Artificial Intelligence in Employment Newsletter – October 2026
Client Alert | October 5, 2026
Gibson Dunn’s AI in Employment newsletter reports on the legislative, regulatory, enforcement, and litigation developments shaping employers’ use of AI.
Artificial intelligence is reshaping the workplace. Employers increasingly rely on automated tools to source candidates, screen applications, monitor productivity, evaluate performance, and inform decisions about performance, promotion, discipline, and separation. That shift has drawn the sustained attention of legislatures, regulators, and the plaintiffs’ bar, and it has generated a fast-moving body of law that employers cannot afford to track piecemeal.
Gibson Dunn’s AI in Employment newsletter provides employers with actionable insights into this expanding and fragmented landscape. Each edition will report on the legislative, regulatory, enforcement, and litigation developments shaping employers’ use of AI.
In this inaugural edition, we provide an overview of the legislative and regulatory landscape as it stands today, with a focus on “automated decision-making” regulations that have taken effect or will take effect in the coming months, including Governor Newsom’s signing of the No Robo Bosses Act on September 30. We also review efforts to extend existing anti-discrimination laws to reach AI-driven employment decisions. These regimes share a few common requirements, including notice to employees and applicants and non-discrimination obligations, but they diverge in important respects, including scope of coverage, the specific obligations they impose, and enforcement.
Summary
- Specific laws governing the use of automated decision-making tools in the employment space are proliferating and have been enacted in California, Colorado, Connecticut, and New York City. Existing anti-discrimination laws are also expanding to explicitly address artificial intelligence tools, including in California, Connecticut, Illinois, New Jersey, and Texas.
- Scope and coverage are threshold questions, as the same tool may be subject to different obligations across jurisdictions.
- Notice is the primary cross-jurisdictional requirement, but each jurisdiction imposes additional unique obligations and considerations, such as bias audits, opt-out or human review, and record retention.
- The landscape is evolving, and employers can still shape it. Rulemaking is underway in Colorado and Illinois and new bills are pending. Employers should design compliance programs that can be adjusted rather than rebuilt as the law develops.
Below, we go into more detail, starting with a survey of the landscape, more information about the specific laws that have already passed and/or taken effect, and our key takeaways for employers.
Table of Contents
OVERVIEW OF LEGISLATIVE AND REGULATORY LANDSCAPE
Automated Decision-Making Laws
California CCPA ADMT Regulations
California S.B. 947 (No Robo Bosses Act)
Colorado S.B. 26-189 (ADMT Act)
Connecticut S.B. 5 (Public Act No. 26-15)
New York City Local Law 144AI Anti-Discrimination Laws and Regulations
California Civil Rights Council Automated-Decision System Regulations
Connecticut S.B. 5
New Jersey Division on Civil Rights Regulations
Illinois H.B. 3773
Texas H.B. 149 (TRAIGA)
OVERVIEW OF LEGISLATIVE AND REGULATORY LANDSCAPE
Automated Decision-Making Laws
As of October 2026, automated decision-making laws and regulations have been enacted in cities and states across the country, including California, Colorado, Connecticut, and New York City. The applicable laws in these four jurisdictions are summarized below.
California CCPA ADMT Regulations
The California Privacy Protection Agency’s (CalPrivacy) regulations under the California Consumer Privacy Act (CCPA) impose obligations on businesses that use “automated decision-making technology” (ADMT)—technology that uses computation to “replace” or “substantially replace” human decision-making—to make a “significant decision” about a “consumer,” including decisions regarding “employment or independent contracting opportunities or compensation,” such as hiring, compensation, promotion, allocation or assignments of work, and termination.[1] Because the CCPA defines “consumer” to include employees and independent contractors, the regulations apply to a business’s use of ADMT in the workplace.
