AI Interview Rules in 2027: Colorado, California, Illinois, NYC and the EU (Nov 2026)

Fact-checked on 3 Nov 2026 against the official texts in the Sources list.

TLDR

• A buyer can check a written assessment per question against a transcript timed to the recording, with integrity signals shown as evidence and a person deciding. Two AI hiring rules start on 1 January 2027 and others already apply; this page makes no compliance claim for Tracy.
• Two rules start on 1 January 2027: Colorado's SB 26-189 and California's privacy-agency ADMT rules. California's employment regulations have applied since 1 October 2025.
• Explained from the official text, not legal advice. Whether a rule covers your hiring is a question for your counsel.

"AI hiring laws 2027" suggests one date. The rules that touch an AI interview carry several, and not all of them fall in 2027. This guide lists each rule that touches an AI interview, with its date and its official words, so you can see what already applies, what starts on 1 January 2027 and what to ask any vendor. It explains the texts. It does not tell you whether a rule covers your hiring, because that depends on facts only you and your counsel have.

If you are still deciding what an AI interview is, start with what an AI interviewer is, or see the numbers on AI in hiring.

The dates at a glance

Each date is when the rule takes effect or, for the California privacy agency, when compliance is due.

Some summaries say two state rules start on 1 January 2027. That is close, but the pair is Colorado's SB 26-189 and California's privacy-agency rule, not California's employment regulations.

Colorado: SB 26-189 starts on 1 January 2027

Colorado's date has moved twice. The 2024 act, SB 24-205, was set for 1 February 2026. A 2025 special-session bill, SB 25B-004, moved it to 30 June 2026. Then in May 2026 the legislature repealed and reenacted the law as SB 26-189, which the governor signed on 14 May 2026. Older articles that give either earlier date are out of date.

The signed act says: "Except as otherwise provided in subsection (2) of this section, this act takes effect January 1, 2027." Subsection (2) lists a few provisions, including the appropriation and the safety clause, that took effect on passage. The duties described below start on 1 January 2027, and the act applies to consequential decisions made on or after that date. The official bill summary, which we read on the Colorado General Assembly bill page, defines a consequential decision as one that relates to an individual's "access to, eligibility for, or compensation related to education, employment" and other listed areas, so hiring is in the frame.

What the official summary says a deployer, meaning the organisation using the technology, must do:

• Notice. "mandating that deployers provide clear and conspicuous notice to consumers at the point of interaction with a covered ADMT."
• Explanation. "A deployer is required to provide a consumer with a plain language description of a covered ADMT's role within 30 days after the covered ADMT makes a consequential decision that results in an adverse outcome for the consumer."
• Human review. "The act also grants consumers the right to request meaningful human review and reconsideration following a covered ADMT making a consequential decision resulting in an adverse outcome."
• Records. "Both developers and deployers are required to retain records necessary to demonstrate compliance with the act for at least 3 years."

The summary adds that the attorney general must adopt rules on the post-adverse-outcome disclosures by 1 January 2027, and that before 1 January 2030 the attorney general must give a 60-day notice and chance to cure where a cure is possible.

On timing, a law firm note published on 11 May 2026, before the bill was signed, reported that a federal magistrate judge had stayed enforcement of the earlier law on 27 April 2026 and that the attorney general had said it "does not intend to enforce [the CO AI Law] or any legislation replacing or amending [the CO AI Law] until after the rulemaking process has concluded." We did not verify the current position against the court docket or the attorney general, so treat 1 January 2027 as the date the statute takes effect and check with the attorney general before you plan around an enforcement date.

California: two sets of rules, two dates

Two California bodies issued rules about automated systems, with different dates.

Civil Rights Council regulations: already in force

The Civil Rights Council's page says: "The effective date of the regulations is October 1, 2025." (The same page carries a second sentence about the same regulations and an April 2026 date under a different heading, the contractor-nondiscrimination entry. We read the 1 October 2025 date as the one that applies, and you should confirm with the Council.)

The Council's press release says the regulations "clarify the application of existing antidiscrimination laws" to tools like these. Among other things they aim to:

• "Make it clear that the use of an automated-decision system may violate California law if it harms applicants or employees based on protected characteristics, such as gender, race, or disability."
• "Ensure employers and covered entities maintain employment records, including automated-decision data, for a minimum of four years."
• "Affirm that automated-decision system assessments, including tests, questions, or puzzle games that elicit information about a disability, may constitute an unlawful medical inquiry."

We read the Council's press release, not the final text, because the final-text PDF is a scanned image.

CPPA ADMT rules: compliance from 1 January 2027

The privacy agency's rules are a separate set under the California Consumer Privacy Act. The agency announced on 23 September 2025 that "The regulations go into effect January 1, 2026" with more time for some parts, including automated decisionmaking technology. We read the regulation text itself. Section 7200(b) says: "A business that uses ADMT for a significant decision prior to January 1, 2027, must be in compliance with the requirements of this Article no later than January 1, 2027."

