Most guides to AI compliance are written either for companies that build AI or for compliance teams shopping for AI tools. This one is for the larger group in between: companies that use AI at work and need to know which rules apply to them. The surprise is how little of it is new. Most of what you owe comes from laws you already follow. The new AI-specific laws reach a narrow set of uses, mostly decisions about people, but they reach them hard.
What is AI compliance?
AI compliance means making sure the way your company uses AI meets the laws, regulations and contracts that apply to it: existing law on discrimination, privacy and consumer protection, your sector's rules, the new state and city AI laws where you hire and sell, the EU AI Act if your AI's output is used in the EU, and the AI terms in your contracts. For a US company of 20 to 1,000 people, it comes down to knowing what AI you use, which of those uses decide something about a person, and which dates apply to you.
This guide is for the COOs, HR leads and IT leads who end up owning that question. It covers the US rules and the EU AI Act as of November 2026. It isn't about AI software that does compliance work for you (that's sometimes called "AI in compliance"), and it isn't legal advice.
Are there AI laws in the US?
There's no federal AI law that governs how a company uses AI, but several states and one city have AI laws that reach employers, and existing federal and state laws apply to AI the same way they apply to anything else.
The federal government's stance is to push back on state rules. Executive Order 14365, signed on December 11, 2025, complains that state-by-state regulation "creates a patchwork of 50 different regulatory regimes". It set up an AI Litigation Task Force at the Justice Department "whose sole responsibility shall be to challenge State AI laws", and asked for a federal law that would preempt the ones that conflict with its policy. An executive order can't repeal a state law, though. Until a court strikes one down or Congress overrides it, the state laws below apply.
They mostly don't regulate AI in general. They regulate AI that helps decide something about a person, and almost all of them start with hiring:
| Where | The rule | Who it reaches | In force |
|---|---|---|---|
| New York City | Local Law 144: a bias audit within one year of use, a public summary of it, and notice to candidates who live in the city 10 business days before use | Employers and employment agencies using an automated tool to screen candidates or employees for jobs tied to an office in the city | Enforced since July 5, 2023 |
| California | Civil Rights Council rules applying anti-discrimination law to automated-decision systems | California employers | October 1, 2025 |
| Illinois | HB 3773: no AI that "has the effect" of discriminating, no zip codes as a proxy, and notice to employees | Employers covered by the Illinois Human Rights Act | January 1, 2026 |
| Texas | TRAIGA: no AI deployed "with the intent to unlawfully discriminate". Disparate impact alone isn't enough to show intent | Anyone who conducts business in Texas | January 1, 2026 |
| Connecticut | Public Act 26-15: using an AI hiring tool "shall not be a defense" to a discrimination complaint | Connecticut employers | October 1, 2026 |
| Colorado | SB 26-189: notice before use, an explanation within 30 days of an adverse outcome, correction, human review and three years of records | Anyone doing business in Colorado that uses a tool to materially influence a consequential decision, including hiring | January 1, 2027 |
The awareness gap is real. In SHRM's survey of HR professionals in December 2025, 57% of those in states with workforce-related AI rules said they weren't aware of them.
Which AI compliance requirements apply to your company?
What applies depends on three things: what each AI use does, where the people it affects are, and which rules your sector and contracts already put on you. It helps to think in four layers. Every use sits in the first and the last. The two in between reach fewer uses, and the third reaches the fewest, but that's where the new AI laws are.
Layer 1: the laws you already follow
Anti-discrimination, privacy, consumer protection and employment law don't stop applying because a tool did the work. Connecticut wrote that into statute, and Illinois' rule bans AI with a discriminatory effect whatever the intent. If staff paste customer data into a chatbot, your existing privacy commitments decide whether they could. If a chatbot answers your customers, your existing consumer protection duties cover what it says. This layer covers every use on your list, which is why the AI usage policy matters more than any single new law.
Layer 2: your sector's rules
Some sectors already require a contract before a vendor touches regulated data, and an AI vendor is a vendor. Under HIPAA, a covered entity may let a business associate handle protected health information only if it gets "satisfactory assurance" that the vendor will safeguard it, documented in a written contract. That's why HIPAA compliant AI depends on a signed business associate agreement and the right plan, not on the tool. Law firms and accounting firms have their own professional duties on confidentiality and supervision; we cover them in AI in law firms and AI for accounting firms.
