Which states require AI bias audits for hiring in 2026?

New York City's Local Law 144 requires a yearly independent bias audit of automated employment decision tools used for hiring or promotion in the city. Colorado's SB 26-189 starts January 1, 2027 and requires notices and human review, not audits. New Jersey guidance lists audits as an optional step under its anti-discrimination law.

Is NYC Local Law 144 the only AEDT audit requirement?

Among the laws compared here, yes. NYC Local Law 144 is the one that bars using such a tool unless an independent bias audit was done within the past year. Colorado's SB 26-189 adds notice, explanation and human review duties from January 1, 2027, without any audit.

What does Colorado require for algorithmic hiring tools?

Colorado SB 26-189 applies from January 1, 2027. An employer whose automated tool materially influences a hiring or other employment decision must give notice before use, explain an adverse outcome in plain language, and offer data correction and human review. It has no impact assessment or audit duty.

How often must AI bias audits be conducted?

NYC Local Law 144 requires an audit done no more than one year before each use, so in practice every year. Colorado's SB 26-189 has no audit cycle. New Jersey's January 2025 guidance mentions pre- and post-deployment bias audits as one possible step, with no required frequency.

AI Bias Audit Requirements by State: NYC, Colorado, NJ

A magnifying glass lying on a clipboard with a financial chart, representing AI bias audit requirements by state Image: Pexels, used under the Pexels License.

TL;DR: Only New York City makes you audit an AI hiring tool. Colorado, from January 1, 2027, wants notices and a human reviewer instead. New Jersey has no AI hiring statute we could confirm, but its anti-discrimination law already covers biased tools.

Most compliance conversations about AI in hiring still start with New York City's Local Law 144: learn the AEDT definition, commission an audit, post the results, send the notices.

That's still the only audit mandate in this comparison, but it isn't the only rulebook. Colorado's rules start on January 1, 2027, and New Jersey's civil rights agency has said its Law Against Discrimination (LAD) applies to algorithmic discrimination. Each one defines the covered tools differently and asks for different things.

A company with a Chicago headquarters, a New York City sales office and remote engineers in Colorado already deals with several regimes for one screening tool. Applying one standard across all of them is a compliance failure waiting to happen.

This article breaks down what each jurisdiction requires, compares them side by side, and closes with a 5-step action plan for multi-state employers.

Why "just comply with NYC" no longer covers it

NYC Local Law 144 set the template: an independent bias audit, public posting of a results summary, and advance notice to candidates. It remains the most prescriptive of the three.

But it covers a specific category of tool (automated employment decision tools used to screen candidates or employees for hiring or promotion in New York City) and a specific obligation (an audit no more than a year old before each use).

Colorado, from January 1, 2027, requires notice before an automated tool influences an employment decision, a plain-language explanation after an adverse one, and a route to data correction and human review. New Jersey's January 2025 guidance says an employer can violate the LAD through an automated tool even with no intent to discriminate and even if a vendor built the tool.

None of those requirements are redundant with each other. A bias audit that satisfies NYC does nothing for Colorado's notice and human review duties, and passing an audit doesn't shield you from a New Jersey discrimination complaint.

State-by-state breakdown

NYC Local Law 144

Effective date: The law took effect January 1, 2023; the Department of Consumer and Worker Protection (DCWP) began enforcing it on July 5, 2023 (DCWP FAQ).

What it requires: An employer or employment agency may not use an automated employment decision tool (AEDT) to screen a candidate or employee unless the tool "has been the subject of a bias audit conducted no more than one year prior to the use of such tool", and a summary of the most recent audit's results, with the tool's distribution date, is posted on its website before use (Local Law 144 of 2021). The audit is an impartial evaluation by an independent auditor and, at a minimum, calculates selection or scoring rates and impact ratios across sex, race/ethnicity and intersectional categories. An auditor isn't independent if they work for the employer or the vendor, helped build or distribute the tool, or have a financial interest in either.

Candidates and employees who live in New York City must get notice no less than 10 business days before use: that an AEDT will be used (allowing them to request an alternative selection process or accommodation) and the job qualifications and characteristics it will assess. Information on the type and source of data collected and the retention policy must be provided within 30 days of a written request, if it isn't on the website.

Who it covers: Use "in the city". DCWP reads that as a job located at a New York City office at least part time, a fully remote job associated with a New York City office, or an employment agency located in the city.

What tools it applies to: A computer-based tool that uses machine learning, statistical modeling, data analytics or AI, helps make employment decisions, and substantially assists or replaces discretionary decision-making. Using such a tool to scan a resume bank or invite applications isn't covered; screening people who applied for a specific position is.