When using ADMT in a manner subject to the regulations, a business must, among other obligations:
- Provide a pre-use notice describing the ADMT’s purpose, how the ADMT makes a decision, and what type of output the ADMT generates. The notice must also describe certain rights consumers have.[2]
- Provide consumers with the right to opt out of ADMT and the right to access information about the purpose, logic, and use of the ADMT. Employers are not required to provide a right to opt out of ADMT if the business provides a human appeal process.[3]
- Conduct a risk assessment (including for uses of ADMT since January 1, 2026), submit an attestation of completion by April 2028 (for 2026 and 2027), and update the assessment every three years and within 45 days of a material change.[4]
Businesses using ADMT for significant decisions must comply by January 1, 2027. The regulations are enforceable by CalPrivacy and the California Attorney General, with civil penalties of up to $2,663 per violation and up to $7,988 per intentional violation.
California S.B. 947 (No Robo Bosses Act)
On September 30, Governor Gavin Newsom signed S.B. 947, the No Robo Bosses Act, into law. The Act defines “automated decision system” or “ADS” as “any computational process derived from machine learning, statistical modeling, data analytics, or artificial intelligence that issues simplified output, including a score, classification, or recommendation, that is used to assist or replace human discretionary decisionmaking and materially impacts natural persons.”[5]
Among other prohibitions, the Act prohibits “rely[ing] solely on ADS when making a disciplinary or termination decision.”[6] If ADS is “primarily relie[d] upon” to make a disciplinary or termination decision, a human must corroborate the decision using information such as evaluations or reviews, witness or customer interviews, and personnel files.[7] If ADS is used to make a disciplinary or termination decision, the employer must provide a plain language “stand-alone communication” notifying the employee that ADS was used, that a human reviewed the decision, and providing contact information that the employee can use to obtain more information about the decision.[8] Employees also have the right to request “a meaningful objective description” of their own data that was used by the ADS.[9]
The Act states that employers are still subject to the CCPA ADMT Regulations.[10] Employers with unionized work forces are exempt from the Act if the collective bargaining agreement explicitly waives the obligations under the Act and “provides protection from algorithmic management.”[11] The Act goes into effect on July 1, 2027.
Colorado S.B. 26-189 (ADMT Act)
The Colorado ADMT Act repealed and replaced Colorado’s prior Artificial Intelligence Act. The revised statute adopts a framework governing ADMT, used to “materially influence” “consequential decisions,” including decisions regarding employment or employment opportunities.[12] Employers that use covered ADMT must:
- Provide a pre-use notice;[13]
- Within 30 days after a “consequential decision” resulting in an adverse outcome, provide a plain-language description of the decision and the ADMT’s role in the decision, instructions for requesting additional information, and an explanation of the consumer’s rights;[14] and
- Provide, on request after an adverse outcome, an opportunity to correct personal data used in the decision and to obtain meaningful human review and reconsideration.[15]
The law also prohibits contractual provisions that indemnify either a developer or a deployer of AI tools for claims related to discriminatory uses of ADMT.
The Colorado Attorney General has exclusive enforcement authority, and a violation constitutes a deceptive trade practice under the Colorado Consumer Protection Act, subject to a 60-day cure period when the Attorney General deems cure possible.[16]
On August 11, 2026, the Colorado Attorney General filed proposed rules to clarify and implement the Colorado ADMT Act, addressing topics including adverse outcome disclosures and consumer rights. The public comment period runs until October 26, 2026. Although the ADMT Act is formally effective as of January 1, 2027, enforcement is currently stayed by the federal district court in xAI v. Weiser. It will remain in place until the court rules on xAI’s preliminary injunction motion, which is not due until 28 days after the implementing rulemaking is finalized.
