AI Bias Audit Legal Requirements in 2026: NYC LL 144, EU AI Act, Colorado AI Act, Illinois AIVIA, EEOC Guidance, and California SB 1001 — What You Actually Have to Do

**NYC Local Law 144** is the most operationally specific bias audit law on the planet. The DCWP final rules at https://www.nyc.gov/site/dca/about/automated-employment-decision-tools.page define an Automated Employment Decision Tool as software that uses machine learning, statistical modeling, or AI to substantially assist or replace discretionary employment decisions. If you use one for NYC-based hires or promotions, you must commission an annual independent bias audit, publish a summary on your public site, and notify candidates at least ten business days before the AEDT is used. The audit must compute selection rate ratios and impact ratios across race/ethnicity and sex categories using the federal four-fifths rule framework — not a marketing 'fairness score.'

**The EU AI Act** at https://artificialintelligenceact.eu/ is a horizontal product safety regulation that treats AI like a regulated good. Annex III lists eight categories of high-risk systems; #4 covers AI used in employment, worker management, and access to self-employment — recruitment, advertising, screening, evaluating performance, terminating relationships. Providers of high-risk AI must run conformity assessments, maintain technical documentation, register the system in the EU public database, and operate a post-market monitoring system. Deployers must run a fundamental rights impact assessment, ensure human oversight, monitor system operation, and report serious incidents within 15 days. Most high-risk obligations apply from August 2, 2026; obligations for products in Annex II apply from August 2, 2027.

**The Colorado AI Act** (SB24-205) at https://leg.colorado.gov/bills/sb24-205 is the first comprehensive US state AI statute, effective February 1, 2026. It imposes algorithmic discrimination duties on both developers and deployers of high-risk AI systems — those making or substantially contributing to a consequential decision in employment, education, financial services, healthcare, housing, insurance, legal services, or essential government services. Deployers must run an annual impact assessment, notify consumers when high-risk AI is used to make a consequential decision, and offer correction and appeal rights. Enforcement is exclusive to the Colorado Attorney General; there is no private right of action, but algorithmic discrimination is treated as a deceptive trade practice.

**Illinois AI Video Interview Act** at https://www.ilga.gov/legislation/ilcs/ilcs5.asp?ActID=4015 has been in force since 2020 and is narrower than the headlines suggest. It applies only to employers using AI to analyze applicant video interviews for Illinois positions. Required actions: notify the applicant before the interview, explain how the AI works and what general characteristics it evaluates, obtain consent, limit who can view the video, destroy videos within 30 days of an applicant's request, and — if AI alone selects who advances to in-person interviews — report race and ethnicity data annually. There is no mandatory audit, but the disclosure-and-consent regime can stop a tool dead in its tracks if your vendor cannot describe the model in plain English.

**EEOC guidance** at https://www.eeoc.gov/ai is not new law — it is the agency's published view that Title VII, the ADA, ADEA, and GINA apply unchanged when AI is the decisionmaker. The 2023 technical assistance on the Uniform Guidelines on Employee Selection Procedures makes clear that the four-fifths rule is a starting point, not a safe harbor, for AI selection tools. The 2024 ADA guidance on AI in hiring addresses reasonable accommodation obligations when an assessment screens out candidates with disabilities. Employer liability does not transfer to the vendor; you are responsible for the discriminatory output of the tool you bought.

**California SB 1001** at https://leginfo.legislature.ca.gov/ is a bot-disclosure law that took effect July 1, 2019 — narrow but enforceable. It requires clear and conspicuous disclosure when an online bot is used to incentivize a sale or influence an election vote with California residents. **California AB 2930** is the proposed automated decisionmaking statute that has been re-introduced multiple times. As of June 2026, AB 2930 is not yet enacted — verify status at https://leginfo.legislature.ca.gov/. The California Civil Rights Council has finalized regulations on automated decisionmaking systems in employment under FEHA, effective October 2025, which functionally extend bias audit expectations to California employers.

