AI Hiring Laws Landing in 2027

Prediction:  Sometime in the first week of January, a general counsel somewhere is going to forward a law firm client alert to a recruiting leader with a one-line note: “Are we covered?”

If the answer is “let me find out,” that team is already behind. The laws in that alert won’t be about the back office. They’ll be about the screening tool in your ATS, the assessment vendor you’ve been using, and the rejection email a candidate gets at 2 a.m. In other words, they’ll be about recruiting.

The regulatory landscape for recruiting-related issues is changing rapidly so I need two weeks to cover everything.  This week covers the laws aimed at the machines in your hiring process. Next week covers the one document every new law seems to be targeting: your job posting.

---

For years, AI in hiring has been regulated mostly by implication. Title VII, the ADA, and the ADEA always applied, but few rules told you how to disclose, document, or review what your tools were doing.

That era ends on January 1. The new rules share a simple theme: transparency about the machines in the background. Tell candidates when automation is shaping a decision about them, keep a human accountable who can actually explain it, and keep the receipts.

None of that is unreasonable. The problem is that most TA teams can’t currently answer the first question any of these laws ask: which tools in your funnel score, rank, or filter people?

You can’t disclose a tool you haven’t inventoried. Most compliance problems in 2027 will start as inventory problems in 2026.

The Roadmap: What’s Landing and When

January 1, 2027: Colorado. After two years of delays, Colorado repealed its original AI Act in May and replaced it with SB 26-189, a much narrower law. If automated decision-making technology materially influences a hiring or employment decision about a Colorado resident, you’ll need to give clear notice before using it. After an adverse decision, you’ll need to send a notice within 30 days and offer a path to human review and reconsideration. Records have to be kept for at least three years.

January 1, 2027: California’s privacy rules. The same day, California’s automated decision-making rules under the CCPA take effect. Covered employers who use these tools for significant decisions like hiring, without meaningful human involvement, will need three things: a pre-use notice before collecting a candidate’s data, a documented risk assessment, and processes for access and appeal requests. These sit on top of California’s anti-discrimination rules for automated decision systems, which have been in force since October 2025.

July 1, 2027: California’s “No Robo Bosses Act.” SB 947 was signed September 30. It targets discipline and termination, not hiring. Employers can’t rely solely on an automated system for those decisions, and if they rely on one primarily, a human has to corroborate the outcome with other evidence. Why should recruiters care? Because this is the template. The rubber-stamp model, where a human just clicks “approve,” is on its way out, and it’s hard to imagine the hiring side staying exempt from that logic for long.

The wildcard: Washington, D.C. A December 2025 executive order created a federal task force to challenge state AI laws, and the White House has since called for broad federal preemption. For planning purposes, here’s what matters: neither has produced binding legal change, so the state laws above remain on the books. Even if some get narrowed later, federal anti-discrimination law applies to your AI tools regardless. (My recent piece on the Workday litigation shows how that’s already playing out.)

A federal fight over state AI laws is not a compliance strategy. It’s a reason to build a process that would hold up under either outcome.

---

Legal will interpret these laws, and IT will configure the systems. But recruiting owns the candidate journey these laws are written around. That makes recruiting the function that should be asking questions.

• Don’t assume your ATS vendor handles compliance.  You should be asking  which tools in your funnel score, rank, or filter candidates, and could you produce that list by December 1?
• Instead of treating “a human reviews it” as a checkbox, ask what evidence does the reviewer actually look at, and is it written down anywhere?
• You should be asking where in your application flow does the disclosure appear, before candidates hit “submit” or after?
• Don’t accept your vendor’s generic bias summary without asking if they can show you how the tool performs with your applicant data, and will they support your record-keeping obligations?
• Instead of building a separate process for each state, ask what would it take to give every candidate the same notice and the same path to human review?

---

I’ve highlighted university recruiting programs the last few weeks and again they get this right, practicing the core behavior the new laws require.

Campus teams spell out the process before a student ever applies: the online assessment, the video screen, on-campus interview days, and when decisions come out. They do it because they have to. A 21-year-old who has never been through a corporate hiring process won’t finish one they don’t understand and process needs to be sharp when dealing with short timelines.

Experienced-hire funnels rarely get the same courtesy. The screener runs quietly in the background, and the candidate learns it existed only when the rejection arrives. Bring the campus habit across, and a big chunk of your 2027 disclosure work is already done.

“We don’t operate in California or Colorado”

This is a dangerous assumption because, if you post remote roles, you’re recruiting in every state a candidate can apply from. Colorado’s new law, for example, is written around Colorado residents, not where your headquarters sits. One applicant from Denver to your fully remote req, and you’re in scope.

Another objection I hear is that this will all get preempted anyway. Maybe some of it will. But not by January, and not the federal laws that already apply to every tool in your stack.

A quick disclaimer: I’m a recruiting guy, not an employment lawyer, and regulators will add more detail to several of these rules before they take effect. Talk to counsel about your specific footprint. My goal is to make sure recruiting shows up to that conversation with the right questions.

None of this asks for anything a well-run recruiting function shouldn’t want anyway: knowing what your tools do, telling candidates the truth about it, and keeping a human accountable for the outcome. The deadline just makes it non-negotiable.

---

So, could your team produce a complete list of every tool that scores or filters a candidate, by the December 1? Drop a comment. I’d genuinely like to know how many teams can.

Next week in Part 2: the one document nearly every new hiring law is targeting – your job posting.

If you want help mapping your screening tools and candidate notices before January 1 instead of after, that’s exactly the kind of work ES Talent Solutions does. Reach me directly at estewart@ESTalentSolutions.com and let’s talk.

#AIinHiring #EmploymentLaw #RecruitingCompliance #TalentAcquisition #HRLeadership #ESTalentSolutions

---