This is part of a series from Nelson Mullins' AI Task Force. We will continue to provide additional insight on both domestic and international matters across various industries spanning both the public and private sectors.

As employers increasingly integrate AI into hiring, promotion, discipline, and other employment decisions, state and local regulators are accelerating efforts to impose transparency and accountability. The following two developments highlight both the direction of legislative efforts and the compliance complexity: (1) amendments to the Illinois Human Rights Act (IHRA), effective January 1, 2026, that add AI-specific notice obligations and prohibit the discriminatory use of AI in employment decisions; (2) a December 2025 audit report by the New York State Comptroller finding significant enforcement gaps under New York City’s Local Law 144 (LL144), the city’s automated employment decision tools (AEDT) law in effect since July 2023; and (3) Connecticut's SB5, a broad AI law that regulates AEDTs.

These developments arrive amid continued federal uncertainty and growing state and local activity regulating workplace AI. Employers operating nationally should expect additional requirements in 2026 and should treat AI-enabled HR tools as a regulated workflow—not a standalone technology purchase—requiring governance, documentation, and communications tailored to each jurisdiction.

Illinois: AI Amendments to the Illinois Human Rights Act (HB 3773)

Illinois’s House Bill 3773 amends the IHRA to expressly regulate employers’ use of AI in employment decisions. Effective January 1, 2026, it adds (a) an anti-discrimination standard focused on the effect of AI-driven decision-making and (b) a requirement to notify employees when AI is used for covered employment purposes, with implementing details to be set by the Illinois Department of Human Rights (IDHR).

Scope and Coverage

The amendments apply broadly to IHRA-covered employers (generally, employers with at least one employee in Illinois during 20+ weeks of the year). The IHRA’s definition of “artificial intelligence” is expansive and includes generative AI, so employers should inventory not only purpose-built HR tools (e.g., screening, assessment, and interview analytics), but also embedded AI features in broader software products and vendor platforms used in employment workflows.

Key Requirements

Anti-discrimination (disparate-impact risk). The IHRA amendments make it a civil rights violation to use AI in covered employment decisions where the AI has the effect of discriminating on the basis of protected class. The statute also prohibits using zip codes as a proxy for protected classes—an explicit warning against seemingly neutral variables that may replicate protected-class traits.

Notice. The amendments also make it a civil rights violation to fail to notify employees that AI is being used for covered employment purposes. The statute leaves the “how” (timing, content, and delivery) to IDHR rulemaking, so employers should be ready to operationalize notice quickly once the final rules are issued.

IDHR Draft Rules: Subpart J

IDHR has circulated draft implementing rules (Subpart J) that—if finalized in similar form—would require more than a simple “AI is used” disclosure. The draft reflects a detailed, operations-heavy notice regime and offers a preview of the compliance lift for employers.

• Triggering use cases. Notice would be required when AI is used to influence or facilitate covered employment decisions (e.g., resume screening, predictive assessments/tests, interview analytics, targeted job ads, or analyses using third-party data).
• Common exclusions. The draft would generally exclude AI used for non-employment business operations (e.g., marketing content) and standard automated tools that are not used to generate outputs influencing employment decisions.
• Timing. The draft rules contemplate annual notice to current employees and additional notice within 30 days of adopting a new or substantially updated AI system/process; candidates would receive notice in the job posting/notice.
• Delivery channels. The draft rules contemplate multi-channel distribution (handbook/policies, workplace posting, intranet/external website with a prominent link, and job postings).
• Notice content. Proposed notices would identify the tool/vendor, the employment decision(s) affected, purpose and categories of personal information processed, positions covered, a contact for questions, accommodation information, and required statutory language.
• Accessibility and languages. Notices should be in plain language, available in commonly spoken workforce languages, and reasonably accessible to individuals with disabilities.
• Recordkeeping. Employers would be required to retain notices and related AI-use records for four years following use.

While the rules remain in draft form, they signal that Illinois may emphasize detailed, affirmative notice (and associated operational controls) rather than mandating formal bias audits. Employers can use the draft as a checklist to begin gathering tool, vendor, and data-processing details needed to support compliant disclosures.

The proposed amendment was published to the Illinois Register to allow for public comment on the proposed rulemaking. The IDHR was scheduled to hold a hearing on the draft regulations; however, as of June 2, 2026, the hearing is temporarily postponed.  

New York City: Enforcement Gaps Under Local Law 144

New York City’s LL144 regulates employers’ use of AEDTs in hiring and promotion. Before using an AEDT, covered employers must obtain an annual independent bias audit, publish a summary of the most recent audit on their website, and provide candidate notice that an AEDT will be used (including how it will be used and the type of data collected).

The NYC Department of Consumer and Worker Protection (DCWP) enforces LL144 and may impose per-day civil penalties for non-compliance. DCWP also established an arrangement with the NYC Office of Technology and Innovation (OTI) for technical assistance in evaluating tools and compliance.