Layer 3: AI-specific laws where you hire, sell and operate
This is the layer in the table above. Ask where the jobs are, and where the applicants and employees are, not where your headquarters is. Each law draws its own line. New York City's covers a job tied to an office in the city (or an employment agency based there), whoever applies, and owes notice to candidates who live in the city. Colorado's protects Colorado residents and anyone whose opportunity in Colorado is being evaluated. A company based in Ohio that hires for offices in Chicago and New York City has Illinois and New York City duties for those roles.
Two dates are close:
- Colorado, January 1, 2027. The law applies to decisions made from that date. The attorney general held the rulemaking hearing on October 26, 2026, and is drafting the final rules.
- California, July 1, 2027. SB 947, signed on September 30, 2026, stops employers relying solely on automated-decision systems to discipline or fire workers, requires human oversight and verification, and requires notice. The start date comes from reporting by HR Dive; the author's release doesn't give one.
The EU AI Act, if your AI's output is used in the EU
The EU AI Act reaches companies outside the EU. It covers deployers in a third country "where the output produced by the AI system" is used in the Union. For a US company, the usual way in is hiring: AI that screens applicants for a role in Europe.
The AI Omnibus, which entered into force on July 27, 2026, moved the dates. The rules for high-risk uses in sensitive areas, including employment, apply from December 2, 2027. For high-risk AI built into regulated products such as lifts or toys, they apply from August 2, 2028. Two parts already apply: the bans on prohibited practices and the AI literacy duty, both since February 2, 2025. Chatbots carry a transparency duty too: people should be made aware they're talking to a machine. We set the EU duties against NIST and ISO in our AI governance framework guide.
Layer 4: your contracts
Some of the strictest AI rules you'll meet aren't laws. Customers send security questionnaires that ask which AI tools touch their data and whether you follow a framework such as the NIST AI RMF or ISO 42001. Your vendors' terms decide whether your data trains their models, how long they keep it, and who can see it. Those terms differ by plan: the same vendor can treat a personal account and a business workspace very differently, as our ChatGPT Plus vs Business comparison shows. Compliance here means reading the terms of every tool on your list and keeping your promises to customers in line with them.
Which uses carry the most AI compliance risk?
The uses that score, rank, flag or decide something about a person carry nearly all the AI-specific duties; drafting, summarizing and research carry almost none beyond your existing law and policy. That gives you a fast way to triage your list.
A recruiter who asks a chatbot to draft a job ad is in layer 1. The same recruiter asking it to rank 200 applicants may be in all four layers at once: discrimination law, any sector rules on applicant data, the AI hiring laws for wherever those applicants live, and the vendor terms of the chatbot. The tool didn't change. What it was used for did.
A compliance calendar for 2026 to 2028
These are the AI-specific dates a US employer is most likely to meet. Put the ones that apply to you on the calendar with an owner.
| Date | Where | What starts |
|---|---|---|
| July 5, 2023, then yearly | New York City | Enforcement starts; each tool's bias audit must be no more than a year old when it's used |
| February 2, 2025 | EU | Prohibited practices and the AI literacy duty |
| January 1, 2026 | Illinois, Texas | Illinois' notice duty and effect-based ban; Texas' intent-based ban |
| October 1, 2026 | Connecticut | AI is no defense to a discrimination complaint; employers filing WARN notices must tell the state whether the layoffs relate to AI |
| January 1, 2027 | Colorado | Notice, 30-day explanations, correction, human review, three-year records |
| July 1, 2027 | California | SB 947's limits on AI in discipline and firing (date from secondary reporting) |
| October 1, 2027 | Connecticut | Written notice before an AI-assisted employment decision |
| December 2, 2027 | EU | High-risk rules for employment and other Annex III areas |
| August 2, 2028 | EU | High-risk rules for AI built into regulated products |
Penalties vary as much as the dates. Texas, for example, sets civil penalties of $10,000 to $12,000 for each curable violation that isn't cured, and $80,000 to $200,000 for each one that can't be, enforced only by the attorney general after a 60-day chance to cure. Colorado also gives a 60-day cure period.
Compliance starts with a list, and the list needs owners
Every one of these laws assumes you know which tools you use and what for. Most companies don't. AI arrives in three ways: tools someone bought as AI, AI features vendors switch on inside software you already pay for, and personal accounts staff use on their own. A law like Colorado's doesn't care which way a ranking tool arrived.
That's why our framework starts its guardrails with a list of approved tools and a data map, and gives every use an owner, a backup and a review date. Your AI list, in module 3 of our free course, builds the list with an owner on every row. Data map sorts which data may go into which tool. The compliance work in the steps below is mostly filling in two more columns on that list: which layers each use sits in, and which dates apply. It's also the groundwork for deploying AI more widely, because the same list tells you what's safe to scale.
