AI in recruitment: what the law says for hirers and recruiters

The rules at a glance, place by place

No country we cover bans AI in hiring outright. What exists is a mix of equality law, data protection law and, in some places, rules written for hiring tools. This table is the short version; each section below gives the detail and the source.

What counts as AI in hiring

The rules above use different words, but the tools they target are the same: software that writes or targets job adverts, parses and ranks CVs, scores assessments or video interviews, chats with candidates, or recommends who to progress or reject. Under the EU AI Act, Annex III lists the use of AI to recruit or select people, place targeted job adverts, filter applications and evaluate candidates, and also AI used for decisions on work terms, promotion, termination and monitoring. AI Act Annex III

Our view as recruiters: a tool does not need to say "AI" on the box to be caught. If software ranks or filters people and a person mostly follows it, the legal analysis below applies.

United Kingdom

Equality law applies to the tool and to the agency

Section 19 of the Equality Act 2010 covers a provision, criterion or practice that puts people sharing a protected characteristic at a particular disadvantage and cannot be shown to be a proportionate means of achieving a legitimate aim. Equality Act 2010, section 19 In our reading, an automated screening rule can be such a practice. Section 55 bars discrimination by employment service providers, and section 56 treats a service for finding employment for people, and a service for supplying employers with people to do work, as employment services. That is how recruitment agencies and sourcing platforms are caught. Equality Act 2010, section 55 Equality Act 2010, section 56

New automated decision rules since 5 February 2026

Section 80 of the Data (Use and Access) Act 2025 replaced Article 22 of the UK GDPR with new Articles 22A to 22D. They define a decision as solely automated where there is no meaningful human involvement, and as significant where it has a legal or similarly significant effect. Article 22B restricts significant decisions based wholly or partly on special category data unless an exception applies. Article 22C requires safeguards for significant solely automated decisions: give information, let the person make representations, provide human intervention, and let them contest the decision. Data (Use and Access) Act 2025, section 80 The provisions commenced on 5 February 2026, and earlier decisions are saved. SI 2026/82, regulation 2

What the ICO has said and found

• On 31 March 2026 the ICO published "Recruitment Rewired" after voluntary engagement with more than 30 employers. It was not an audit. The ICO says many employers are likely to be making solely automated significant decisions in recruitment, and that it will scrutinise major employers and platforms. ICO: Recruitment Rewired
• It consulted on draft guidance about automated decision-making from 31 March to 29 May 2026. Its plans page expects final guidance in winter 2026. ICO: draft ADM guidance consultation ICO: planned guidance, technology
• Its November 2024 audit of AI recruitment tool providers made 296 recommendations and 42 advisory notes; 97% were accepted and 3% partially accepted. Findings included tools without accuracy testing, tools that let recruiters filter out candidates by protected characteristics, tools that inferred gender or ethnicity from names, excessive data collection and scraping, and providers wrongly describing themselves as processors. ICO: AI tools in recruitment, audit outcomes report
• The Department for Science, Innovation and Technology published "Responsible AI in Recruitment" on 25 March 2024. It is guidance, not law. DSIT: Responsible AI in Recruitment guide

Identity checks and what we did not find

For right to work checks, the Home Office guide allows facial recognition through a registered digital identity provider, but it is optional and an alternative route must be offered. The scheme extends to workers, individual sub-contractors and online matching services for work starting on or after 1 October 2026, with civil penalties of up to £45,000 for a first breach and £60,000 for a repeat breach, per worker. Home Office: right to work checks, employer guide Home Office: illegal working penalty codes of practice We found no AI provision in the contents of the Employment Rights Act 2025, and we have not found a UK AI regulation bill in the King's Speech of 13 May 2026. Employment Rights Act 2025: contents The King's Speech 2026 The Joint Committee on Human Rights called for an AI Bill on 14 September 2026; we have not found a government response. Joint Committee on Human Rights: Human Rights and the Regulation of AI