Connecticut S.B. 5 (Public Act No. 26-15)
Connecticut’s S.B. 5 regulates automated employment decision-making technology (AEDT), defined as technology that processes personal data and uses computation to generate output that is a “substantial factor”—meaning a factor that “meaningfully alters” the outcome of a decision—used to “make or materially influence” an employment-related decision.[17] S.B. 5 requires employers to:
- Disclose in plain language that an employee or applicant is interacting with an AEDT, unless a reasonable person would deem it obvious;[18]
- Provide a pre-use notice that discloses the AEDT’s purpose, the nature of the decision, information about the categories and sources of the personal data it will analyze or process, and how the data will be assessed.[19]
S.B. 5’s AEDT provisions apply to technologies deployed on or after October 1, 2027. A violation of S.B. 5 constitutes an unfair or deceptive trade practice under Connecticut’s Unfair Trade Practices Act (Conn. Gen. Stat. §§ 42-110a et seq.) and is enforced solely by the Attorney General, with a 60-day cure opportunity for violations occurring on or before December 31, 2027.[20]
Local Law 144, in effect since January 1, 2023, applies to employers and employment agencies that use an automated employment decision tool (AEDT) to “substantially assist or replace” discretionary decision-making in screening candidates for employment or employees for promotion within New York City.[21]
The law prohibits use of an AEDT unless the tool has undergone a bias audit no more than one year prior to use and the employer has posted a summary of the bias audit results.[22] Employers must notify each New York City candidate or employee no less than 10 business days before use and disclose the job qualifications and characteristics the AEDT will use. The notice must also include instructions for how an individual can request an alternative selection process or reasonable accommodation, but employers are not required to provide an alternative selection process. Additionally, employers must provide information about the data collected, its source, and the data retention policy within 30 days of a written request, if not disclosed on the employer’s website.[23]
The Department of Consumer and Worker Protection (DCWP) enforces Local Law 144, with civil penalties of up to $500 for a first violation and $500 to $1,500 for each subsequent violation.[24] To date, there have been no publicly announced enforcement actions under Local Law 144, although on December 2, 2025, the New York State Comptroller published an audit of DCWP’s enforcement of Local Law 144, addressing challenges in identifying non-compliance. The audit discussed perceived shortcomings in DCWP’s enforcement efforts, noting that DCWP only identified one instance of noncompliance among the 32 companies surveyed, whereas the Comptroller identified 17 instances of potential noncompliance. The Comptroller recommended a number of changes to DCWP’s investigation process with the goal of increasing Local Law 144 enforcement.
AI Anti-Discrimination Laws and Regulations
Several states have passed laws or regulations that explicitly prohibit discriminatory uses of AI in the workplace. These regimes operate principally through existing anti-discrimination frameworks, though several add new obligations, including notice and recordkeeping requirements. Regulatory developments in California and New Jersey and new laws in Connecticut, Illinois and Texas are summarized below.
California Civil Rights Council Automated-Decision System Regulations
The California Civil Rights Council’s (CRC) regulations regarding “automated-decision systems” (ADS) took effect on October 1, 2025.[25] The regulations define ADS as computational processes that “mak[e] a decision or facilitat[e] human decisionmaking” regarding an employment benefit.[26] The regulations define “employer” to extend to an employer’s “agent[s],” which includes “any person acting on behalf of an employer, directly or indirectly, to exercise a function traditionally exercised by the employer,” including recruiting, screening, hiring, promotion, and decisions regarding pay, benefits, or leave.[27] The regulations state that an employer’s use of an ADS or selection criteria that discriminates against applicants or employees on a protected basis is a violation of California’s anti-discrimination law, the Fair Employment and Housing Act (FEHA).[28] That includes the use of ADS to measure skills or abilities in a way that discriminates against people with disabilities or to analyze tone, expressions, or behavior in a way that has the practical effect of discriminating against protected groups.[29] The regulations also state that evidence, or the lack of evidence, of anti-bias testing or similar proactive efforts to avoid unlawful discrimination is relevant to a claim or defense.[30] Employment records, including automated-decision system data, must be retained for four years from the later of the date the record is made or the date of the personnel action.[31]
The regulations are enforceable by the California Civil Rights Department, and individual claims based on discriminatory uses of ADS may proceed through the FEHA complaint process or civil actions.
