If your business uses AI to screen resumes, rank applicants, or decide who gets credit, state AI laws now reach that decision — and January 1, 2027 is the next hard date. This guide explains the state AI laws small business owners need to track: two laws already in force in Illinois and Texas, and two sets of rules due January 1, 2027 in Colorado and California. It is general information, not legal advice. Most rules do not ban AI tools; they require notice, a correction route, and a human who can look again.
Table of Contents
The short version: four states, two deadlines
| State | Law | Status | What it mainly asks |
|---|---|---|---|
| Illinois | HB 3773 (Illinois Human Rights Act) | Since January 1, 2026 | Notice for AI in employment decisions; no discriminatory AI effect |
| Texas | TRAIGA, HB 149 | Since January 1, 2026 | No AI deployed with intent to unlawfully discriminate |
| Colorado | SB 26-189 (rewritten Colorado AI Act) | January 1, 2027 | Pre-use notice, 30-day adverse notice, correction, human review, 3-year records |
| California | CCPA ADMT regulations | By January 1, 2027 (existing uses) | Pre-use notice, opt-out or appeal, access to decision information |
No federal AI statute overrides these rules. A December 2025 executive order directed agencies to challenge state AI laws, and a bipartisan federal discussion draft appeared in June 2026, but no overriding federal law has passed, per BuildAIPolicy’s November 2026 tracker.
Already in force: Illinois and Texas
Illinois: notice plus an effects test
Illinois HB 3773 amends the Illinois Human Rights Act. Since January 1, 2026, it has been a civil rights violation to use AI in an employment decision — recruitment, hiring, promotion, discipline, or discharge — in a way that has the effect of subjecting employees to discrimination. Employers must also give notice of AI use, and the law bans using ZIP codes as a proxy for a protected class.
That effects test matters: Illinois does not ask only about intent. If outcomes fall unevenly on a protected group, the result itself can be the problem. Enforcement runs through the civil-rights complaint process, led by the Department of Human Rights, with a civil action available in some cases.
One warning: the detailed notice rules are unfinished. The department proposed rules in May 2026, then withdrew them, and Gibson Dunn’s October 2026 newsletter reports no updated timeline. That does not pause the statute, but no template should be treated as the final word on the notice.
Texas: an intent test, enforced by the attorney general
TRAIGA (HB 149) also took effect on January 1, 2026. It prohibits developing or deploying AI with intent to unlawfully discriminate. Gibson Dunn notes the key limit: disparate impact alone does not prove intent, and the law imposes no notice or audit duties. Enforcement rests exclusively with the Texas attorney general, with no private right of action, a 60-day cure period, and penalties reported at $10,000 to $12,000 per violation. Document the tool’s legitimate purpose and criteria used — never deploy a tool you know screens out a protected group.
From January 1, 2027: Colorado’s rewritten law
Colorado’s first AI Act (SB 24-205, 2024) never took effect. Governor Polis signed SB 26-189 on May 14, 2026, replacing it with a narrower law effective January 1, 2027. Impact assessments, risk programs, and the duty of care are gone; a notice-and-recourse regime remains — the most detailed law here.
What counts: covered technology and consequential decisions
The law covers ADMT used to materially influence a consequential decision: employment access, eligibility, selection, or compensation, plus lending, housing, insurance, education, health care, and government services. The output must affect the outcome — by ranking, scoring, recommending, or classifying a person.
Ordinary tools are carved out: calculators, databases, spreadsheets requiring human analysis, and tools solely summarizing or presenting information for human review with no score or ranking. General-purpose chat tools are excluded too, if not configured for consequential decisions and covered by an acceptable use policy. Drafting a job ad differs from ranking applicants.
The three duties
First, pre-use notice: before using covered ADMT, give a clear, conspicuous notice of its use in a consequential decision and how to obtain more information. Littler notes a notice in the online application process likely satisfies this.
Second, an adverse-action process: within 30 days of an adverse decision materially influenced by covered ADMT, give a plain-language description of the decision and the technology’s role, plus instructions for requesting information, data access, corrections, and human review. Review is limited to what is commercially reasonable — a qualifier Littler flags as a key issue.
Third, records: keep compliance records for at least three years, including version identifiers and changelogs where applicable. Only the attorney general enforces the law — no private right of action — with penalties up to $20,000 per violation and a 60-day cure notice where cure is deemed possible. Regulations are due January 1, 2027, and enforcement will wait until rulemaking finishes. Treat January 1 as your readiness date.