European Union

The AI Act classes AI used for recruitment, selection, targeted job adverts, filtering applications and evaluating candidates as high risk. AI Act Annex III The Digital Omnibus on AI, Regulation (EU) 2026/1744, moved the date from which Annex III high-risk duties apply to 2 December 2027, and Annex I product duties to 2 August 2028. Regulation (EU) 2026/1744 (Digital Omnibus on AI) AI Act Article 113 Council of the EU: final approval of the AI simplification rules

• Already applying: Article 5(1)(f) prohibits AI that infers a person's emotions in the workplace, with an exception for medical or safety reasons. The Commission's guidance we read confirms an employer inferring emotions at the workplace is prohibited; we have not confirmed whether it addresses interviews. AI Act Article 5
• AI literacy: Article 4 requires providers and deployers to take measures to support the AI literacy of staff who operate AI for them. The wording changed in the Omnibus. AI Act Article 4
• Reach: the Act covers providers and deployers outside the EU where the output of the system is used in the Union. A UK or US company screening candidates for an EU role should assume it is in scope. AI Act Article 2
• Penalties: up to €35m or 7% of worldwide turnover for prohibited practices, up to €15m or 3% for other listed operator obligations, and up to €7.5m or 1% for supplying misleading information. AI Act Article 99

Data protection and platform work

The EU Court of Justice has treated credit scoring as an automated individual decision where a lender relies on the score (SCHUFA, C-634/21, 7 December 2023), and has addressed the right to an explanation of automated decisions (Dun & Bradstreet Austria, C-203/22, 27 February 2025). We read both from the Court's press releases, not the judgments. CJEU press release: SCHUFA Holding (Scoring), C-634/21 CJEU press release: Dun & Bradstreet Austria, C-203/22 The Platform Work Directive (EU) 2024/2831 sets rules on algorithmic management and must be transposed by 2 December 2026. It is aimed at digital labour platforms; we have not confirmed whether it reaches ordinary recruitment agencies. Directive (EU) 2024/2831 on platform work

United States: federal

We found no federal statute written for AI hiring tools. Existing discrimination and credit reporting law applies, and federal enforcement priorities have shifted.

• EEOC: in EEOC v. iTutorGroup (case 1:22-cv-02565) the company agreed to pay $365,000, the EEOC's first settlement over AI in hiring (press release of 11 September 2023). EEOC: iTutorGroup settlement The EEOC's earlier AI technical assistance page now returns an error at its old address.
• Executive orders: Executive Order 14281 of 23 April 2025 directs agencies to deprioritise enforcement of disparate impact liability. Executive Order 14281 (Federal Register) Executive Order 14365 of 11 December 2025 sets a national AI policy framework aimed at state AI laws, and the Attorney General created a DOJ AI Litigation Task Force by memorandum on 9 January 2026. Executive Order 14365 (Federal Register) DOJ memorandum: AI Litigation Task Force Our view: this changes federal enforcement, not private claims or state enforcement, which remain live risks.
• Credit reporting: CFPB Circular 2024-06 of 24 October 2024 says the Fair Credit Reporting Act can apply to background dossiers and algorithmic scores used for employment decisions. We have not confirmed whether it remains in force. CFPB Circular 2024-06

United States: state and city

New York City

Local Law 144 covers employers and employment agencies that use an automated employment decision tool for hiring or promotion in the city. The tool must have had a bias audit within the year before use, and candidates must be told 10 business days before it is used. Enforcement began on 5 July 2023. Penalties are up to $500 for a first violation and $500 to $1,500 for each later one, with each day a separate violation. NYC DCWP: Automated Employment Decision Tools NYC DCWP: AEDT FAQ NYC Local Law 144 of 2021 A State Comptroller audit published on 2 December 2025 found the city agency had received two complaints, reviewed 32 companies and found one case of non-compliance, while the Comptroller's own review found at least 17 instances of potential non-compliance among the same companies. New York State Comptroller: audit of Local Law 144 enforcement

