AI Bias Audit Requirements by State (2026): NYC, Colorado, Minnesota, New Jersey Compared

For the first two years after NYC Local Law 144 took effect in July 2023, most compliance conversations about AI in hiring started and ended with New York City. Learn the AEDT definition. Commission an audit. Post the results. Done.

That framing is now wrong for a meaningful share of US employers. Colorado, Minnesota, and New Jersey all have active requirements for HR teams using algorithmic decision tools in 2026. Each state defines the covered tools differently, imposes different obligations on employers, and sets different penalties for noncompliance.

A company with 80 employees, a Chicago headquarters, a New York City sales office, and remote engineers in Colorado and Minnesota already operates under three separate AI employment law regimes. Applying one standard across all of them is a compliance failure waiting to happen.

This article breaks down what each jurisdiction requires, compares them side by side, and closes with a 5-step action plan for multi-state employers.

Why "just comply with NYC" no longer covers it

NYC Local Law 144 set the template: mandatory third-party bias audits, public disclosure of results, and advance candidate notice. It was the first law of its kind in the US, and it remains the most prescriptive.

But it covers a specific category of tool (Automated Employment Decision Tools used in hiring or promotion in New York City) and a specific employer obligation (annual independent audit before deployment). Other states have filled adjacent gaps that NYC does not address.

Colorado focuses on "high-risk AI" impact assessments and ongoing monitoring, with candidate rights to explanation and appeal. Minnesota gives candidates the right to opt out of automated decisions entirely. New Jersey applies its existing anti-discrimination law to AI-generated disparate impact, with a pre-deployment assessment requirement backed by AG guidance.

None of those requirements are redundant with each other. A third-party bias audit satisfying NYC does not constitute a Colorado impact assessment. Minnesota's opt-out right has no equivalent in NYC's framework. New Jersey's private right of action under the Law Against Discrimination (NJLAD) creates litigation exposure that the other states currently do not.

Multi-state employers need to track all four.

State-by-state breakdown

NYC Local Law 144

Effective date: July 5, 2023 (with enforcement beginning July 2023; updated guidance issued through 2024)

What it requires: Employers must commission an annual independent bias audit of any Automated Employment Decision Tool (AEDT) before using that tool in hiring or promotion decisions affecting NYC candidates. The audit must be conducted by an independent auditor, which means an auditor with no financial interest in the employer or the tool vendor. Audit results must be posted publicly on the employer's website at least 10 business days before the tool is first used with any candidate, and results must remain posted for the entire period the tool is in use plus at least six months after use ends.

Employers must also notify candidates at least 10 business days before the AEDT is used. That notice must explain that an AEDT will be used, what job qualifications and characteristics the tool evaluates, and how candidates can request an alternative selection process that does not use the AEDT. Employers must provide that alternative process upon request.

Who it covers: Any employer or employment agency that employs workers in New York City, or that considers applications from candidates in New York City for positions that will be performed there. There is no minimum employer size.

What tools it applies to: AEDTs are defined as computational processes that substantially assist or replace discretionary decision-making in screening candidates for employment or employees for promotion. The key phrase is "substantially assist or replace." Tools that simply schedule interviews or filter by hard qualifications do not qualify. Tools that rank, score, or otherwise prioritize candidates based on outputs from machine learning or other algorithmic processes do qualify.

Audit frequency: Annual. The audit must cover the most recent year of use and must be conducted even if the tool has not changed.

Candidate rights: 10 days' advance notice; right to request an alternative selection process; no right to opt out without alternative.

Penalties: $375 per violation per day for a first violation. $1,500 per violation per day for each subsequent violation. The New York City Department of Consumer and Worker Protection (DCWP) enforces the law. Private right of action is not established in the statute, though NJLAD theories remain available in overlapping fact patterns.

For a full breakdown of the AEDT definition and audit scope, see the NYC Local Law 144 AI bias audit employer guide.