How to get compliant: six steps
There are six steps, in order. Each one produces what the next one needs.
01 · Make the list
List every AI tool and AI feature in use, with who uses it, what for, and on what plan. Include the features inside your applicant tracking system, CRM and office suite, and ask teams what they use on personal accounts. The free Shadow AI Audit is a quick way to start, and our AI audit guide has the full checklist.
02 · Mark every use that decides something about a person
For each use, ask whether its output scores, ranks, flags, recommends or classifies a person before someone decides about them. Hiring, promotion, discipline, firing, pay, credit, housing and access to services are the usual ones. Mark those uses. Write down why the others aren't, so you can show your reasoning later.
03 · Map the marked uses to places and dates
For each marked use, note where the jobs or services are and where the affected people live: which states, which cities, and whether any are in the EU. Some laws turn on the job's location, others on the person's. Match them against the table and the calendar above. The output is a short list of duties per use: an audit, a notice, an explanation process, a human reviewer, records.
04 · Put the rules in writing
Your AI usage policy should say which tools are approved, what data may go into each, and that chatbot output isn't used to decide who gets hired, promoted or let go unless the use has been through steps 02 and 03. The AI usage policy generator drafts one in a few minutes.
05 · Check the paperwork with every vendor
For each tool, confirm the plan you're on, whether your data trains its models, retention, and who at the vendor can see your data. For tools in the marked uses, ask for the documentation your notices and audits need: what the tool does, what data it uses and its known limitations. Where a sector rule applies, get the contract it requires, such as a business associate agreement, signed before any regulated data goes in.
06 · Give each use an owner and a review date
Name an owner and a backup for each marked use, and put every date from step 03 on a shared calendar. Review the list every quarter and whenever a vendor ships a material update. Review dates, in module 7 of our course, sets up the rhythm, and an AI council can make the cross-team calls.
If you'd rather have help working through the list and the dates, our AI governance service does this with you.
What's still open
- Federal preemption. The Justice Department's task force can challenge state AI laws in court, and the executive order asks Congress for a law that would preempt the ones that conflict with federal policy. Neither has happened yet to the laws in this guide.
- Colorado's final rules. The attorney general is drafting them after the October 26, 2026, hearing. They decide how many tools count as materially influencing a decision.
- California's start date. SB 947's July 1, 2027, date comes from secondary reporting; we'll confirm it against the chaptered text.
- New laws. This guide covers the AI laws in force or signed as of November 2026. Any state can add one.
We'll update this article when a court rules on a state AI law, Colorado's rules are final, or a new state law passes. The date at the top of the page shows when we last checked.
Sources
- Ensuring a National Policy Framework for Artificial Intelligence, The White House, December 2025: Executive Order 14365, the AI Litigation Task Force and the call for preemptive legislation.
- Automated Employment Decision Tools and Frequently Asked Questions, NYC Department of Consumer and Worker Protection: the bias audit, notices, the 10-business-day rule and the July 5, 2023, enforcement date.
- 775 ILCS 5/2-102, Illinois General Assembly: the AI provision and its January 1, 2026, effective date.
- Rulemaking actions, California Civil Rights Council: the automated-decision systems regulations and their October 1, 2025, effective date.
- Newsom signs McNerney's No Robo Bosses Act of 2026, Office of Senator McNerney, September 2026: what SB 947 requires and when it was signed.
- California revamps AI protections for workers, HR Dive, October 2026 (secondary): SB 947's July 1, 2027, start date.
- House Bill 149, enrolled version, Texas Legislature, 2025: the intent rule, enforcement, the cure period, penalties and the January 1, 2026, effective date.
- Public Act 26-15, Connecticut General Assembly, May 2026: the no-defense rule, the WARN disclosure and the October 1, 2027, notice duty.
- SB 26-189, signed act, Colorado General Assembly, May 2026: the duties, the 60-day cure period and the January 1, 2027, start.
- Automated Decision-Making Technology rulemaking, Colorado Attorney General, checked November 2026: the hearing date and the status of the final rules.
- AI Act: regulatory framework for AI, European Commission, checked November 2026: the application dates, the AI Omnibus and its entry into force, and the chatbot transparency duty.
- Article 2: Scope, EU AI Act Explorer (secondary, a reproduction of the act's text), checked November 2026: coverage of deployers outside the EU.
- 45 CFR 164.502, eCFR, November 2026: the satisfactory-assurance rule for business associates.
- The State of AI in HR 2026, full report, SHRM, 2026: the survey of HR professionals in December 2025 and the 57% unaware of state AI rules.