S.B. 5 amends the Connecticut Fair Employment Practices Act (CFEPA) to provide that the use of an AEDT is not a defense to a complaint alleging a discriminatory practice.[32] A court or the Connecticut Commission on Human Rights and Opportunities may, however, consider evidence of anti-bias testing or similar proactive efforts to avoid the discriminatory practice.[33] These provisions went into effect on October 1, 2026.
New Jersey Division on Civil Rights Regulations
The New Jersey Division on Civil Rights (DCR) adopted regulations, effective December 15, 2025, addressing disparate impact discrimination under the New Jersey Law Against Discrimination (LAD) that expressly include discrimination arising from the use of automated employment decision technology. The regulations offer examples of potential algorithmic discrimination, including tools that use an employer’s existing workforce as the baseline for candidate searches or that screen candidates on the basis of availability.[34] As with other disparate impact claims under New Jersey law, once a complainant pleads a prima facie case of disparate impact, the burden shifts to the employer to show that the challenged practice is necessary to achieve a substantial, legitimate, or nondiscriminatory interest.
H.B. 3773 amends the Illinois Human Rights Act (IHRA) to clarify that an employer’s use of artificial intelligence with respect to an employment decision (such as recruitment, hiring, promotion, and discharge) that has the effect of subjecting employees to discrimination is a violation of the IHRA.[35] H.B. 3773 defines “artificial intelligence” broadly as a “machine-based system that, for explicit or implicit objectives, infers from the input it receives how to generate outputs such as predictions, content, recommendations, or decisions,” which includes generative artificial intelligence.[36] An employer must provide notice that it is using artificial intelligence for the purpose of an employment decision.[37] H.B. 3773 also codifies a prohibition on using zip codes as a proxy for protected class.
Similar to California’s CRC regulations, the Illinois Department of Human Rights (IDHR) has enforcement authority, and individuals may proceed through the IHRA complaint process, with a civil action available in some cases. The statute directs the IDHR to adopt rules necessary for implementation and enforcement, including on the circumstances requiring notice and the timing and means of notice.[38] Although the IDHR issued rules in May 2026, those have since been withdrawn. No updated timeline for the regulations has been announced.
The Texas Responsible Artificial Intelligence Governance Act (TRAIGA), effective January 1, 2026, takes a materially lighter approach. TRAIGA prohibits developing or deploying an AI system with the intent to unlawfully discriminate, but it does not reach disparate impact, imposes no notice or audit obligations, and provides a 60-day notice-and-cure period. Enforcement rests exclusively with the Texas Attorney General, who can seek penalties of between $10,000 and $12,000 per violation for unaddressed “curable” violations, between $80,000 and $200,000 for “uncurable” violations, or $2,000 to $40,000 per day.[39]
1. Coverage Is the First Question
The threshold question is whether a given automated tool is covered at all—and the standards vary across jurisdictions. They range from the CRC regulations, which reach any computational process that merely facilitates human decision-making about an employment benefit, to Texas’ TRAIGA, which reaches only systems deployed with the intent to discriminate. The coverage thresholds are summarized below:
| Statute or Regulation | A tool is covered when it … |
| California — CCPA ADMT regulations | replaces or substantially replaces human decision-making |
| California — CRC ADS regulations | makes a decision or facilitates human decision-making regarding an employment benefit |
| California – S.B. 947 (No Robo Bosses Act) | issues a simplified output that is used to assist or replace human discretionary decisionmaking and materially impacts natural persons |
| Colorado — S.B. 26-189 | materially influences a consequential decision |
| Connecticut — S.B. 5 | generates output that is a substantial factor used to make or materially influence a decision |
| Illinois — H.B. 3773 | is used with respect to an employment decision |
| New Jersey — DCR regulations | produces a disparate impact under the LAD |
| New York City — Local Law 144 | substantially assists or replaces discretionary decision-making |
| Texas — TRAIGA | is deployed with the intent to discriminate |
.