Colorado SB 24-205

Effective date: February 1, 2026

What it requires: Colorado's law applies a "reasonable care" standard to employers deploying high-risk AI systems in employment decisions. Reasonable care means conducting an impact assessment before deployment, documenting the assessment, implementing risk mitigation measures identified in that assessment, and conducting ongoing monitoring after deployment. The law does not require the assessment to be conducted by a third party, which distinguishes it from NYC's regime. An internal HR analytics team or a contracted vendor can conduct the assessment.

Employers must also notify candidates when an AI system was used in an employment decision that produced a legal or significant effect on them. That notice must include an explanation of the AI's role in the decision. Candidates have the right to appeal the decision and to correct factual errors in the information the AI used.

Who it covers: Employers with 50 or more employees in Colorado. There is no geographic limitation on where candidates must be located; it covers decisions affecting Colorado employees and applicants for Colorado positions.

What tools it applies to: "High-risk AI systems" in employment, which Colorado defines broadly to include any AI system that makes or substantially influences employment decisions including hiring, promotion, compensation, performance evaluation, and termination. The definition is broader than NYC's AEDT definition. Tools that merely automate administrative tasks do not qualify.

Audit frequency: No fixed audit cycle. The law requires ongoing monitoring after deployment, which in practice means regular internal review of outcome data and documentation of any material changes to the system.

Candidate rights: Notice that AI was used; right to explanation of the decision; right to appeal; right to correct errors.

Penalties: Colorado Attorney General enforcement only. No private right of action. Civil penalties under the Colorado Consumer Protection Act can reach significant amounts for knowing violations, but the enforcement framework is still developing.

For employer compliance specifics, see the Colorado AI Act SB 189 employer guide.

Minnesota HF 4873 (AI Policy Act)

Effective date: Applicable employment provisions effective July 31, 2025

What it requires: Minnesota's law centers on transparency and opt-out rights. Employers must disclose when AI is used in employment decisions. Candidates and employees have the right to opt out of automated decision-making that produces legal or significant effects on them. If a candidate opts out, the employer must use a non-automated process to make the decision. Employers are prohibited from using protected class characteristics as inputs to AI systems used in employment decisions. Employers must also provide an explanation of any automated decision upon request.

Who it covers: All employers operating in Minnesota, with no minimum size threshold. This is a meaningful distinction from Colorado's 50-employee minimum.

What tools it applies to: AI systems used to make or substantially influence employment decisions, defined similarly to Colorado's high-risk AI definition. The prohibition on using protected class inputs applies to any AI system used in HR contexts, even tools that are not the primary decision engine.

Audit frequency: No audit requirement. The law focuses on process rights rather than periodic auditing.

Candidate rights: Disclosure of AI use; right to opt out; right to explanation; prohibition on protected-class inputs.

Penalties: Minnesota Attorney General enforcement. No private right of action is established in the current statute. Legislative language suggests the AG can seek civil penalties and injunctive relief.

For the full scope of Minnesota's requirements, see the Minnesota AI legislation employer compliance guide.

New Jersey A4115 and AG Guidance

Effective date: AG guidance issued January 2025; underlying NJLAD has been in effect for decades

What it requires: New Jersey's approach layers AI-specific requirements on top of the existing Law Against Discrimination. The statute (A4115) requires employers to conduct impact assessments before deploying AI in employment decisions and to document those assessments. The AG guidance issued in January 2025 adds specificity: employers should conduct disparate impact analysis of AI outcomes annually, maintain records of those analyses, and retain documentation sufficient to reconstruct why specific decisions were made.

Critically, the existing NJLAD already prohibits both intentional discrimination and disparate impact discrimination in employment. The AG's guidance confirms that AI-generated disparate impact is actionable under the NJLAD even if the employer did not intend to discriminate. This means that running a biased AI tool on New Jersey candidates exposes employers to private litigation, not just regulatory enforcement.

Who it covers: All employers subject to the NJLAD, which covers employers with one or more employees in New Jersey. There is no minimum size threshold.

What tools it applies to: AI systems used in employment decisions, interpreted broadly in line with NJLAD's existing scope covering hiring, promotion, compensation, termination, and terms of employment.

Audit frequency: No fixed requirement in A4115. AG guidance characterizes annual disparate impact analysis as a best practice that demonstrates reasonable care.