NYC LL 144 is the only one of the six regimes that mandates an independent auditor by statute, and the DCWP rules are surprisingly strict. Per https://www.nyc.gov/site/dca/about/automated-employment-decision-tools.page, an independent auditor must not have been involved in the development, training, or use of the AEDT; must not have a direct financial interest in the AEDT's continued use; and must not be an employee of the employer or the vendor. Practically, this disqualifies most vendor-led 'we audited ourselves' reports and forces engagement with a third-party firm — often a labor economist, an industrial-organizational psychologist, or a specialized algorithmic auditing firm.

The EU AI Act takes a different approach. For most Annex III high-risk systems, providers can self-certify through an internal conformity assessment per https://artificialintelligenceact.eu/. Only a narrow subset — remote biometric identification systems and AI components of products already covered by Annex II — require a Notified Body, the EU's accredited third-party assessor regime. This means most EU high-risk AI providers will run internal quality management systems documented to ISO/IEC 42001 or similar standards, and only call in a Notified Body when their product touches biometric identification or a regulated product category.

Colorado's SB24-205 does not require an independent auditor by statute. The impact assessment that deployers must complete can be performed internally, but it must include a description of the high-risk AI's purpose, intended outputs, data used, mitigation steps for algorithmic discrimination, and post-deployment monitoring. Pragmatically, the impact assessment must be defensible if the AG asks for it — which means most Colorado deployers will use a third-party assessor anyway, even though they are not strictly required to.

Illinois AIVIA does not require any audit at all. The compliance obligation is procedural: notify, explain, consent, restrict access, destroy on request, report demographics. The EEOC similarly does not mandate a specific audit. It does, however, expect employers to validate selection tools under the Uniform Guidelines on Employee Selection Procedures — a standard that pre-dates AI and that most AI hiring vendors do not meet out of the box. The compliance gap here is significant and underestimated.

California's emerging FEHA regulations on automated decisionmaking systems, effective October 2025, are closer to NYC LL 144's posture — they require anti-bias testing, recordkeeping for four years, and documentation of how the system was validated for the specific employment use case. They do not mandate an independent third party, but they do require records the Civil Rights Council can inspect on request.

The practical 2026 playbook: if you operate in NYC, hire an actual independent auditing firm. If you operate in the EU, build an internal quality management system aligned to ISO/IEC 42001 and reserve Notified Body engagement for biometric or Annex II products. If you operate in Colorado, document the impact assessment with the rigor you would use for a SOC 2. If you operate everywhere, the cheapest path is engaging one auditor whose work product satisfies the strictest regime that applies to you — usually NYC.

NYC LL 144 mandates an annual bias audit before an AEDT is used and every year thereafter. The DCWP rules at https://www.nyc.gov/site/dca/about/automated-employment-decision-tools.page require that the audit use data from at least the prior twelve months of actual use — or, if not available, test data prepared in a documented methodology. The audit summary that appears on your public site must include the dates of the audit, the source of the data, and selection rate plus impact ratio calculations for each major race/ethnicity and sex category. This is not a one-and-done procurement event; it is a recurring operational cost.

The EU AI Act treats cadence as continuous rather than annual. Post-market monitoring under Article 72 requires providers to systematically collect, document, and analyze data on the performance of the high-risk AI throughout its lifetime. Serious incidents must be reported to authorities within 15 days. Significant modifications that affect compliance trigger a fresh conformity assessment. Practically, this is heavier than an annual audit — it is a permanent process, more like ISO 27001 surveillance audits than a once-a-year report card.

Colorado's SB24-205 requires an impact assessment annually and within 90 days after any intentional and substantial modification to the high-risk AI system. The Colorado AG can also require additional documentation on request. The cadence is similar to NYC's but the substance is broader — Colorado's impact assessment must address all consequential decisions, not just employment.

Illinois AIVIA has no audit cadence because it has no audit. The annual race/ethnicity demographic reporting obligation only kicks in if AI is the sole basis to advance candidates to in-person interviews, and the data goes to the Illinois Department of Commerce and Economic Opportunity, not to a public database.

