located in the city, including fully remote jobs tied to an NYC office | Screening candidates for employment or employees for promotion within the city. A bias audit within one year before use, notice 10 business days before use to candidates and employees who live in the city, and a penalty of up to $500 for a first violation and $500 to $1,500 for later ones | In force. The law text says January 1, 2023, and DCWP enforcement began July 5, 2023 |
| Texas HB 149 | Persons covered by Section 551.002, which includes those who conduct business in Texas or develop or deploy an AI system there | An AI system built or used with intent to unlawfully discriminate against a protected class. Disparate impact alone does not show intent. The Act’s definition of consumer excludes an individual acting in a commercial or employment context, and we found no mention of hiring | In force since January 1, 2026 |
| Ontario Employment Standards Act | Employers with 25 or more employees that advertise externally. Postings limited to current staff, or for work outside Ontario, are excluded | AI used to screen, assess or select applicants must be disclosed in the posting. No detailed description of the system is needed | In force since January 1, 2026 |
| UK GDPR Articles 22A to 22D | Controllers taking decisions about data subjects | A legal effect or a similarly significant effect, from a decision based solely on automated processing, meaning no meaningful human involvement. Safeguards cover information, representations, human intervention and contesting the decision | In force since February 5, 2026. A saving provision leaves earlier decisions under the old safeguards |
| Australia, Privacy Act APP 1.7 to 1.9 | APP entities that use personal information in a computer program’s decisions | Decisions that could reasonably be expected to significantly affect an individual’s rights or interests. The fact sheet lists recruitment software that sorts candidate profiles and makes hiring decisions, and AI that ranks employee performance | Enacted. Applies from December 10, 2026 |
Using a vendor’s tool does not move the duty. Ontario says its disclosure rule “applies equally where the employer engages a third party.” Colorado’s draft rules give an example where the employer is the deployer because it retained a staffing company to generate an ADMT output. Put the duties into your vendor terms with the contract update checklist.
The EU delay is adopted law
The Omnibus is Regulation (EU) 2026/1744, which carries the date July 8, 2026. Recital 46 states that it should enter into force on the third day after publication. EUR-Lex lists July 27, 2026 as the date of entry into force, and the Commission’s consolidated Article 113 is dated as at July 27, 2026. The Parliament’s Legislative Observatory shows a Parliament vote on June 16 and Council adoption on June 29. Other official pages differ. A Parliament research page dated October 21 gives May 29 as the adoption date, and the Commission’s framework page, with no update date, still calls the Omnibus a proposal. Use the Official Journal dates.
Article 113 as amended applies the high-risk requirements from December 2, 2027 to systems classified under Article 6(2) and Annex III. Article 26 sits in Chapter III, Section 3, which Article 113 dates the same way. It tells a deployer to follow the instructions for use and to assign human oversight to people with the necessary competence, training and authority. Unless other Union or national law provides otherwise, logs the system generates must be kept for at least six months to the extent they are under the deployer’s control. An employer must inform workers’ representatives and the affected workers before using a high-risk system at the workplace. Because Article 26 ties your duties to the provider’s instructions for use, ask each vendor now when it will supply them.
Article 5(1)(f) has banned AI that infers emotions of a person in the workplace since February 2, 2025, with an exception for medical or safety reasons.
California’s ADMT rules start January 1, 2027
Under the Privacy Protection Agency’s regulations, businesses that use ADMT to make significant decisions must comply from January 1, 2027. A business that starts using ADMT for these decisions on or after that date must comply from its first use. The regulation treats a decision as made without human involvement unless a reviewer knows how to interpret the output, reviews it with other relevant information, and has authority to make or change the decision. A recruiter who sees a score but cannot change the outcome may not count as a human reviewer. Test your screening workflow against those three conditions.
A business that uses ADMT as section 7200(a) describes must give consumers a Pre-use Notice under section 7220. The Agency says the rules implement a consumer right to opt out of ADMT, and its statement of reasons refers to opt-out exceptions for hiring decisions. Section 7221(b)(2) removes the opt-out duty for hiring decisions when two conditions hold: the business uses the ADMT solely to assess whether the person can perform the work, to decide whether to hire them; and the ADMT works for the business’s purpose and does not unlawfully discriminate based on protected characteristics. An appeal to a human reviewer with authority to overturn the decision is a separate route under section 7221(b)(1).
