What HR Leaders Need to Know Now: AI Rules, Federal vs. State, and Your Next Moves
The ground under AI in HR is shifting. A new federal executive order aims to set national standards, while states continue enforcing their own rules. HR teams are caught between two clocks: comply today, prepare for change tomorrow.
The play is simple: keep your programs compliant, build a stronger AI governance muscle, and set a cadence to track what changes next. That balance will protect hiring pipelines, performance systems, and workforce analytics without stalling innovation.
What's Actually Happening
Executive Order 14365 seeks uniform federal standards and challenges certain state AI laws. The Department of Justice formed an AI Litigation Task Force, and the Department of Commerce is flagging "onerous" state rules for possible legal action by early March 2026. Some federal funding may hinge on a state's regulatory posture.
States are expected to fight back, arguing an executive order can't preempt state law without Congress. Meanwhile, laws in places like California, Colorado, Illinois, Texas, and New York City continue to apply. Until courts say otherwise, employers must still follow existing state and local rules.
What This Means for Your HR Stack
Anything that screens, ranks, scores, or evaluates people is in scope: résumé screening, video interview analysis, assessments, performance ratings, career pathing, and monitoring tools. Vendor claims won't cover your risk-your name is on the decision. Audit access, explainability, change logs, and adverse impact reporting are the new table stakes.
Your Current Compliance Checklist
- New York City Local Law 144 (effective Jan 1, 2023): Bias audits and candidate notice for automated employment decision tools. See guidance from NYC's consumer agency here.
- California Civil Rights Department AI Regulations (effective Oct 1, 2025): Anti-discrimination requirements for AI used in employment decisions.
- Illinois AI Discrimination Law (effective Jan 1, 2026): Notice and fairness obligations for AI hiring tools.
- California Consumer Privacy Agency AEDT Regulations: Enhanced privacy and consent requirements tied to automated decision tools.
- Colorado Consumer AI Law (effective Jun 30, 2026): Disclosure and risk assessment duties for certain AI uses.
- EU AI Act (enforceable Aug 2, 2026): Classifies employment-related AI as high-risk, with strict obligations. Background from the European Commission here.
Global employers should also scan local guidance in other countries. Expect more rules, not fewer.
Five Moves to Make Now
- Stand up AI governance. Form a cross-functional group (HR, Legal, IT, Compliance). Assign owners, approval gates, and an issue escalation path. Keep a live AI register listing each tool, purpose, data used, population affected, and decision authority.
- Set clear policies. Cover notice, consent, human review, documentation, vendor oversight, and retention. Map which tools are used in which processes-sourcing, screening, interviewing, assessment, performance, promotion, and termination.
- Train the people who use the tools. HR, recruiters, and managers should know where AI helps-and where a human must step in. Include bias basics, adverse impact, recordkeeping, and how to handle candidate or employee inquiries.
- Audit for impact. Run periodic adverse impact testing on outcomes, not just inputs. If a tool causes significant adverse effect on a protected group, be ready to show it is job-related and consistent with business necessity-and consider less-discriminatory alternatives.
- Track legal changes and ask for clarity. Monitor litigation tied to the executive order and check state agency guidance. Document your interpretations and decisions. Refresh policies and vendor terms as rules shift.
Vendor and Data Guardrails That Save You Later
- Contracts: Audit rights, transparency on model updates, prompt breach and defect notice, assistance with audits, termination for non-compliance.
- Documentation: Impact assessments, data dictionary, training data sources, model change logs, and decision override records.
- Privacy and security: Data minimization, retention schedules, role-based access, and clear consent language where required.
Cadence That Keeps You Compliant
- Monthly: Review legal trackers, vendor change notes, and any flagged incidents.
- Quarterly: Run adverse impact tests, refresh risk assessments, and validate notices and consent flows.
- Annually: Re-audit high-impact tools, renegotiate vendor terms if needed, and retrain teams.
The Bigger Picture for HR Strategy
All 50 states, Puerto Rico, the Virgin Islands, and D.C. have introduced AI bills. California leads in enacted measures, with Texas, Utah, and New York also active. Even if some state AI laws get preempted in court, federal anti-discrimination rules and general state laws still apply. Good governance isn't optional; it's how you keep hiring and performance programs credible and defensible.
If your team needs structured upskilling on AI in HR, vendor selection, and practical compliance, explore curated learning paths here.
Bottom line: Keep following current law, build durable governance, and set a steady review rhythm. That approach will hold up whether federal policy wins, state rules persist, or both keep you busy for years.
Your membership also unlocks:
