Which States Require an AI Hiring Bias Audit in 2026?

In 2026, only New York City clearly requires an independent bias audit for AI hiring tools. Colorado's audit-style law was suspended and rewritten before it took effect. Illinois requires notice, not an audit. If you screen New York City candidates with an automated tool, you owe a yearly audit by an outside auditor, a public results summary, and at least 10 business days of notice to each candidate.

What is an AI hiring bias audit?

A bias audit checks whether a hiring tool picks people from one group at a much lower rate than another. The New York City rule sets the standard most people mean when they say "audit."

It must be done by an independent auditor, not the vendor and not your own HR team.

An "automated employment decision tool" (AEDT) is software that uses a model to substantially assist or replace a person's judgment in hiring or promotion. If a tool only ranks resumes as one input a human weighs freely, it may fall outside the rule. If it does the sorting, it is in.

The math most auditors run is the four-fifths rule. If one group is selected at less than 80 percent of the rate of the top group, that signals adverse impact.

That 80 percent screen is the longstanding federal standard in the Uniform Guidelines on Employee Selection Procedures. A tool can still be found unlawful even when it clears the line.

Does New York City require a bias audit? (law in force)

Yes. Local Law 144 of 2021 is in force. The Department of Consumer and Worker Protection began enforcing it on July 5, 2023.

If you use an AEDT to substantially assist hiring or promotion decisions in New York City, you must:

Have a bias audit done by an independent auditor no more than one year before you use the tool.
Post a summary of the most recent audit results on your website.
Notify each candidate that a tool will be used, how it works, and what data it collects.

The audit is annual. It is not a one-time box to check. Miss the yearly refresh and the tool is out of compliance the day the old audit expires.

Sources: nyc.gov (DCWP) | osc.ny.gov

What notice do you owe candidates, and what are the fines?

New York City requires at least 10 business days of notice before a candidate is screened by the tool. The fines stack by the day.

A first violation is $500. Each later violation runs $500 to $1,500. Each day you use a non-compliant tool counts as a separate violation, and a missing notice is its own separate violation.

That is how a single tool used across a hiring season can turn into a five-figure exposure.

Enforcement has been light so far. A New York State Comptroller audit published December 2, 2025 reviewed 32 companies and found the city agency had recorded only one violation. The Comptroller's own review flagged at least 17 possible cases of non-compliance.

The agency logged just two complaints between July 2023 and June 2025. Light enforcement is not the same as no rule. The per-day fine structure is still on the books.

Sources: osc.ny.gov | nyc.gov (DCWP)

Does Colorado require an AI bias audit in 2026? (not in force)

No. This is where most 2026 checklists are wrong. Colorado's SB 24-205 was signed in May 2024 and set to start February 1, 2026, then pushed to June 30, 2026.

Then enforcement was suspended in spring 2026. The legislature repealed and replaced it with SB 26-189, which the governor signed May 14, 2026. The new version takes effect January 1, 2027.

The rewrite dropped the heavy parts. The original leaned on a duty of care and impact assessments, which is the closest Colorado ever got to an audit. Even that was not the same as New York City's independent third-party audit.

The replacement law is disclosure-based. So for all of 2026, Colorado imposes no bias-audit duty on employers. Treat it as a proposal-turned-future-law, not a live obligation.

Sources: leg.colorado.gov | Norton Rose Fulbright

What about Illinois? (law in force January 1, 2026)

Illinois HB 3773 is in force as of January 1, 2026. It amends the Illinois Human Rights Act. It does not require a bias audit. What it does require:

Notify applicants and employees when you use AI for hiring, promotion, discipline, discharge, and similar decisions.
Do not use zip codes as a proxy for a protected class.
Do not use AI that has a discriminatory effect, whether or not you meant it to.

The notice duty applies even if your tool never discriminates. So Illinois is a notice-and-non-discrimination state, not an audit state.

Sources: Seyfarth Shaw

Does federal law require an audit?

No federal law mandates a hiring bias audit. Title VII of the Civil Rights Act still applies to every AI screening tool on its own force, as a statute.

The EEOC issued technical assistance on May 18, 2023 that spelled out how Title VII reaches these tools.

The agency took that guidance off its website in January 2025. Removing the guidance did not change the law.

Two points still hold. First, the four-fifths rule flags adverse impact at the 80 percent line.

Second, you stay liable even when a vendor built and runs the tool. "The software did it" is not a defense.

That is why many employers outside New York City run an audit anyway. It is the cleanest evidence that they checked.

Sources: natlawreview.com

Do you owe an audit? A three-question test

Here is the AEDT trigger test. Answer in order:

Are any of your candidates in New York City? If no, you have no audit mandate in 2026. Skip to Title VII hygiene.
Does an automated tool substantially assist or replace a human decision on those candidates? If no, you likely fall outside Local Law 144.
If yes to both, do the three steps: independent audit within the past year, public results summary, and 10 business days of notice.

For Colorado and Illinois in 2026, swap "audit" for "notice and non-discrimination."

If you want a second set of eyes on which of your tools actually trips the trigger, that is the kind of thing I sort out at nomadtechnologist.com.

Not legal, financial, or tax advice.