AI Hiring Laws: What Recruitment Agencies Must Tell Candidates (October 2026)
AI hiring laws in the EU, New York City, Illinois, Colorado and California, read for recruitment agencies: what to tell candidates, and what changed in 2026.
If your agency uses AI anywhere near a hiring decision, the question candidates and clients will ask first is simple: did you tell them? Most AI hiring laws start there. Some add audits, consent or record-keeping on top.
This post maps the AI hiring laws that matter most to a recruitment agency today, what each one asks you to tell candidates, and what has changed. Some of the dates in older guides have since moved.
Written in October 2026. This is how we read the rules, not legal advice. Laws in this area change often: check the source before you rely on a date.
Why agencies are in scope
It is easy to assume these laws are written for the employer. Some of them name agencies directly. New York City's rule, for example, "prohibits employers and employment agencies from using an automated employment decision tool unless the tool has been subject to a bias audit within one year of the use of the tool, information about the bias audit is publicly available, and certain notices have been provided to employees or job candidates" (NYC Department of Consumer and Worker Protection).
The EU AI Act splits duties between the company that builds an AI system (the provider) and the company that uses it (the deployer). An agency that screens candidates with an AI tool is usually the deployer.
European Union: the AI Act
Two parts of the AI Act matter for recruitment.
Telling people they are talking to an AI. The transparency article says: "Providers shall ensure that AI systems intended to interact directly with natural persons are designed and developed in such a way that the natural persons concerned are informed that they are interacting with an AI system." The information must be given "in a clear and distinguishable manner at the latest at the time of the first interaction or exposure." The article "Comes into force 2 August 2026, according to Article 113" (AI Act, Article 50).
That duty sits with the provider: the tool itself has to say it is an AI. As a deployer, your job is to use tools that do.
Recruitment as high-risk. The AI Act's list of high-risk uses includes "AI systems intended to be used for the recruitment or selection of natural persons" (AI Act, Annex III). For those systems the deployer has its own notice duty: "deployers of high-risk AI systems referred to in Annex III that make decisions or assist in making decisions related to natural persons shall inform the natural persons that they are subject" to the system (AI Act, Article 26).
The date moved. If a guide says the high-risk rules start in August 2026, it is out of date. The EU amended the AI Act with "Regulation (EU) 2026/1744 of the European Parliament and of the Council of 8 July 2026" (EU Publications Office), and the Commission summarises the new date plainly: "High-risk AI systems in Annex III : Rules apply starting 2 December 2027" (European Commission).
So, in short: the "tell them it is an AI" rule already applies. The high-risk duties, including the deployer's notice, apply from December 2027.
New York City: bias audits and notices
The New York City rule quoted above has three parts: an independent bias audit within the past year, a public summary of it, and notices to candidates. It applies to employment agencies as well as employers.
If you fill New York City roles and an automated tool plays a part in the decision, read the city's rule and FAQ before you use it. The details, including what the notice must say and when, are in the rule text linked from the city's page.
Illinois: video interviews, and a broader notice rule
Illinois has two laws worth knowing.
AI-analysed video interviews. An employer that uses AI to analyse recorded video interviews for Illinois-based roles must, before the interview: "Notify each applicant before the interview that artificial intelligence may be used to analyze the applicant's video interview and consider the applicant's fitness for the position. (2) Provide each applicant with information before the interview explaining how the artificial intelligence works and what general types of characteristics it uses to evaluate applicants. (3) Obtain, before the interview, consent from the applicant" (Illinois Artificial Intelligence Video Interview Act, bill text via NCSL).
Any AI in employment decisions. An amendment to the Illinois Human Rights Act makes it a civil rights violation "For an employer to fail to provide notice to an employee that the employer is using artificial intelligence for the purposes described in paragraph (1)." Those purposes include recruitment and hiring. "This Act takes effect January 1, 2026." (Illinois Human Rights Act amendment, bill text via NCSL).
The second law is the wider one. It is not limited to video, and it is already in force.
Colorado: the original AI Act was replaced
If an article describes Colorado's original AI Act as the law in force, it is out of date. The bill summary says: "The act repeals and reenacts those provisions with new requirements regarding the use of automated decision-making technology in consequential decisions." The new version requires deployers to "provide clear and conspicuous notice to consumers at the point of interaction with a covered ADMT" (Colorado General Assembly, SB26-189).
If you hire for Colorado roles, read the new bill, not a summary of the old one.
California: automated decisions from 2027
California's privacy regulator has approved rules on automated decision-making technology (ADMT). Its announcement says: "Businesses that use ADMT to make significant decisions must comply with the ADMT requirements beginning January 1, 2027." (California Privacy Protection Agency). These rules apply to businesses covered by California's privacy law, so check whether yours is.
What to tell candidates, by jurisdiction
| Where | What you must tell candidates | Since or from |
|---|---|---|
| EU | That they are interacting with an AI, at the first interaction (the tool's duty) | 2 August 2026 |
| EU | That they are subject to a high-risk AI system (your duty as deployer) | 2 December 2027 |
| New York City | The notices the rule requires, plus a public bias audit summary | In force |
| Illinois | That AI is used in recruitment or hiring decisions | 1 January 2026 |
| Illinois | For AI-analysed video interviews: notice, an explanation, and consent, before the interview | In force |
| Colorado | Clear notice at the point of interaction with a covered ADMT | Check the new bill |
| California | ADMT requirements for businesses covered by its privacy law | 1 January 2027 |
How PlacementFlow handles its part
We build the screening assistant, so the "tell them it is an AI" duty is ours to get right. Three decisions shape it.
The disclosure is on the screen, not in a policy. The candidate is talking to it right now, so that is where they need to know. The line under the assistant's name always says it is an AI: "AI Screening Assistant" at the first stage, "Automated assistant (AI)" at the second. The first message says it is an automated assistant and that a human recruiter reads every conversation. There is no setting to turn it off. What candidates see is listed in AI Transparency: What Candidates Are Told, and how the chat works is in Screen Candidates via Web Chat.
One named assistant, with fixed rules. Candidates meet one named assistant, Sofia, instead of a different bot at each step, and her rules are fixed: she says she is an assistant if asked, and she never claims to be human.
Text only, and a person decides. Voice and video analysis is where the strictest rules apply, so we left it out: screening is a written chat. The AI can flag a missed must-have, but only a recruiter can reject. What the AI does and does not do is in What the AI Does and Never Does, and the record a recruiter can export is in Auditable AI and the Decision Audit Export.
One honest limit. Our first cold sourcing email carries no AI notice, because it is a fixed template written by people, not a message written by AI. The candidate is told about the AI when they open their screening link.
What stays your job: your own privacy notice, any notice a local law asks you to give, and your own records. A tool can make the disclosure inside its own screen. It cannot send your notices for you.
A checklist for your agency
- List where AI touches a candidate. Sourcing, screening, scheduling, scoring. Each one is a place a notice may be due.
- Check each tool discloses itself. At the first interaction, in plain words, every time.
- Map your jurisdictions. Where the role is based decides which rules apply, not where your office is.
- Keep a person on every rejection. It is the clearest answer when someone asks who decided.
- Date your sources. Colorado and the EU have both changed their rules. Recheck before you rely on a summary.
Continue Reading
More insights for recruitment professionals