2. Notice Is Key Across Jurisdictions
Most jurisdictions that have an ADMT or AI in employment law require some form of notice to employees and applicants. Where notice is required, it must be given before ADMT or AEDT is used to make a covered decision. Post-decision obligations are less uniform. Colorado requires an affirmative explanation within 30 days of an adverse outcome, California provides an access right exercisable on request, and some jurisdictions (including Connecticut) do not require any post-use notice.
3. But the Same Notice May Not Work Everywhere
Where notice is required, the content and form of the required notices vary. Each state requires a different level of detail and discrete information for their notices. Employers must decide whether they will create bespoke notices for each jurisdiction or a consistent cross-jurisdictional notice, and confirm that whichever approach they choose satisfies every applicable requirement.
4. And Notice Is Not Always Enough
Most jurisdictions impose additional obligations beyond notice—including bias audits, opt-out rights, and human review. Finding appropriate vendors and building compliance tools and processes to meet these obligations takes time.
5. Compliance Deadlines Are Here
Some of these laws are already in effect:
- New York City Local Law 144 (since January 1, 2023).
- CRC regulations (since October 1, 2025).
- Illinois H.B. 3773 (since January 1, 2026).
- TRAIGA (January 1, 2026).
- Connecticut SB 5’s anti-discrimination provisions (since October 1, 2026).
Employers operating in those jurisdictions should confirm that any required notices are in place where notice is mandated, and should be careful not to overlook obligations outside of notice, such as recordkeeping and anti-bias testing requirements.
Three more laws are coming online in short order:
- January 1, 2027: California’s CCPA ADMT regulations and the Colorado ADMT Act.[40]
- July 1, 2027: California’s No Robo Bosses Act.
- October 1, 2027: Connecticut SB 5’s AEDT provisions.
Notably, California’s obligations reach backward: Uses of ADMT that began before January 1, 2026 and continue after that date are subject to the risk assessment requirements, which require reporting to CalPrivacy by April 1, 2028.[41]
6. Anti-Discrimination Laws Still Apply and Drive Litigation Risk
The notice-and-disclosure regimes are enforced by regulators and generally create no private right of action.[42] However, private plaintiffs can still pursue claims under anti-discrimination laws, like the New York State or City Human Rights Law, FEHA, the IHRA, and the CFEPA. Bias audits can be both a sword and shield—they are expressly considered in evaluating defenses in California and Connecticut, but can also be subject to discovery if not conducted in a manner that preserves privilege. The bias audit summaries required by Local Law 144 are a separate matter; they must be published, so no privilege attaches.
7. The Landscape Is Evolving—And Employers Can Still Shape It
The legislative and regulatory landscape continues to develop on several fronts. Rules are still being written: Colorado’s rulemaking is open now, with comments accepted through October 26, 2026, and the Illinois Department of Human Rights withdrew its proposed rules in June 2026 without announcing a revised timeline, while continuing to accept comments. Employers with significant workforces should consider participating in the Colorado and Illinois rulemaking processes rather than waiting for final rules. Comment letters—including letters submitted by Gibson Dunn in California—have had a significant impact on the final form of regulations.
New laws are also on the horizon and what role federal law will play, if any, remains an open question. There is currently no federal statute governing AI in employment, but Executive Order 14365 directed a multi-agency effort to challenge and preempt state AI laws, and in January 2026, the Department of Justice established an AI Litigation Task Force for that purpose.[43]
None of this gives employers a reason to delay compliance. The enacted regimes are enforceable on their own terms, and employers should develop compliance programs that can be adjusted rather than rebuilt as the legislative and regulatory landscape evolves.
Conclusion
Several of these laws should see further movement in the coming months. We will continue to monitor these developments and provide updates as the law evolves.
[1] 11 Cal. Code Regs. § 7001(e), (ddd)(4).
[2] Id. § 7220.
[3] Id. § 7221.
[4] Id. §§ 7150–7157.
[5] Cal. Labor Code § 1520(c).