Two definitions decide who this reaches. Section 7001(ddd) lists "employment or independent contracting opportunities or compensation" among significant decisions, and (ddd)(4) says that includes "Hiring;". Section 7001(e) defines ADMT as "any technology that processes personal information and uses computation to replace human decisionmaking or substantially replace human decisionmaking." It adds that substantially replacing means using the output without human involvement, and that human involvement requires a reviewer to "Know how to interpret and use the technology’s output to make the decision;", to review the output and other relevant information, and to "Have the authority to make or change the decision based on their analysis".

The article also asks for a pre-use notice ("must provide consumers with a Pre-use Notice") and an opt-out ("A business must provide consumers with the ability to opt-out of the use of ADMT to make a significant decision concerning the consumer, except as set forth in subsection (b)"), where subsection (b) includes an appeal to a human reviewer who can overturn the decision. We did not check how the CCPA treats job applicants as "consumers", and the conditions for each exception are longer than we quote here. Take both questions to counsel.

Illinois: two laws

Illinois HB 3773 (Public Act 103-0804). The bill status page records "Effective Date January 1, 2026" and the synopsis says it is a civil rights violation, in recruitment, hiring and other employment decisions, "for an employer to use artificial intelligence that has the effect of subjecting employees to discrimination on the basis of protected classes" or to use zip codes as a proxy, and "for an employer to fail to provide notice to an employee that the employer is using artificial intelligence." The synopsis says "employee"; we did not read the act to see whether applicants are covered. We read the bill page, not the public act.

The Artificial Intelligence Video Interview Act (820 ILCS 42). This one has applied since 1 January 2020 and speaks directly to recorded video. Section 5 says an employer that asks applicants to record video interviews and uses AI analysis of them, when "considering applicants for positions based in Illinois," must, before asking, "Notify each applicant before the interview that artificial intelligence may be used to analyze the applicant's video interview and consider the applicant's fitness for the position," explain "how the artificial intelligence works and what general types of characteristics it uses to evaluate applicants," and obtain consent. It adds: "An employer may not use artificial intelligence to evaluate applicants who have not consented to the use of artificial intelligence analysis." Section 15 requires deletion of an applicant's interviews within 30 days of a request. Whether a given live interview counts as a "recorded video interview" with "artificial intelligence analysis" is a legal question, and we do not answer it. We read an archived copy of the official ilga.gov page, and later amendments were not checked. For the difference between a recorded one-way interview and a live two-way one, see one-way versus two-way video interviews.

New York City: Local Law 144

The city's Department of Consumer and Worker Protection (DCWP) says Local Law 144 of 2021 "prohibits employers and employment agencies from using an automated employment decision tool unless the tool has been subject to a bias audit within one year of the use of the tool, information about the bias audit is publicly available, and certain notices have been provided to employees or job candidates." The city rule's page gives "Effective date : July 5, 2023", and DCWP says it "will begin enforcement of this law and rule on July 5, 2023."

The law names the employer or employment agency that uses the tool. A vendor's audit helps, but the duty in the quoted sentence sits with the user.

The EU: the emotion-recognition ban

Article 5(1)(f) of the EU AI Act prohibits "the use of AI systems to infer emotions of a natural person in the areas of workplace and education institutions, except where the use of the AI system is intended to be put in place or into the market for medical or safety reasons." Article 113 says "Chapters I and II shall apply from 2 February 2025", and Article 5 sits in Chapter II. The Service Desk marks Article 113 as amended by the Digital Omnibus on AI (consolidated text as at 27 July 2026); the date for point (f) is unchanged. A later date, 2 December 2026, applies to other Article 5 points, not to point (f). The text does not mention interviews. Whether a product "infers emotions" is a legal and technical question, so ask the vendor in writing (question 6 below).

What the rules have in common

The texts above keep asking for four things:

• Telling the person. Colorado, California's CPPA rules, both Illinois laws and New York City each ask for some form of notice.
• A person who can decide. Colorado gives a right to human review on request, and the CPPA definition of ADMT turns on whether a human reviewer with authority is involved.
• Records. California says four years for automated-decision data; Colorado says at least 3 years for developers and deployers.
• Checking for bias. New York City asks for an audit and a public summary; California and Illinois treat discriminatory effect as a violation of existing law.

For how an AI interview report can support a reviewer, see what reviewers should see in an AI interview report.

What to ask any AI interview vendor

Ask them in writing. Good answers do not make anyone compliant, but they show what you are buying.

1. Does the tool score, rank or recommend, or does it record what was said? Colorado's definition of ADMT covers "predictions, recommendations, classifications, rankings, scores", and New York City's law is about tools used in decisions.
2. Who decides, and can a person see the evidence and overrule? This is the human-involvement test in the CPPA definition and the human-review right in Colorado.
3. What does the person see before the interview, and can we edit the notice? Colorado, the CPPA, Illinois and New York City each ask for notice.
4. Can you give us documentation of intended uses, known limitations and training data categories? Colorado asks developers for it from 1 January 2027.
5. Has the tool had a bias audit in the past year, and where is the public summary? This is the New York City question.
6. Does it infer emotions or personality traits from a face or a voice? This is the EU question, and the Illinois video act asks employers to explain "what general types of characteristics" the AI uses.
7. How long are recordings kept, who else sees them and how do we delete one on request? Illinois gives 30 days to delete on request.
8. What records can we export, and for how long? California says four years; Colorado at least 3.
9. How do you handle a person who asks to see or correct their data, or asks for a human review? Colorado grants these rights.

For a wider list of what to check, see how AI interviews work for employers and candidates.

What Tracy's own pages show

Tracy AI Interviewer runs a two-way video interview in the browser. Its published product and home pages say this on the points above.

• The decision. The product page says: "Tracy does not reject anyone. A person decides." The home page says: "A person reviews the evidence and decides." This helps with question 2.
• Recording and transcript. The product page says the interview is "recorded on both sides, with a transcript timed to the recording", so a reviewer reads what was said beside the recording. This helps with question 2.
• A written assessment per question. The product page says Tracy writes "an assessment for each question with the reasoning behind it". The home page says: "You read the words, then you decide." A reviewer can check each assessment against the transcript.
• Integrity signals, as signals. During the interview Tracy captures signals such as where the candidate is looking, response timing, tab switching, leaving fullscreen and an external screen. Nothing is decided during the interview: afterwards the signals are assessed together and the evidence goes to the reviewer. Tracy's cheating-detection guide says a signal calls for review and does not establish that someone cheated. A signal is not a verdict, and the person reviewing decides.
• A notice before the interview. The product page says: "People are told about the recording before it starts." That is a recording notice. It does not claim to meet any notice rule above, and what your notice must say is for you and your counsel to settle.

This page makes no claim that Tracy complies with any rule above, has had a bias audit, or has been assessed under any of them. It does not answer questions 4 to 6 for Tracy, so ask us in writing, as you would any vendor. A demo shows a real result. For the reasoning behind keeping a person in the decision, see AI interview versus human interview.

When a vendor answer is not enough

A vendor can tell you what its tool does. It cannot tell you whether a rule covers your hiring, which roles and locations count, or what your notice must say. Those answers depend on where candidates are, who you hire and how you use the output, and they belong with your counsel. If New York City's law covers a tool you use, the audit duty in the DCWP sentence sits with you as the user.

Questions

Try it free and read a real result with the recording and transcript beside it, or book a demo to ask us your vendor questions in person.

Sources

All sources retrieved 3 Nov 2026.

• Colorado General Assembly, SB 26-189 bill page: the enacted bill summary (consequential decision, notice, explanation, human review, records, enforcement), signed 14 May 2026. Opens in a browser; it refuses automated requests. The summary wording quoted above appears only here.
• Colorado General Assembly, SB 26-189 signed act (PDF): section 5, effective date and applicability (some provisions on passage, the duties on 1 Jan 2027).
• Proskauer, Major Developments Put Colorado's AI Law on Ice Ahead of Implementation, 11 May 2026: a law firm report of the stay of enforcement and the attorney general's stated intent. Secondary source, written before signing.
• California Civil Rights Council, rulemaking actions: effective date of the automated-decision-system regulations.
• California Civil Rights Council, press release of 30 Jun 2025: what the regulations do.
• California Privacy Protection Agency, announcement of 23 Sep 2025: regulations effective 1 Jan 2026 with ADMT compliance from 1 Jan 2027.
• California Privacy Protection Agency, text of regulations (PDF): ADMT definition, significant decision including hiring, sections 7200, 7220 and 7221.
• Illinois General Assembly, HB 3773 bill status: Public Act 103-0804, effective 1 Jan 2026, synopsis (archived copy of ilga.gov).
• Illinois General Assembly, Artificial Intelligence Video Interview Act, 820 ILCS 42: sections 5, 15 and 20 (archived copy of ilga.gov).
• NYC Department of Consumer and Worker Protection, Automated Employment Decision Tools: what Local Law 144 requires and enforcement from 5 Jul 2023.
• NYC Rules, Automated Employment Decision Tools (Updated): adopted rule, effective 5 Jul 2023.
• European Commission AI Act Service Desk, Article 5: prohibited practices, including emotion inference in the workplace.
• European Commission AI Act Service Desk, Article 113: application dates (page marked as amended by the Digital Omnibus on AI; point (f) date unchanged).
• Tracy AI Interviewer, home page: a person reviews the evidence and decides; you read the words, then you decide; integrity signals.
• Tracy AI Interviewer, product page: recording notice, two-way video, recording and transcript timed to it, an assessment per question, "Tracy does not reject anyone. A person decides."
• Tracy AI Interviewer, AI interview cheating detection: integrity signals flagged for review, not as proof of cheating.