Audit frequency: Every year. DCWP says an employer "can only rely on a bias audit for one year from the date it was conducted."

Candidate rights: Notice 10 business days before use; a request for an alternative selection process or accommodation; data information on written request. The law doesn't require any particular action based on the audit's results; existing anti-discrimination law still decides that.

Penalties: Up to $500 for a first violation (and each additional violation the same day), then $500 to $1,500 for each subsequent violation. Each day an unaudited tool is used is a separate violation, and so is each missed notice. DCWP enforces the audit and notice rules; discrimination claims go to the NYC Commission on Human Rights. The law doesn't limit a candidate's or employee's right to bring a civil action.

For a full breakdown of the AEDT definition and audit scope, see the NYC Local Law 144 AI bias audit employer guide.

Colorado SB 26-189

Effective date: January 1, 2027, for decisions made on or after that date (signed act, Section 5). SB 26-189 repealed and reenacted SB 24-205, the 2024 Colorado AI Act, before that law ever took effect (Colorado Attorney General). The Attorney General must adopt rules on the adverse-outcome explanation by the same date, and written comments on the draft rules close October 26, 2026.

What it requires: Notice and explanation, not audits. Before a covered tool is used to materially influence an employment decision, the employer must give a clear and conspicuous notice that it uses one. A prominent public notice where candidates interact, such as a link next to the application, satisfies that.

If the tool materially influences a decision with an adverse outcome (a rejection, a termination, lower pay), the employer has 30 days to send a plain-language description of the decision and the tool's role, instructions for requesting the tool's name, version and developer and the personal data used, and an explanation of the candidate's rights. Records showing compliance are kept for three years.

The act contains no impact assessment, risk management program, bias audit or ongoing monitoring duty. The vendor (the "developer") must hand the employer documentation instead: intended uses, categories of training data, known limitations, and instructions for use, monitoring and human review.

Who it covers: Any business doing business in Colorado that deploys a covered tool. The definition sets no employee-count threshold. Protected people include employees, job applicants who live in Colorado, and anyone whose opportunity in Colorado is evaluated.

What tools it applies to: Automated decision-making technology whose output is a non-trivial factor that changes how an employment decision comes out, for example by ranking, scoring, recommending, classifying or constraining candidates. Incidental, trivial or clerical uses are out, and so are routine scheduling and tools that only summarize or organize information for a person without producing a score, ranking or recommendation that materially influences the outcome.

Audit frequency: None. The act has no audit or assessment cycle.

Candidate rights: Notice before use. After an adverse outcome: an explanation, correction of factually incorrect or materially inaccurate personal data, and meaningful human review and reconsideration "to the extent commercially reasonable." No opt-out.

Penalties: The Attorney General enforces it exclusively, and a violation is a deceptive trade practice under the Colorado Consumer Protection Act. Until January 1, 2030, the Attorney General must first send a notice of violation and allow 60 days to cure where a cure is possible, unless the violation was knowing or repeated. The act creates no new private right of action, but existing anti-discrimination claims remain, with fault split between vendor and employer by their relative fault. The act itself states no penalty amount.

For employer compliance specifics, see the Colorado AI Act SB 189 employer guide.

New Jersey: the Law Against Discrimination and the January 2025 guidance

Status: We couldn't confirm that New Jersey has enacted any AI hiring statute. Earlier versions of this page relied on bill A4115; the Legislature's bill site didn't load for us from two networks on October 15, 2026, so we've taken those claims out. What does apply is the existing Law Against Discrimination, as explained by the Division on Civil Rights in guidance released with the Attorney General on January 9, 2025 (press release).

What the guidance says: The LAD "applies to algorithmic discrimination in the same way it has long applied to other discriminatory conduct", including disparate treatment and disparate impact. A covered entity "can violate the LAD even if it has no intent to discriminate, and even if a third-party was responsible for developing the automated decision-making tool" (DCR guidance, PDF). Buying the screener from a vendor doesn't move the risk off your books.

Audits: Not required. Among non-exhaustive steps an entity can take, the guidance lists "conducting impact assessments; having pre-and post-deployment bias audits performed by independent parties". It sets no frequency.

What tools it applies to: Automated decision-making tools used in decisions the LAD already covers, including employment.

How complaints work: Anyone who believes their LAD rights were violated can file a complaint with the Division on Civil Rights within 180 days of the incident (DCR).

For the full employer framework, see the New Jersey AI employment law employer guide.

