Several countries now have rules specifically about using AI to hire people. The rules have been changing fast enough that anything written eighteen months ago is probably wrong.
Correct as at September 2026. This is not legal advice. Every item below has changed at least once since it was announced, and two changed in the six months before this was written. Treat it as a map of what exists, then check the current position where you are before acting on it.
Why hiring gets singled out
Regulators have picked out a small number of uses of AI to regulate specifically, and hiring is one of them. The reasoning is the same everywhere:
- A hiring decision changes someone's life.
- The person affected cannot see how the decision was made.
- One system applies the same flaw to thousands of people at once.
Europe — the AI Act
The EU AI Act (Regulation 2024/1689) came into force on 1 August 2024. Systems used to recruit or select people — including targeting job adverts, filtering applications and evaluating candidates — count as high risk, which is the category with the most duties attached.
The timing has changed. The high-risk duties were originally due to start on 2 August 2026. A later law — the Digital Omnibus on AI (Regulation 2026/1744, published 24 July 2026) — pushed them back.
| Date | What applies |
|---|---|
| 2 February 2025 | Banned practices, including trying to work out people's emotions at work |
| 2 August 2026 | Transparency duties (Article 50) |
| 2 December 2026 | Transparency duties for systems already in use; new bans |
| 2 December 2027 | The high-risk duties — the ones that cover recruitment |
| 2 August 2028 | High-risk duties for AI built into regulated products |
Two things not to misread. The delay gives you more time; it does not change what you will have to do. And the ban on working out emotions at work has already applied since February 2025 — which matters directly if a tool claims to judge a candidate's emotional state from video.
United States — state by state
There is no single national law. There is a patchwork, and what applies depends on where your candidates are, not where you are.
- New York City (Local Law 144), in force since July 2023. If you use an automated tool to help decide who gets hired, you need an independent bias check every year, you must publish a summary of the results, and you must tell candidates at least ten working days before you use it.
- Illinois. The AI Video Interview Act has applied since 2020: tell candidates, explain what the AI looks at, get consent, limit who you share it with, and delete it within 30 days if asked. Separately, a change to the Illinois Human Rights Act covering AI in employment decisions started on 1 January 2026.
- Colorado. Worth knowing because it shows how fast this moves. SB 24-205 was going to be the first broad state AI law. A federal court paused it in April 2026. The state then replaced it with SB 26-189, signed on 14 May 2026, which starts on 1 January 2027 and is narrower — mostly about disclosure, with enforcement depending on further rules from the Attorney General.
Data protection — separate rules that always apply
These exist regardless of any AI law.
GDPR, in Europe and the UK, gives candidates the right to see, correct and delete their data. You need a reason to hold it and a date to delete it. If you collected someone's details from somewhere other than them, you generally have to tell them — including where you got them. And Article 22 restricts decisions made purely by software where the effect on the person is serious, which a rejection arguably is.
India's DPDP Act 2023 became live when its detailed rules were published on 13 November 2025, with obligations phasing in until about mid-May 2027. Some employment processing does not need consent, but you still have duties around telling people, keeping data safe, deleting it, and handling complaints.
Working out what applies to you
- Where are your candidates? That usually decides which rules apply — not where your company is registered.
- Does the tool make or strongly influence a decision, or just help with admin? The closer to the decision, the more applies.
- Is anything guessing at characteristics rather than reading stated facts? That is where the outright bans are.
- Could you produce the records, the notice and the human review if asked tomorrow?
The one rule that will not change
Every set of rules ends up asking for the same three things: tell candidates, keep records, and keep a person in the decision. Build for those and you will be close to compliant almost anywhere, even as the dates and the statutes keep moving.