US State AI Rules Are Now the Harder Compliance Problem

While attention was on the EU AI Act’s August 2026 enforcement date, the more immediately applicable rules for a US employer arrived state by state, at different times, with different scopes and different delays.

As of mid-2026 the picture includes Colorado’s employment AI legislation with a pushed implementation date, California’s finalized civil rights regulations on automated decision systems plus privacy agency rules requiring opt-outs and disclosures, and an Illinois disclosure law. Other states have passed or are considering their own.

There is no federal preemption resolving this. If you employ people in more than one state, you are complying with several regimes at once, and that is now the harder problem for most American businesses than anything coming out of Brussels.

What These Laws Actually Cover

Almost all of the employment-focused state rules target the same category: automated systems used to make or substantially inform consequential decisions about people. Hiring, promotion, discipline, termination, compensation, scheduling.

The recurring obligations are notice, some form of assessment or bias testing, recordkeeping, and in some cases an opt-out or a right to human review.

That is a specific and important category. It is also not what most people mean when they say “we use AI at work”.

The Distinction That Saves You Time

Decision systems score, rank, screen, or otherwise contribute to an outcome about a person. A resume screener. A performance-scoring tool. A scheduling system that allocates shifts. These are what the laws are about.

Writing tools transform text a human wrote and will review before it is used. A rewrite that changes the register of an email is not making a decision about anyone.

The line blurs in one place worth watching: if AI-generated text becomes the substantive content of a decision record, the tool is closer to the process than it looks. Using a model to draft a performance review from your own notes is assistance. Using one to produce the assessment itself, which you then sign without independent judgment, is something else.

The practical test is whether a human made the decision and can explain it without reference to the tool. If yes, it is assistance. If the tool’s output is the reasoning, you have a decision system, whatever the vendor calls it.

There is more on the writing side of this in how to write a performance self review and on the policy side in how to write an AI use policy for a small team.

Recordkeeping Is The Common Denominator

Across the different state approaches, one obligation recurs in some form: keep records of what the system did and what you decided.

That is worth taking seriously even where it does not strictly apply to you, because it is also what answers a client questionnaire, an internal audit, and a discrimination claim. Extended recordkeeping requirements for automated decision system data are a feature of the California regulations specifically, and the general direction across states is toward more documentation rather than less.

The practical version is not a compliance platform. It is a dated decision record.

Before:

Reviewed candidates and selected three for interview. Used AI to help with the screening.

After:

Candidate screening for the Operations Analyst role, 3 August 2026.

All 47 applications reviewed by the hiring manager against the published criteria: relevant experience, required certification, location eligibility.

No automated scoring or ranking was used. An AI writing tool was used to draft rejection emails from the manager’s notes; the manager reviewed and sent each one.

Three candidates advanced. Reasons recorded per candidate in the ATS.

The second version distinguishes what made the decision from what wrote the correspondence, which is the exact distinction the statutes turn on. It also takes four minutes to write and would be worth a great deal in a dispute two years later. The format generalizes; see how to write a decision log entry.

A Wrivio Context for hiring records could say:

Rewrite this as a factual hiring decision record. Neutral register, complete sentences. State who decided, against what criteria, and what tools were used for which step. Keep every name, date, role title, and number exactly as written. Do not add reasons, evaluations, or characterizations of candidates that are not in the original.

Press Ctrl+Shift+Space, paste the draft, and check the diff. In hiring records the danger is a rewrite adding a plausible-sounding rationale you did not write, which is precisely the sentence that would be read aloud back to you later.

Dates Are The Part To Verify Yourself

This is the area where secondary sources are least reliable, because implementation dates have moved repeatedly.

Colorado’s employment AI law had its implementation pushed from an earlier date after industry pushback, and further changes have been reported. Other states have amended scope after passage. Anything you read about a specific effective date, including this post, should be checked against the state’s own published text before you rely on it.

Two rules of thumb: check the statute or the agency page rather than an article, and re-check anything more than three months old. A useful working index of the underlying obligations, if you want a comparison point for what regulators are converging on, is the NIST AI Risk Management Framework, which is voluntary but widely referenced.

This is also a genuine limit on what a blog post can do for you. Multi-state employment law with moving effective dates is a place to get advice, not to rely on a summary.

What To Actually Do

Separate your inventory into two lists. Systems that touch decisions about people, and tools that transform text a human reviews. The first list needs real attention. The second mostly needs a note saying why it is on the second list.

Write down the states you employ in. The obligations follow the employee, so the map of your workforce is the map of your exposure.

Keep decision records for anything on the first list. Dated, naming who decided and on what basis.

Get advice if the first list is not empty. This is not a summarizable area, and the penalties attach to specific procedural failures rather than to intent.

Common Questions

Does an AI writing tool count as an automated decision system?

Not if a human makes the decision and reviews the text. The statutes target systems that score, rank, or screen people. A tool that rewrites a message you then send is assistance.

Which states have employment AI rules in force?

The set is changing and effective dates have moved repeatedly, with Colorado, California, and Illinois the most cited as of mid-2026. Check each state’s own published text rather than a summary.

Is there a federal law that overrides the states?

No federal preemption resolved this as of August 2026, which is why multi-state employers face several regimes at once.

What is the single most useful thing to do?

Keep dated decision records that say who decided and on what basis, separately from any note about which tools were used for drafting.

Download Wrivio for Windows to draft records and correspondence with a local model, so the underlying text never leaves the machine it was written on.