California

The Civil Rights Council regulations on automated decision systems took effect on 1 October 2025. Records, including automated decision data, must be kept for at least four years. The regulations add a definition of "agent", which matters to agencies acting for employers; we have not read the adopted wording, so check it. They also say assessments run by such systems may amount to unlawful medical inquiries. California Civil Rights Department: approved AI employment regulations Separately, the CPPA's regulations on automated decision-making technology require compliance from 1 January 2027, and a "significant decision" includes employment. CPPA: approved regulation text (ADMT) SB 7, the "No Robo Bosses Act", was vetoed on 13 October 2025 and the veto was sustained on 2 March 2026. California SB 7: bill status SB 947 was signed on 30 September 2026 as Chapter 859 and is operative from 1 July 2027. Its summary centres on discipline and termination, so check whether and how it applies to hiring. California SB 947: bill status

Illinois, Colorado and Texas

• Illinois: from 1 January 2026, employers may not use AI that has the effect of discriminating against protected classes in recruitment, hiring, promotion and other decisions, may not use zip codes as a proxy, and must notify employees when they use AI for these purposes. The Department of Human Rights is to set notice rules; we have not confirmed their status. Illinois Public Act 103-0804 The AI Video Interview Act requires an employer using AI to analyse recorded interviews to notify the applicant, explain how the AI works and obtain consent beforehand. Illinois Artificial Intelligence Video Interview Act
• Colorado: SB 26-189 was signed on 14 May 2026 and replaced SB 24-205. Deployers must give notice at the point of interaction, a plain-language description within 30 days of an adverse outcome, and meaningful human review. Developer documentation duties and Attorney General rules start on 1 January 2027. The Attorney General enforces, with a 60-day cure period before 1 January 2030, and the Act creates no new private right of action. Colorado SB26-189
• Texas: the Responsible AI Governance Act took effect on 1 January 2026. It requires intent for a discrimination claim, is enforced by the Attorney General with a 60-day cure period, and its definition of "consumer" excludes the employment context. Texas HB 149: bill history

Court cases to watch

Mobley matters most to recruiters because it tests whether a vendor that screens candidates for employers can be liable alongside them. Until it is resolved, we would not assume liability sits only with the software provider.

Ontario, Canada

Since 1 January 2026, publicly advertised job postings in Ontario must say if AI is used to screen, assess or select applicants. The employer remains responsible even when a recruiter posts the advert. The rules do not apply to employers with fewer than 25 employees, general recruitment campaigns for no specific position, internal-only postings, work outside Ontario, or the Crown. A posting with no vacancy must say so. Ontario: requirements for publicly advertised job postings We have included it because the duty sits on postings that a recruiter may publish.

What changes next, and when

1. 2 December 2026

   EU Platform Work Directive transposition deadline

   Member States must have implemented the Directive by this date. Directive (EU) 2024/2831 on platform work

2. Winter 2026

   ICO final guidance on automated decision-making

   The ICO plans page expects final guidance this winter. No date has been fixed. ICO: planned guidance, technology

3. 1 January 2027

   Colorado developer duties and Attorney General rules; California CPPA compliance

   Colorado developer documentation duties and rules start, and CPPA automated decision-making technology compliance begins. Colorado SB26-189 CPPA: approved regulation text (ADMT)

4. 1 July 2027

   California SB 947 operative

   The new Labor Code provisions start. California SB 947: bill status

5. 2 December 2027

   EU AI Act Annex III high-risk duties

   Duties for recruitment and worker management tools apply from this date. AI Act Article 113 Council of the EU: final approval of the AI simplification rules

No UK AI bill has been announced, but the Joint Committee on Human Rights has asked for one. We will log any government response. Joint Committee on Human Rights: Human Rights and the Regulation of AI