The small-employer trap
A carve-out for employers with 40 or fewer employees does not protect a firm using covered ADMT to materially influence hiring or compensation. A 15-person firm letting a score decide interviews is in scope; one only drafting postings is not. Size helps only when the tool decides nothing.
From January 1, 2027: California’s rules — but only if the CCPA covers you
California’s rules sit inside the California Consumer Privacy Act (CCPA), not a standalone AI statute. The Privacy Protection Agency’s ADMT regulations were approved in September 2025 and took effect on January 1, 2026. Businesses already using ADMT for a significant decision before January 1, 2027 must meet the notice, opt-out, and access requirements by that date; later uses must comply before they begin.
The CCPA covers for-profit businesses doing business in California meeting any one threshold: revenue over $25 million; personal information of 100,000 or more California residents bought, sold, or shared yearly; or 50% or more of revenue from selling California residents’ personal information. Most very small firms meet none, so ADMT rules do not directly apply — though a contractor to a covered business can still face contractual data duties.
A significant decision provides or denies financial or lending services, housing, education, employment or contracting opportunities or compensation, or health care. For those, a covered business must give a prominent pre-use notice before collecting personal information for ADMT use, explaining the specific purpose and consumer rights. It must also offer an opt-out, with exceptions — including an appeal to a human reviewer who understands the output, considers the consumer’s information, and can overturn the decision. After an opt-out, it must stop ADMT use for that consumer as soon as feasible, within 15 business days at most. Risk assessments are a separate, phased duty. For background, see our guide to AI for small business, and for the earlier hiring-law pattern, see our Connecticut AI hiring law post. If you also sell to Europe, see our EU AI Act requirements for small business guide.
Your January 1, 2027 checklist
Keep a short written record of each step. That record is itself part of compliance in Colorado, and your best defense anywhere else.
- List every AI tool you use, including tools built into software you already pay for, and its actual use.
- Flag any tool that makes or influences a decision about a person: applicants, employees, borrowers, tenants, or customers seeking credit.
- For each flagged tool, note the affected people’s states, and whether it scores, ranks, recommends, or classifies them.
- Ask each vendor for documentation: intended use, data used, limitations, and how a human reviews output. A vendor that cannot answer has given you a finding.
- Draft the notices now: a pre-use notice for Colorado and California, and an adverse-outcome template naming who handles corrections and human review.
- Train tool users, and set a review date. Rulemaking is still open in Colorado, so re-check this list before relying on it again.
Common mistakes to avoid
First, assuming your vendor handles compliance: vendors document tools; the decision and its notice remain yours. Second, assuming small means exempt, which Colorado’s hiring exception disproves. Third, using one generic notice for every state: Illinois, Colorado, and California ask for different things, at different times. Fourth, letting the tool decide alone: if no human with real authority can change the outcome, the human-review promises are empty.
Does this apply if I only use AI to draft job ads?
Generally no, if a human still decides and the tool produces no score, ranking, or recommendation about anyone. The rules bite when a tool materially influences a decision, such as ranking or screening out applicants. If it starts suggesting who to interview, that needs a fresh check.
I run a 10-person firm. Am I exempt in Colorado?
Not for hiring. Colorado’s carve-out for employers with 40 or fewer employees does not protect a firm using covered technology to materially influence hiring or compensation. Using AI only to draft or summarize for human review differs from letting a score decide interviews.
Do California’s ADMT rules apply to my small shop?
Only if you meet a CCPA threshold: for-profit, doing business in California, and either over $25 million revenue, personal information of 100,000 or more California residents bought, sold, or shared yearly, or 50% or more of revenue from selling that information. Meet none, and the duties do not directly apply — but check contracts with covered businesses you serve.
Do I have to stop using AI hiring tools on January 1, 2027?
No. None of these laws requires you to stop using AI tools outright. They require notice before use, an explanation and correction and review route after an adverse outcome, and records showing what happened. Put those pieces in place before the deadline, and have a lawyer review your notices first.
Conclusion
January 1, 2027 is not a ban on AI in hiring or lending. It is the date Colorado’s rewritten law takes effect and California’s rules must be met for uses already underway, on top of Illinois and Texas rules already in force. The firms that cope best can already answer three questions: which tools decide anything about a person, which states those people are in, and who can explain and reverse a decision. Answer those this month, and the deadline becomes a checklist, not a surprise.
General information, last checked against the sources linked above on November 4, 2026 — not legal advice. For advice on your situation, speak to a qualified employment or privacy lawyer.
Was this article helpful?