EEOC enforcement does not impose a cadence but expects ongoing monitoring under the Uniform Guidelines. Practically, employers should refresh their adverse impact analysis quarterly during heavy hiring cycles and annually otherwise, with a full revalidation any time the tool, the role, or the candidate population materially changes. Failure to monitor is a key fact pattern that turns a defensible disparate impact case into an indefensible one.

The cross-cutting answer: build an annual audit calendar that includes NYC LL 144, Colorado impact assessment, EU post-market monitoring report, and EEOC adverse impact review on the same cycle, then layer change-triggered re-audits when the model, training data, or use case changes materially. This is what most large multi-state employers are running by mid-2026, and it is what the AI vendor security questionnaire at AI vendor security questionnaire should be probing your vendors for as well.

NYC LL 144 requires candidate notice at least ten business days before the AEDT is used. The notice must state that an AEDT will be used, what job qualifications and characteristics will be evaluated, where the candidate can request information about the data collected, and where to find the most recent bias audit summary. Critically, the candidate may request an alternative selection process — though the law does not require the employer to grant that request, denying it without a documented reason is the kind of fact pattern plaintiffs' counsel loves.

The EU AI Act layers multiple notice obligations. Article 26 requires deployers of high-risk AI to inform natural persons subject to the system's use that they are subject to such use. Article 86 grants affected persons the right to a clear and meaningful explanation of an AI-assisted decision that produces legal or significant effects. Article 50 requires transparency for emotion recognition and biometric categorization systems regardless of risk tier. The aggregate effect is that EU candidates must know they are being evaluated by AI, must understand the decision, and must have a path to human review.

Colorado's SB24-205 builds in a pre-decision notice obligation, an explanation right when AI contributes to an adverse consequential decision, the right to correct personal data used by the system, and the right to appeal to a human reviewer. The deployer must also publicly publish a summary statement describing what high-risk AI systems they use and how. This is the most consumer-rights-heavy of the US state regimes and the closest in spirit to the EU AI Act.

Illinois AIVIA requires three things before the interview: notify the applicant that AI may be used, explain how the AI works and what general characteristics it evaluates, and obtain explicit consent. If the applicant does not consent, the employer cannot use the AI analysis. Post-interview, the applicant may request that the video be destroyed and must be destroyed within 30 days of that request, including by all third parties.

EEOC technical assistance recommends — but does not require — that employers give candidates notice that AI is being used and an opportunity to request reasonable accommodations. The ADA reasonable accommodation obligation is the sharp edge here: if an assessment screens out a qualified candidate with a disability who could perform the job with accommodation, the employer is liable regardless of whether the AI was the proximate cause of the screen-out.

California's combined regime — SB 1001 bot disclosure, CCPA/CPRA right to opt out of automated decisionmaking once the regulations are finalized, and FEHA automated decisionmaking regulations — creates a notice obligation that resembles a hybrid of EU AI Act and Colorado. The pragmatic compliance posture for any multi-state employer is to write one candidate notice that satisfies the strictest applicable regime and deliver it before any AI evaluation, every time, regardless of jurisdiction. Trying to gate notice by candidate IP geolocation is more legal risk than it is worth.

NYC LL 144 penalties are modest on their face but compounding in practice. Per https://www.nyc.gov/site/dca/about/automated-employment-decision-tools.page, the first violation is $500, each subsequent violation up to $1,500, and each day of continuing violation counts as a separate violation. For an AEDT used on hundreds of candidates over months before an enforcement action lands, the math is brutal. DCWP has issued enforcement notices since 2023 — verify current enforcement posture at the DCWP page before any deployment.

The EU AI Act has the highest theoretical penalty regime in the world for AI. Article 99 sets maximum fines at EUR 35 million or 7% of total worldwide annual turnover for prohibited practices, EUR 15 million or 3% for high-risk violations, and EUR 7.5 million or 1% for supplying incorrect information to authorities. The percentages bind even mid-cap companies that would not approach the absolute caps. Enforcement is by national competent authorities in each Member State; expect German, Dutch, and Irish DPAs to lead aggressive enforcement based on their GDPR track record.