Why Minnesota is no longer in this comparison

Earlier versions had a Minnesota section built on "HF 4873 (AI Policy Act)" with an opt-out right for candidates. The Minnesota Revisor's records for HF 4873 show a 2024 bill about supplemental nursing services agencies and a 2026 bill about a St. Cloud sales tax, neither about AI in hiring (2024, 2026). We found no Minnesota law giving candidates an AI opt-out, so we removed the section. Our Minnesota AI legislation guide covers what Minnesota has.

Comparison table

Jurisdiction	Independent audit required	Audit frequency	Candidate notice	After a decision	Enforcement
NYC (Local Law 144)	Yes	Within one year before use	10 business days before use	Request for an alternative process or accommodation	DCWP civil penalties; civil actions not limited
Colorado (SB 26-189, from Jan 1, 2027)	No	None	Before use	Explanation within 30 days, data correction, human review	Attorney General only, deceptive trade practice, cure period
New Jersey (LAD guidance)	No (listed as an optional step)	None set	Listed as an optional step	Discrimination complaint	Division on Civil Rights complaint within 180 days

The audit column is where NYC stands alone. The last column is where the risk sits: in New Jersey, a biased outcome can be a LAD violation whoever built the tool and whether or not you meant it.

A laptop on a sofa showing a dashboard with charts and a donut graph, representing AI bias audit requirements by state Image: Unsplash.

What "multi-state employer" actually means in practice

Consider a concrete example. A company is headquartered in Chicago, has a New York City sales office and employs remote engineers in Colorado and New Jersey. It uses an AI resume screening tool for all open roles and an AI performance evaluation system for all employees.

For the resume screening tool:

NYC Local Law 144 applies to candidates for jobs at the NYC office. The tool needs a bias audit no more than a year old, a posted results summary, and notice to NYC-resident candidates 10 business days before use.
Colorado SB 26-189 applies to candidates for the Colorado engineering roles, for decisions made from January 1, 2027. The company must post a notice before the screener is used, send a plain-language explanation within the 30-day window after any rejection the tool materially influenced, and offer data correction and human review.
In New Jersey, no audit or notice is mandated, but a screener that screens out a protected group can be a LAD violation even though a vendor built it.
Illinois has its own disclosure requirements under the state AI employment law that apply to the Chicago headquarters roles.

For the performance evaluation system:

Colorado's law applies to the Colorado employees from January 1, 2027, if the system's scores materially influence pay, promotion or termination. Notice before use; after an adverse outcome, an explanation, data correction and human review.
NYC's law applies if the system screens NYC employees for promotion and substantially assists or replaces discretionary decision-making. Then it's an AEDT and needs the yearly audit.

One AI tool, several regimes, different obligations for each candidate and employee population.

This is why a single compliance policy covering "AI in HR" is not sufficient. The policy needs to be jurisdiction-aware at the level of individual tool deployment and individual candidate population.

What an NYC bias audit actually calculates

DCWP's FAQ sets the minimum: the auditor calculates selection rates (for a tool that selects) or scoring rates (for a tool that scores), and the impact ratio, across sex categories, race/ethnicity categories and intersectional categories. The published summary shows the number of applicants, those rates and the impact ratios for all categories (DCWP FAQ).

Page 3 of the NYC DCWP AEDT FAQ: what the published bias audit summary must include, and that a bias audit can be relied on for one year Screenshot: NYC Department of Consumer and Worker Protection, Automated Employment Decision Tools FAQ (June 29, 2023), page 3.

An employer can use historical data from its own use of the tool, or from other employers using it if it provides its own data or has never used the tool. Test data is allowed when there isn't enough historical data. We didn't find an official source for audit prices, so we don't quote one; get quotes from more than one independent auditor and ask what data they need from your vendor.

New Jersey and Colorado don't require an audit. Running the same impact-ratio analysis on your New Jersey and Colorado applicants is still the cheapest way to spot a problem before a complaint does.

For a wider view of state hiring laws, see the AI hiring tool compliance US state laws overview.

5-step action plan for multi-state employers

Step 1: Map every AI tool used in hiring and promotion decisions

Start with a complete inventory. Include resume screening tools, applicant tracking system ranking features, video interview analysis software, skills assessment platforms, and any AI-assisted performance evaluation or succession planning tools. Include AI features embedded in broader HR software platforms, which can be switched on without a separate purchase.

For each tool, document: what decisions it affects, what candidate or employee population it touches, and which jurisdictions those people are located in.

Step 2: Identify which candidate populations are in which jurisdictions

Build a matrix. For each open role or hiring process, record whether candidates will come from or be employed in NYC, Colorado, New Jersey, or Illinois. For existing employees, record current work locations.

