What employers have to say, where, and starting when. A jurisdiction-by-jurisdiction briefing covering Ontario, Illinois, New York City, California, Colorado, Connecticut and the European Union.
| Subject | What employers have to say, where, and starting when |
| Prepared by | Julien Gagnier, CHRL, MBA, Virvell |
| Jurisdictions | Canada, United States, European Union |
| Date | September 2026 |
General information only, not legal advice. Requirements change and interpretation varies by situation.
Most talent teams adopted AI screening tools before the rules caught up. As of 2026 those rules exist, they differ by jurisdiction, and in Ontario and Illinois they are already enforceable.
If AI touches who moves forward in your process, you now have to say so in writing, in the places candidates see. That is the whole obligation in most jurisdictions. You do not have to explain how the tool works or publish your vendor's methodology.
The failure mode is not complexity. It is simply not having added the line.
| Jurisdiction | Status | Core obligation |
|---|---|---|
| Ontario | In force Jan 1, 2026 | Disclose AI use in every public job posting. Employers with 25+ employees. |
| Illinois | In force Jan 1, 2026 | Notify applicants of AI use. Discriminatory effect is itself a civil rights violation. |
| New York City | In force July 2023 | Independent bias audit, published results, candidate notice 10 business days ahead. |
| California | In force Oct 1, 2025 | Discrimination rules cover automated systems at employers with 5+ staff. Four-year records. Separate privacy rules land Jan 1, 2027. |
| Colorado | Jan 1, 2027, enforcement stayed | Notice, adverse outcome explanation, human review, three-year retention. Currently enjoined. |
| Connecticut | Phasing in from Oct 1, 2026 | Disclosure and pre-decision notice duties for automated employment tools. |
| European Union | Dec 2, 2027 | Full high-risk regime for hiring systems. Transparency and AI literacy already apply. |
Colorado and the EU both moved their dates in 2026. Neither regime was withdrawn, only deferred, and the deferred obligations are broader than what is in force today.
This is the one most Canadian employers are behind on, and it applies to a large share of the mid-market.
| Who is covered | Employers with 25 or more employees |
| What is required | Every publicly advertised job posting must state whether AI is used to screen, assess, or select applicants. The same wording belongs on any associated application form. |
| Source | Amendments to the Employment Standards Act, 2000, through the Working for Workers legislation |
| Enforcement | Treated like any other employment standard |
These tend to get missed together:
The Ministry has not issued guidance on what counts as artificial intelligence, or how to read the words screen, assess, and select. The statutory definition is broad. Practically, if a tool influences who moves forward, treat it as covered and say so.
HB 3773 amended the Illinois Human Rights Act. Beyond the notice duty, it makes AI that produces a discriminatory effect on protected classes a violation in itself, including unintentional disparate impact, and bans using ZIP codes as a proxy for protected characteristics. There is no audit you can publish to cure a bad outcome, which makes it stricter in substance than the New York City model. It stacks with the Illinois AI Video Interview Act, in place since 2020. The Department of Human Rights proposed implementing rules in May 2026 covering when and how notice must be given, so the operational detail is still settling.
The employers most exposed are often the ones with no Illinois office. The Act reaches employment in Illinois, so a distributed company hiring remotely can pull Illinois applicants through the same automated funnel as everyone else.
Local Law 144 covers automated employment decision tools and remains the most procedurally demanding regime in North America. A December 2025 State Comptroller audit found significant gaps in enforcement, which has not changed what employers owe.
Two separate regimes, on two separate clocks. Civil Rights Council regulations have applied since October 1, 2025 to employers with five or more employees in the state. They make the presence or absence of bias testing explicitly relevant to discrimination claims and require automated-decision data to be kept for four years.
The privacy agency rules are the ones still ahead. They add pre-use notice, access and opt-out rights where automated technology replaces or substantially replaces human judgment, with compliance required by January 1, 2027, including for tools already running.
The original AI Act slipped twice and was then substantially rewritten by SB 26-189, signed May 14, 2026. The narrower version drops risk management programs and impact assessments, keeping notice before use, an explanation when an outcome goes against someone, a correction right, human review, and three-year retention. Enforcement sits with the Attorney General alone, through the Consumer Protection Act, with a sixty-day cure period and no private right of action.
Treat the January date as provisional. A federal court enjoined enforcement of the predecessor law in April 2026 in xAI v. Weiser, the stay reaches the replacement, and the Attorney General was still in pre-rulemaking as of mid-2026. What adequate notice actually looks like will be set by rules that do not yet exist.
The EU AI Act treats AI used in hiring and worker management as high risk. Those duties were set for August 2, 2026, but the Digital Omnibus, Regulation (EU) 2026/1744, in force July 27, 2026, pushed them to December 2, 2027.
The deferral bought time rather than relief. Risk management, data governance, human oversight, and documentation all still apply on the later date, and the transparency provisions under Article 50 were never deferred at all. Neither was the Article 4 AI literacy duty, which has bound providers and deployers since February 2025 and was reworded in July 2026.
We use automated tools, including artificial intelligence, to help review and screen applications for this role. All hiring decisions are made by our team.
Adapt to your process. Short and plain is the goal.
If your team signs off on each outcome, say that too. It is accurate, it reassures candidates, and it is the fact most relevant to the frameworks above.
Guidance from regulators is still thin. Ontario has published no interpretation of its own key terms, Illinois is mid-rulemaking, Colorado cannot currently be enforced, and the European timeline has moved twice. A federal executive order signed in December 2025 directed the Justice Department to challenge state AI laws it considers onerous, naming Colorado's directly, and that effort is still working its way through the courts. Anyone claiming certainty about the edges is overstating it, this document included.
What is stable is the direction. Every framework surveyed here converges on one distinction: does the AI make the decision, or does it give a person better information to make it?
Tools that score, rank, or reject automatically sit in the high-risk tier everywhere. They pull in bias audits, adverse action procedures, appeal rights, and the heaviest documentation burden. Tools that gather and organize evidence while leaving each call to a human carry a materially lighter load, because a person is accountable for the outcome and can explain it.
When evaluating a screening vendor, that question is worth asking before the pricing question.
Virvell combines AI pre-screen interviews, voice AI reference checks, and background verification in one platform, with an evidence layer that maps each candidate claim back to the role's requirements and shows where sources agree, conflict, or leave gaps. Recruiters see the evidence and make every call. No candidate scoring, no rankings, no automated rejection.