Hiring-AI regulations across NYC, Illinois, and Colorado
Three of the most active US jurisdictions for AI-in-hiring regulation: NYC's Local Law 144 (bias audits), Illinois's HB 3773 + Video Interview Act, and Colorado's AI Act. Where they overlap, where they diverge, and how to design a single compliance program that covers all three.
| Question | NYC LL 144 | Illinois HB 3773 + VIA | Colorado AI Act |
|---|---|---|---|
| Scope | |||
| What AI does it cover? | 'Automated Employment Decision Tools' (AEDTs) — any computational process that substantially assists or replaces discretionary employment decisions, used to screen candidates for jobs in NYC. | Any AI used in recruiting, hiring, promotion, renewal of employment, selection for training, discharge, discipline, tenure, or terms of employment. | AI systems used to make or be a substantial factor in 'consequential decisions' — including hiring, promotion, demotion, and termination. |
| Geographic trigger? | Jobs located in NYC OR jobs whose primary location is unknown but employer is based in NYC. | Any employment decision affecting an Illinois worker (and the VIA covers any video-interview involving an Illinois candidate). | Consequential decisions affecting Colorado residents. |
| Key obligations | |||
| Bias audit required? | Yes — annual independent bias audit. Summary results must be published on the employer's website. | Not explicitly mandated, but using a tool with a discriminatory effect is a violation of the Illinois Human Rights Act (HB 3773). Bias testing is the de facto compliance norm. | Annual impact assessment required, plus a documented risk-management program. Disparate-impact analysis is a core component. |
| Notice to candidates? | Yes — at least 10 business days before use. Must disclose the data inputs and the characteristics evaluated. | VIA requires consent before AI analysis of a video interview. HB 3773 doesn't add a separate notice requirement but the AI's use can't be hidden. | Yes — before the AI makes the decision, with an explanation of the data sources and an option to appeal adverse outcomes to a human. |
| Vendor obligations? | Deployer-only law. The vendor providing the AEDT has no direct LL 144 duty. | Employer-side obligation primarily. But sale of a discriminatory tool can give rise to vendor liability under broader IHRA enforcement. | Both developer and deployer have distinct duties. Developers must furnish documentation to enable the deployer's impact assessment. |
| Enforcement | |||
| Who enforces? | NYC Department of Consumer and Worker Protection (DCWP). | Illinois Department of Human Rights enforces HB 3773. VIA is enforced via private right of action. | Colorado Attorney General. The Act explicitly creates no private right of action. |
| Maximum penalty? | $500 first violation, $1,500 per subsequent violation. Per day, per AEDT. | VIA: damages, attorneys' fees, injunctive relief via private suit. HB 3773 (IHRA): up to $50,000 for first violation, plus damages and reinstatement. | Civil penalties up to $20,000 per violation under the Colorado Consumer Protection Act enforcement vehicle. |
| Practical | |||
| Small-business exemption? | No formal SME carve-out — applies to any employer hiring in NYC. | Standard IHRA threshold (15+ employees in Illinois for most claims, 1+ for sexual harassment / discrimination via VIA). | Yes — limited carve-out for developers under 50 employees that don't substantially modify the AI system with their own data. |
Key takeaways
Three different anchors for the same problem
NYC anchors compliance on the annual bias audit, Illinois on existing anti-discrimination law plus video-interview consent, and Colorado on a new EU-style impact assessment. A national hiring vendor effectively has to satisfy all three to operate freely in the US — the audit you build for NYC won't satisfy Colorado, and vice versa.
Vendor-vs-deployer matters most in Colorado
NYC and Illinois mainly bind the employer (deployer). Colorado uniquely binds the developer (vendor) too — which means HR-tech vendors selling into Colorado need their own compliance documentation that they can hand to customers. Build this once for Colorado and you're 80% of the way to the EU AI Act's high-risk regime.
Federal coverage is sparse but coming
There's no federal AI hiring law yet. The EEOC has issued guidance that Title VII covers algorithmic hiring tools, and OFCCP has signalled active scrutiny of federal contractors. Expect federal harmonisation pressure as more states copy Colorado's framework.
Not sure which of these applies to your situation?
Answer 5 quick questions and we'll match you to the AI regulations that apply to your jurisdiction, AI use case, and users.
Start the 60-second wizard →Comparison updated 2026-05-19. Hand-curated by Regulations.ai — not legal advice. For specific compliance decisions, consult qualified counsel in the relevant jurisdiction.