Candidate rights: Right to notice that AI was used; right to explanation. NJLAD's existing framework provides the right to bring a discrimination claim in court without needing to go through the AG.

Penalties: Private right of action under the NJLAD. Plaintiffs can recover compensatory damages, punitive damages, and attorney fees. AG can also investigate and seek civil penalties. This is the most litigation-exposed regime of the four.

For the full NJLAD and A4115 employer framework, see the New Jersey AI employment law employer guide.

Comparison table

The critical column for most employers is the last one. New Jersey is the only jurisdiction where a candidate can sue directly over AI-generated discrimination without going through a government agency. That changes the risk calculus significantly.

What "multi-state employer" actually means in practice

Consider a concrete example. A company is headquartered in Chicago with 120 employees, operates a New York City sales office with 15 employees, and employs 22 remote engineers in Colorado and Minnesota. It uses an AI resume screening tool for all open roles and an AI performance evaluation system for all employees.

For the resume screening tool:

• NYC Local Law 144 applies to any candidate considered for positions in the NYC office. The company must commission an annual third-party bias audit of the tool, publish results, and give NYC candidates 10 days' advance notice.
• Colorado SB 24-205 applies to candidates for the Colorado engineering roles. The company must complete a pre-deployment impact assessment (internal is acceptable) and implement ongoing monitoring. It must notify Colorado candidates when the AI influenced a decision and provide a right to explanation and appeal.
• Minnesota HF 4873 applies to candidates for Minnesota roles. The company must disclose AI use, give candidates the right to opt out, and ensure the tool does not use protected class characteristics as inputs.
• Illinois has its own disclosure requirements under the state AI employment law that apply to the Chicago headquarters roles.

For the performance evaluation system:

• Colorado's law applies to the 22 Colorado employees. Impact assessment required before the system was deployed.
• Minnesota's law applies to the Minnesota employees. Opt-out rights apply, meaning any Minnesota employee can request that their performance evaluation not use automated tools.
• NYC's law applies if the system is used in promotion decisions for NYC employees. If the system "substantially assists" promotion decisions, it is an AEDT and requires the full audit cycle.

One AI tool. Four overlapping regimes. Different obligations for each candidate and employee population.

This is why a single compliance policy covering "AI in HR" is not sufficient. The policy needs to be jurisdiction-aware at the level of individual tool deployment and individual candidate population.

Audit cost reality check

Third-party bias audits, the kind required by NYC Local Law 144, typically cost between $5,000 and $50,000. The range reflects real differences in scope.

A simple binary screening tool with two years of historical data on 10,000 candidates in two demographic categories might cost $8,000 to audit. A multi-stage pipeline covering sourcing, resume screening, technical assessments, and interview scheduling, with limited historical data and multiple protected class categories, can exceed $40,000. Auditors also charge more when they need to request and process data from multiple vendors rather than a single system.

Vendors who specialize in this work include Holistic AI, O'Neil Risk Consulting, and BABL AI. Each has a somewhat different methodology and pricing structure. Shopping multiple vendors before selecting one is worth the time.

What auditors actually examine: training data composition (what historical hiring decisions was the model trained on, and do those decisions reflect discriminatory patterns); outcome rates by demographic (what share of candidates from each protected group advance at each stage); feature correlation analysis (are features the model weights heavily correlated with protected characteristics even if those characteristics are not direct inputs).

The 4/5ths rule is the most commonly applied standard for disparate impact. If the pass rate for a protected group is less than 80% of the pass rate for the highest-passing group, there is presumptive adverse impact. For example, if white candidates advance past the screening tool at 40% and Black candidates advance at 28%, that is a 70% ratio, which falls below the 4/5ths threshold. That does not automatically mean the tool is illegal, but it creates an obligation to investigate and document a business justification.

Internal impact assessments, which Colorado and New Jersey accept in place of third-party audits, cost less but require qualified internal staff or a contracted HR analytics vendor. The analytical work is similar. The difference is that you are not paying for an independent auditor's certification of the results.

For cost context relative to overall AI compliance, see the AI hiring tool compliance US state laws overview.