Practical checklist for hirers

1. List every tool in your hiring process that ranks, filters, scores, transcribes or chats with candidates, including tools your agencies and platforms use for you. AI Act Annex III ICO: Recruitment Rewired
2. Check whether any rejection or progression decision happens with no meaningful human involvement. If it does, put the Article 22C safeguards in place: information, a way to make representations, human intervention and a way to contest. Data (Use and Access) Act 2025, section 80
3. Test each tool for bias before you rely on it and keep the results. This supports an Equality Act defence, is a legal requirement in New York City, and answers the ICO's finding that some tools lacked accuracy testing. Equality Act 2010, section 19 NYC DCWP: Automated Employment Decision Tools ICO: AI tools in recruitment, audit outcomes report
4. Tell candidates. Duties differ: ten business days before use in New York City, notice and consent for AI video interviews in Illinois, notice at the point of interaction in Colorado from 2027, and a statement in the job posting in Ontario. NYC DCWP: Automated Employment Decision Tools Illinois Artificial Intelligence Video Interview Act Colorado SB26-189 Ontario: requirements for publicly advertised job postings
5. Offer a human route. A person who can review and change the outcome is a requirement in the UK and Colorado and sound practice elsewhere. Data (Use and Access) Act 2025, section 80 Colorado SB26-189
6. Fix the vendor contract. The ICO found providers wrongly calling themselves processors and vague contracts. Settle who is controller, what data the vendor may reuse, what audit evidence you will receive and who carries liability. ICO: AI tools in recruitment, audit outcomes report Mobley v. Workday: court orders on govinfo
7. If you hire in the EU, remove any tool that infers emotions at work, and train staff who run AI tools. Ask counsel whether your interview tools fall inside the ban. AI Act Article 5 AI Act Article 4
8. Keep records. California requires at least four years for automated decision data and Colorado requires three years. California Civil Rights Department: approved AI employment regulations Colorado SB26-189
9. Offer an alternative to facial recognition for right to work checks. Home Office: right to work checks, employer guide
10. Take legal advice on your own set-up before you act, and review it again when the dates in the section above arrive.

What this means for recruitment agencies

Agencies are directly in scope in several places: the Equality Act treats finding people for employers as an employment service, New York City Local Law 144 names employment agencies, the California regulations introduce an "agent" concept, and Ontario puts the AI statement on postings that recruiters publish. Equality Act 2010, section 56 NYC Local Law 144 of 2021 California Civil Rights Department: approved AI employment regulations Ontario: requirements for publicly advertised job postings If you use a recruiter, ask which tools touch your candidates, what they do, and what testing has been done. We are recruiters, not lawyers, and we would rather you ask us that question than assume.

We recruit permanent technology hires in London, New York and San Francisco, and contractors in the UK. If you are hiring across those markets and want a straight view of how this affects your process, talk to Mark or Mike.

How we keep this guide current

Law in this area is moving month by month, so this guide is checked on a fixed schedule rather than when we remember.

1. Every Monday morning (London time) an automated check reads the 61 official pages behind this guide: legislation, regulators, courts and government notices. It compares each page with the previous week and flags any that have changed. It also searches GOV.UK and the US Federal Register for new publications on automated decision-making and AI in employment.
2. We review anything flagged within a week. A person reads the changed source, decides whether this guide needs to change, and updates the text.
3. Every change is logged. The update gets a dated entry in the What changed log on the hub, and the "last reviewed" date at the top of this page moves.
4. Limits. The check sees changes to the listed pages. A few official sites block automated checks. The weekly email lists them so we can open them by hand. It does not replace legal advice.

See also how we research every page in the hub method.

Sources

Every source below was fetched and read on 8 October 2026. Primary sources only, apart from the docket tracker noted. Where we read only a press release or a summary, the text says so. How we research these pages.