[6] Id. § 1522(b)(1).
[7] Id. § 1522(b)(2).
[8] Id. § 1524.
[9] Id. § 1522(d).
[10] Id. § 1526.4.
[11] Id. § 1526.5.
[12] Colo. Rev. Stat. §§ 6-1-1701 et seq.
[13] Id. § 6-1-1704(1).
[14] Id. § 6-1-1704(3).
[15] Id. § 6-1-1705.
[16] Id. § 6-1-1706.
[17] Conn. Pub. Act No. 26-15 § 7. The statute defines “[e]mployment-related decision” as “(A) . . . any decision, made based on any individual’s personal data, to hire, promote, discipline or discharge such individual, to renew such individual’s employment, to select such individual for any training or apprenticeship or with respect to such individual’s tenure or terms, privileges or conditions of employment, and (B) does not include any such decision that (i) results in any nonmaterial change in such individual’s job tasks, work responsibilities, hours or work assignments, or (ii) is made with respect to workplace health and safety, scheduling and planning or productivity monitoring.”
[18] Id. § 9.
[19] Id. § 10.
[20] Id. §12.
[21] N.Y.C. Admin. Code §§ 20-870 et seq.; 6 RCNY §§ 5-300 et seq.
[22] N.Y.C. Admin. Code § 20-871(a).
[23] Id. § 20-871(b).
[24] N.Y.C. Admin. Code § 20-872.
[25] 2 Cal. Code Regs. § 11008.1.
[26] Id. § 11008.1(a).
[27] Id. § 11008(a).
[28] Id. § 11009.
[29] Id. § 11016(c)(5), (d)(1).
[30] Id. § 11009(f).
[31] Id. § 11013(c).
[32] Conn. Pub. Act. No. 26-15 § 13.
[33] Id.
[34] N.J. Admin. Code §§ 13:16-1.1 et seq.
[35] 775 ILCS 5/2-102(L)(1).
[36] Id. § 2-101(N).
[37] Id. § 2-102(L)(2).
[38] Id. § 2-102(L).
[39] Tex. Bus. & Com. Code §§ 552.001 et seq. TRAIGA does not define what makes a violation “curable” or “uncurable.”
[40] 11 Cal. Code Regs. § 7200(b); Colo. Rev. Stat. §§ 6-1-1701 et seq.
[41] 11 Cal. Code Regs. §§ 7155(b), 7157(a)(1).
[42] Colo. Rev. Stat. § 6-1-1706(4); Conn. Pub. Act No. 26-15, § 12; N.Y.C. Admin. Code § 20-872.
[43] Exec. Order No. 14365, 90 Fed. Reg. 58,499 (Dec. 11, 2025).
Gibson Dunn lawyers are available to assist in addressing any questions you may have about these developments. Please contact the Gibson Dunn lawyer with whom you usually work, the authors, or any of the following leaders and members of the firm’s Artificial Intelligence or Labor & Employment practice groups:
Artificial Intelligence:
Cassandra L. Gaedt-Sheckter – Palo Alto (+1 650.849.5203, cgaedt-sheckter@gibsondunn.com)
Vivek Mohan – Palo Alto (+1 650.849.5345, vmohan@gibsondunn.com)
Eric D. Vandevelde – Los Angeles (+1 213.229.7186, evandevelde@gibsondunn.com)
Frances A. Waldmann – Los Angeles/London (+1 213.229.7914, fwaldmann@gibsondunn.com
Labor & Employment:
Danielle J. Moss – New York (+1 212.351.6338, dmoss@gibsondunn.com)
Grace E. Hart – New York (+1 212.351.6372, ghart@gibsondunn.com)
Jason C. Schwartz – Washington, D.C. (+1 202.955.8242, jschwartz@gibsondunn.com)
Katherine V.A. Smith – Los Angeles (+1 213.229.7107, ksmith@gibsondunn.com)
*A recent law graduate in the New York office, not yet admitted to practice law.