State Comptroller’s Audit Findings

In December 2025, the New York State Comptroller issued Audit Report 2024-N-6, assessing DCWP’s enforcement of LL144 from July 2023 through June 2025. The audit concluded that DCWP had not designed or implemented an effective enforcement system and identified weaknesses that may have allowed non-compliance to persist undetected.

• Complaint intake did not appear to work as intended. DCWP received very few AEDT complaints during the audit period and did not validate whether intake and routing processes (including 311) were capturing LL144 issues.
• Proactive reviews were limited and methodologically weak. DCWP reviewed a sample of company websites/bias audits and identified minimal issues; the Comptroller’s review of the same sample flagged substantially more potential non-compliance—suggesting gaps in review criteria and coverage of LL144 requirements.
• Technical expertise was underused. Despite acknowledging limited in-house technical capability, DCWP did not consistently leverage OTI support when determining whether tools qualified as AEDTs.
• Outreach and education were not sustained. Limited ongoing engagement with stakeholders compounded the challenge of detecting violations in a regime that often relies on employers to self-identify and publicly post required materials.

Key Recommendations from the Audit

The audit recommended that DCWP strengthen complaint routing and analysis, test why complaints are rarely filed, broaden and standardize proactive compliance reviews (including use of existing enforcement resources), develop additional leads beyond complaints, and consistently use OTI’s technical support when assessing whether tools qualify as AEDTs and whether bias audits and notices satisfy LL144.

For employers, the message is that quiet enforcement activity should not be read as low exposure: LL144 compliance can tighten quickly if DCWP implements the audit’s recommendations, and non-compliance is often detectable only through structured reviews rather than individual complaints.

Connecticut: SB5 and Amendments to State Employment Discrimination Law 

Connecticut’s Senate Bill No. 5 (SB5) creates requirements spanning several areas of AI policy, including AEDTs. Effective October 1, 2027, it establishes a framework derived from laws such as New York’s LL 144. 

Scope and Coverage

Under the framework, AEDT is defined broadly and covers any technology that processes personal data and uses computational processes whose output is a substantial factor used to materially influence an employment-related decision. Disclosure and notice obligations will apply when AEDT output is used as a substantial factor in altering the outcome of an employment decision. However, disclosure is unnecessary when it is obvious to a reasonable person that they are interacting with AEDT technology. 

Additionally, similar to Illinois’s House Bill 3773, SB5 amends Connecticut’s human rights statute, stating that the use of AEDT is not a defense to discrimination claims, while also allowing for the consideration of evidence of anti-bias testing when evaluating these claims. 

Key Requirements

Unlike New York’s LL 144, rather than conducting bias audits or risk assessments, there is a focus on disclosure and written notice to both applicants and employees. 

Deployers are required to provide notice disclosing that: (a) an AEDT has been deployed; (b) the AEDT’s purpose and the nature of the decision; (c) the AEDT’s trade name; (d) the categories of personal data to be analyzed and how it will be assessed; (e) the sources of the data; and (f) contact information of the deployer.

In comparison to previous versions of the bill, there is no longer a requirement to provide written notice disclosing information concerning the right to opt-out of the processing of personal data, nor is there a requirement to give a statement disclosing the core reasons for an adverse employment decision. 

However, although bias audits are not explicitly required, courts or the commission may consider evidence of anti-bias testing and similar efforts when evaluating discrimination claims. 

Compliance Considerations

Employers using (or procuring) AI-enabled HR tools should consider the following practical steps:

• Inventory tools and decision points. Map where AI influences or facilitates employment decisions (screening, assessments, interviews, advertising, performance/discipline) and identify the responsible owner, vendor, and workflow.
• Build notice packages for Illinois and Connecticut. Start collecting the tool/vendor and data-processing information that Illinois’s draft rules suggest will be needed for detailed, multi-channel disclosures (including accommodation language and retention processes). Prepare notices for Connecticut AEDTs.
• Test for discriminatory effects. Even where audits are not formally required, evaluate tools for disparate impact and document mitigations (human review, thresholds, alternative assessments, monitoring).
• Maintain LL144 core artifacts. If operating in NYC, ensure annual independent bias audits are completed, summaries are posted, and candidate notices are accurate and consistently delivered.
• Strengthen vendor governance. Contract for transparency, audit/assessment support, change notifications, and cooperation with notices and bias-audit obligations; avoid “black box” deployments in regulated jurisdictions.

With more jurisdictions moving to regulate workplace AI, companies should treat AI-enabled employment tools as part of a compliance-managed process—combining governance, testing, and jurisdiction-specific notices—rather than an isolated technology initiative.

This article was written with the assistance of summer associate Ariana Pizzo.

Follow Nelson Mullins' Idea Exchange for more thought leadership from our AI Task Force, or click here to subscribe to emails from the Nelson Mullins AI Task Force blog.