This does not need to be real-time. A quarterly review of hiring activity by jurisdiction is sufficient for most employers. What matters is that you have a current picture before deploying a tool or before a hiring cycle begins.

Step 3: Determine which laws apply to each tool-population combination

Using the inventory from Step 1 and the population map from Step 2, apply the jurisdictional matrix from the comparison table above. Document your conclusions. This documentation serves two purposes: it tells your HR operations team what procedures to follow, and it demonstrates reasonable care if you face a regulatory inquiry.

Some combinations will be clear. If you use an AI resume screener for any NYC role, NYC Local Law 144 applies. If an AI performance evaluation tool materially influences pay or promotion for Colorado employees, Colorado SB 26-189 applies to those decisions from January 1, 2027.

Other combinations require judgment. If a New Jersey resident applies for a role tied to the NYC office, NYC's notice goes to NYC residents, but the audit duty still applies to the tool, and the LAD may still reach the decision. Document your reasoning.

Step 4: Commission the required audits and assessments

For NYC: commission an independent bias audit if the current one is more than a year old by the time of your next use, and post the results summary and the tool's distribution date before use.

For New Jersey: nothing is mandated, but the guidance lists impact assessments and pre- and post-deployment bias audits by independent parties among the steps that can help. Keeping the NYC-style impact-ratio analysis for New Jersey applicants, with notes on what you changed in response, is a sensible record.

For Colorado: no assessment is required. Before January 1, 2027, ask each vendor for the documentation SB 26-189 requires it to provide, publish the pre-use notice, draft the adverse-outcome letter, name who handles human review, and set records to be kept for three years.

Step 5: Implement candidate notice workflows with jurisdiction-specific copy

Each jurisdiction requires different content in candidate notices. NYC requires notice at least 10 business days before use, saying an AEDT will be used and what it assesses, and allowing a request for an alternative process or accommodation. Colorado requires a notice before use and, after an adverse outcome the tool materially influenced, a plain-language explanation with instructions for correction and human review.

Build these as separate notice templates, not a single generic disclosure. A single disclosure that tries to satisfy every jurisdiction at once usually satisfies none of them clearly. Maintain records of when each notice was sent and to which candidates.

For a practical checklist tied to federal EEOC guidance in addition to these state requirements, see the EEOC AI hiring guidance employer checklist.

What to do next

If your company has NYC candidates or employees in an automated screening step and no bias audit from the past year, that is your most urgent gap: each day of use without one is a separate violation.

If you have Colorado employees or candidates for Colorado roles, plan for SB 26-189, which replaced SB 24-205 and covers decisions made from January 1, 2027. Comments on the Attorney General's draft rules close October 26, 2026; the AI regulation deadline calendar tracks both dates.

For New Jersey, nothing needs filing, but the guidance makes the vendor's tool your responsibility. Ask vendors for their bias testing and run your own numbers.

The Illinois AI employment disclosure law covers the fourth jurisdiction for employers with operations in that state and is worth reviewing alongside this analysis.

For the full landscape of state AI hiring laws beyond these jurisdictions, see the AI hiring tool compliance US state laws overview.

What we could not confirm: whether any New Jersey AI hiring bill, including A4115, has been enacted; the New Jersey Legislature's site didn't load for us on October 15, 2026. We also found no official source for typical audit prices.

Correction (October 15, 2026): Earlier versions said Colorado SB 24-205 took effect February 1, 2026. It never took effect as written: SB 26-189 repealed and reenacted it, with duties starting January 1, 2027. Later the same day we also rewrote the Colorado section, the comparison row, the example and the action steps. They had described duties from the 2024 law (reasonable care, a 50-employee threshold, impact assessments, ongoing monitoring and an appeal right) as if they applied. SB 26-189 has none of those; its duties are notice before use, an explanation after an adverse outcome, data correction, human review and three-year records, checked against the signed act.

Correction (October 15, 2026, second update): We checked the NYC, Minnesota and New Jersey sections against official sources. NYC penalties were wrong: we understated the first-violation maximum, which the law sets at up to $500, with $500 to $1,500 for later ones. The notice period is 10 business days, the law doesn't bar candidates' civil actions, and we removed a claim about how long results must stay posted that we couldn't check against DCWP's rules. The Minnesota section described a law we couldn't find (HF 4873 is not an AI bill), so we removed it. The New Jersey section relied on bill A4115, which we couldn't confirm was enacted, and said the guidance recommends annual analysis and that New Jersey accepts internal assessments in place of audits; the January 2025 guidance says neither. We also removed audit price estimates we couldn't source.