1. Data (Use and Access) Act 2025, section 80New UK GDPR Articles 22A to 22D on automated decisions. Checked 8 October 2026.
2. SI 2026/82, regulation 2Section 80 commenced on 5 February 2026. Checked 8 October 2026.
3. Equality Act 2010, section 56What counts as an employment service. Checked 8 October 2026.
4. AI Act Annex IIIRecruitment and worker management as high-risk uses. Checked 8 October 2026.
5. AI Act Article 5The ban on inferring emotions in the workplace. Checked 8 October 2026.
6. AI Act Article 113Application dates after the Omnibus. Checked 8 October 2026.
7. AI Act Article 2Scope, including output used in the Union. Checked 8 October 2026.
8. NYC DCWP: Automated Employment Decision ToolsLocal Law 144 guidance. Checked 8 October 2026.
9. NYC Local Law 144 of 2021Statute text and penalties. Checked 8 October 2026.
10. California Civil Rights Department: approved AI employment regulationsRegulations effective 1 October 2025. Checked 8 October 2026.
11. CPPA: approved regulation text (ADMT)Automated decision-making technology compliance from 1 January 2027. Checked 8 October 2026.
12. Illinois Public Act 103-0804AI amendments to the Illinois Human Rights Act. Checked 8 October 2026.
13. Illinois Artificial Intelligence Video Interview ActNotice, explanation and consent. Checked 8 October 2026.
14. Colorado SB26-189The 2026 Colorado automated decision-making law. Checked 8 October 2026.
15. Texas HB 149: bill historyThe Texas Responsible AI Governance Act. Checked 8 October 2026.
16. Ontario: requirements for publicly advertised job postingsAI disclosure in job postings. Checked 8 October 2026.
17. Equality Act 2010, section 19Indirect discrimination. Checked 8 October 2026.
18. Equality Act 2010, section 55Employment service providers. Checked 8 October 2026.
19. ICO: Recruitment RewiredICO engagement with employers, 31 March 2026. Checked 8 October 2026.
20. ICO: draft ADM guidance consultationConsultation window for draft automated decision-making guidance. Checked 8 October 2026.
21. ICO: planned guidance, technologyExpected timing of final ADM guidance. Checked 8 October 2026.
22. ICO: AI tools in recruitment, audit outcomes reportThe November 2024 audit findings and 296 recommendations. Checked 8 October 2026.
23. DSIT: Responsible AI in Recruitment guideNon-binding government guidance, first published 25 March 2024. Checked 8 October 2026.
24. Home Office: right to work checks, employer guideDigital identity checks and facial comparison from 1 October 2026. Checked 8 October 2026.
25. Home Office: illegal working penalty codes of practiceCivil penalty levels of £45,000 and £60,000 per worker. Checked 8 October 2026.
26. Employment Rights Act 2025: contentsWhere we looked for AI provisions and found none. Checked 8 October 2026.
27. The King's Speech 2026Where we looked for an AI bill. Checked 8 October 2026.
28. Joint Committee on Human Rights: Human Rights and the Regulation of AIThe 14 September 2026 call for an AI Bill. Checked 8 October 2026.
29. Regulation (EU) 2026/1744 (Digital Omnibus on AI)The 2026 amendments to the AI Act timetable. Checked 8 October 2026.
30. Council of the EU: final approval of the AI simplification rulesFinal approval and the 2 December 2027 date. Checked 8 October 2026.
31. AI Act Article 4AI literacy. Checked 8 October 2026.
32. AI Act Article 99Penalty tiers. Checked 8 October 2026.
33. CJEU press release: SCHUFA Holding (Scoring), C-634/21Credit scoring as an automated individual decision. Checked 8 October 2026.
34. CJEU press release: Dun & Bradstreet Austria, C-203/22The right to an explanation of automated decisions. Checked 8 October 2026.
35. Directive (EU) 2024/2831 on platform workAlgorithmic management rules and the 2 December 2026 transposition date. Checked 8 October 2026.
36. EEOC: iTutorGroup settlementThe first EEOC settlement over AI in hiring. Checked 8 October 2026.
37. Executive Order 14281 (Federal Register)Federal direction on disparate impact enforcement. Checked 8 October 2026.
38. Executive Order 14365 (Federal Register)National AI policy framework order. Checked 8 October 2026.
39. DOJ memorandum: AI Litigation Task ForceCreation of the task force. Checked 8 October 2026.
40. CFPB Circular 2024-06Algorithmic scores and the Fair Credit Reporting Act. Checked 8 October 2026.
41. NYC DCWP: AEDT FAQScope, audit and notice timing. Checked 8 October 2026.
42. New York State Comptroller: audit of Local Law 144 enforcementThe 2 December 2025 audit. Checked 8 October 2026.
43. California SB 7: bill statusVetoed 13 October 2025, veto sustained 2 March 2026. Checked 8 October 2026.
44. California SB 947: bill statusSigned 30 September 2026, Chapter 859. Checked 8 October 2026.
45. Mobley v. Workday: court orders on govinfoCourt orders in the collective action. Checked 8 October 2026.
46. Kistler v. Eightfold AI: docket (Justia)Docket tracking. Justia is not an official court site. Checked 8 October 2026.