5-step action plan for multi-state employers

Step 1: Map every AI tool used in hiring and promotion decisions

Start with a complete inventory. Include resume screening tools, applicant tracking system ranking features, video interview analysis software, skills assessment platforms, and any AI-assisted performance evaluation or succession planning tools. Include vendor-provided AI features embedded in broader HR software platforms. Many employers using Workday, Greenhouse, or similar platforms have AI features active by default that they did not explicitly purchase.

For each tool, document: what decisions it affects, what candidate or employee population it touches, and which jurisdictions those people are located in.

Step 2: Identify which candidate populations are in which jurisdictions

Build a matrix. For each open role or hiring process, record whether candidates will come from or be employed in NYC, Colorado, Minnesota, New Jersey, or Illinois. For existing employees, record current work locations.

This does not need to be real-time. A quarterly review of hiring activity by jurisdiction is sufficient for most employers. What matters is that you have a current picture before deploying a tool or before a hiring cycle begins.

Step 3: Determine which laws apply to each tool-population combination

Using the inventory from Step 1 and the population map from Step 2, apply the jurisdictional matrix from the comparison table above. Document your conclusions. This documentation serves two purposes: it tells your HR operations team what procedures to follow, and it demonstrates reasonable care if you face a regulatory inquiry.

Some combinations will be clear. If you use an AI resume screener for any NYC role, NYC Local Law 144 applies. If you use an AI performance evaluation tool for Colorado employees, Colorado SB 24-205 applies and a pre-deployment impact assessment was required before you started using it.

Other combinations require judgment. If a candidate applies from Minnesota for a role they will perform entirely in Colorado, both Minnesota's disclosure and opt-out requirements and Colorado's impact assessment and notice requirements may apply. Document your reasoning.

Step 4: Commission the required audits and assessments

For NYC: commission a third-party bias audit if you have not done so within the past year. The audit must cover actual use data from the prior year. If the tool is new, the audit covers the prior period of use, or if the tool has not been used yet, a pre-deployment assessment covers the training data and validation testing. Publish results on your website before your next NYC hiring cycle.

For Colorado and New Jersey: conduct internal impact assessments for each covered tool before the next use cycle. If you lack internal HR analytics capacity, contract a vendor. Document the methodology, the data used, the results, and any mitigation steps taken.

For Minnesota: implement a disclosure and opt-out workflow for Minnesota candidates and employees. This typically means adding a disclosure to job application workflows and providing a process for employees to request non-automated performance evaluations.

Step 5: Implement candidate notice workflows with jurisdiction-specific copy

Each jurisdiction requires different content in candidate notices. NYC requires at least 10 days' advance notice specifying what the AEDT evaluates and how to request an alternative process. Colorado requires post-decision notice when AI influenced the outcome. Minnesota requires disclosure at the point of use with opt-out instructions.

Build these as separate notice templates, not a single generic disclosure. A single disclosure that tries to satisfy all four jurisdictions simultaneously typically fails to satisfy any of them clearly. Maintain records of when each notice was sent and to which candidates.

For a practical checklist tied to federal EEOC guidance in addition to these state requirements, see the EEOC AI hiring guidance employer checklist.

What to do next

If your company has not yet conducted a NYC Local Law 144 bias audit and you have NYC candidates or employees in your hiring or promotion processes, that is your most urgent compliance gap. The $1,500 per day penalty for subsequent violations adds up quickly, and DCWP enforcement actions have increased in frequency since 2024.

If you have Colorado employees or candidates for Colorado roles, review whether your AI tools required a pre-deployment impact assessment under SB 24-205. The law's February 2026 effective date means that tools you deployed before that date should have been assessed at or before deployment.

Minnesota and New Jersey require less procedural overhead than NYC's audit regime, but New Jersey's private right of action under the NJLAD is a meaningful litigation exposure that the other states do not create. Prioritize getting your New Jersey candidate notice and disparate impact analysis in place.

The Illinois AI employment disclosure law covers the fifth major jurisdiction for employers with operations in that state and is worth reviewing alongside this analysis.

For the full landscape of state AI hiring laws beyond these four jurisdictions, see the AI hiring tool compliance US state laws overview.