Colorado’s act covers hiring, and the rules are still drafts
The General Assembly’s bill page lists a Signed Act dated May 14, 2026 with the status “Became Law.” The act takes effect January 1, 2027, except provisions that take effect on passage, including three rulemaking subsections. It applies to consequential decisions made on or after that date.
The signed act defines one covered domain as “employment or an employment opportunity that creates or may create an employer-employee relationship.” It defines consumer to include an employee and a job applicant who is a Colorado resident. No employer size exemption appears in the act’s text. Section 6-1-1708 exempts HIPAA covered entities, “except for a consequential decision related to employment or an employment opportunity.” The Attorney General’s interim draft rules of October 6, 2026 treat a hiring manager choosing among internal applicants as a consequential decision because it relates to “selection for an employment opportunity, which falls within a covered domain.”
The signed act requires a deployer to give a clear and conspicuous notice before using a covered ADMT to materially influence a consequential decision, and a prominent public notice at points of interaction complies. After an adverse outcome a further notice is due within 30 days. Only the Attorney General enforces the act, and a violation is a deceptive trade practice. The act gives 60 days to cure after a notice of violation “if a cure is deemed possible,” and the cure provision is repealed effective January 1, 2030. It creates no private right of action.
The signed act directs the Attorney General to adopt rules on post-adverse-outcome disclosures and the consumer-rights section on or before January 1, 2027. The Attorney General’s page says a public formal rulemaking hearing took place on October 26, 2026, and that it considers comments received on or before 11:59 p.m. MST that day. The page, modified October 27, posts no adopted or final rules as of October 28, 2026. Inventory every tool that screens or ranks candidates or employees in Colorado now, and read the final rules the week they appear.
Federal pressure on state laws
Executive Order 14365, signed December 11, 2025, directs the Attorney General to set up an AI Litigation Task Force to challenge state AI laws. It names a Colorado law banning “algorithmic discrimination” in its purpose section. On July 7, 2026 the FTC published a proposed policy statement, with comments due July 31. It says Colorado “has since materially revised the law” but “the new version poses many of the same concerns.” We found no final version. Neither document amends Colorado’s statute or its date. Plan to the statute until a court or Congress says otherwise.
What we could not confirm
- Colorado: the Attorney General’s final rules. The October 26, 2026 hearing has happened, but no final rules are posted as of October 28, 2026. The absence of an employer size exemption is read from the act’s text, so confirm it against the full act.
- Illinois: no date is listed because no state source for such a rule is confirmed here. The Department of Human Rights’ legislative updates page mentions “regulations on artificial intelligence in employment” without a date or text. The Department’s rules and regulations page, modified June 16, 2026, lists no part on artificial intelligence.
- California: whether promotion and termination decisions have a section 7221(b) exception apart from human appeal. Section 7221(b) has exceptions for human appeal, hiring, and work allocation and compensation.
- New York City: whether the law has been amended. The enforcement page shows no update date.
- Australia: whether the Privacy Act’s employee records exemption affects hiring decisions. The fact sheet does not mention it.
- Other jurisdictions: the table lists only the rules above, and a missing jurisdiction is not a finding that it has no rule.
Your 2027 plan, date by date
- December 10, 2026: if you are an Australian APP entity, update the privacy policy to describe the personal information automated decision programs use and the decisions they make.
- Before January 1, 2027: list every tool that screens or ranks candidates or staff. Mark where a person reviews the output with authority to change it.
- January 1, 2027: have the California Pre-use Notice and the Colorado notices ready, and check the Colorado Attorney General’s final rules.
- Through 2027: for EU roles, name oversight owners and set six-month log retention. Prepare worker notices before December 2.
Start with the tool inventory above, then read Talent Acquisition Trends 2027 and Recruiting Trends 2027. The other 2027 deadlines are in the HR compliance calendar, EU pay transparency and US employment law changes.
Written and reviewed by the HR Riant Editorial Team. General information, not legal advice.