Colorado's SB24-205 is enforced exclusively by the AG. There is no private right of action, which materially limits litigation risk compared to traditional discrimination statutes. Violations are treated as deceptive trade practices under Colorado law, which means penalties up to $20,000 per violation under the Colorado Consumer Protection Act, plus injunctive relief and restitution. The AG can also require compliance reports and impose consent decrees.

Illinois AIVIA has no specific monetary penalty in the statute itself. Enforcement runs through the Illinois Human Rights Act if discrimination is alleged, and the Illinois Attorney General has parallel consumer protection authority. The practical penalty exposure is a discrimination claim under IHRA, where damages can be substantial. The recordkeeping and disclosure obligations are also evidence the plaintiffs' bar will demand in any related discrimination case.

EEOC enforcement uses the Title VII penalty regime: back pay, compensatory damages up to caps that vary with employer size, punitive damages, attorney's fees, and injunctive relief. EEOC has been signaling AI hiring tool enforcement since 2022 and has resolved settlements involving algorithmic screening tools that produced disparate impact against older workers. The litigation cost alone often exceeds the audit cost by an order of magnitude.

California SB 1001 violations are unlawful business practices under the UCL, with penalties up to $2,500 per violation plus injunctive relief. The new FEHA automated decisionmaking regulations carry FEHA discrimination remedies — back pay, emotional distress damages, punitive damages, attorney's fees. Texas TRAIGA (HB 149, the Texas Responsible AI Governance Act) was enacted in 2025 — verify current text at https://capitol.texas.gov/ — and creates a tiered penalty regime for prohibited and high-risk AI uses, plus a regulatory sandbox; it is the third US comprehensive state AI law and is increasingly cited by counsel as a template for what other red-state legislatures will pass in 2027.

The independent auditor market has matured fast since NYC LL 144 went live. The credible vendors fall into three buckets. First, established labor economics and I/O psychology consultancies — Aon, Korn Ferry, SHL, DCI Consulting — that have decades of disparate impact analysis experience and have built AEDT audit practices on top. Second, algorithmic auditing specialists like ORCAA, Babl AI, BNH.AI, and Eticas that focus exclusively on AI fairness audits. Third, Big Four advisory practices — Deloitte, EY, KPMG, PwC — that bundle AI audits into broader risk assurance engagements.

Pricing as of June 2026 is opaque because vendors quote per system. A defensible AEDT bias audit for a single hiring tool used at moderate scale runs roughly $25,000 to $75,000 for the first engagement and $15,000 to $40,000 for annual renewals, per practitioner reporting; verify with each vendor before contracting. EU AI Act conformity assessments by a Notified Body for biometric systems run materially higher — six figures is common. Colorado impact assessments performed internally are essentially the loaded cost of two to four weeks of compliance and legal time per high-risk system.

The cheapest credible path for a US-only multi-state employer is engaging one specialist auditor — typically an algorithmic auditing firm — to run a single audit work product that satisfies NYC LL 144's selection rate and impact ratio requirements, Colorado's impact assessment requirements, and EEOC's adverse impact framework simultaneously. This requires asking the auditor up front for a multi-regime scope of work; do not let them default to the NYC-only template.

Where build-it-yourself works: large employers with internal I/O psychology or people analytics teams can run the actual statistical analysis in-house and engage an outside auditor only for the independence signature required by NYC LL 144. This pattern saves real money on annual renewals but requires that the internal team genuinely understands the four-fifths rule, two-sample tests, and the EEOC's preferred validation studies. If your in-house bench is shallow, this becomes 'we did it ourselves and the AG noticed.'

Where build-it-yourself does not work: any time the AI system is a black-box vendor model where you cannot inspect training data or model weights. In those cases, the audit is a downstream input-output analysis only, and the vendor often holds the data you need to do it. Push the vendor to provide audit-ready data exports as a contractual obligation — selection rates by candidate demographic, score distributions by demographic, validation evidence by job family. If they refuse, the tool is not deployable in NYC, Colorado, or the EU.

The bottom line on the auditor decision: do not let your AI vendor pick your independent auditor. The conflict-of-interest rules in NYC LL 144 make vendor-selected auditors a defensibility risk, and the optics in any enforcement action are bad. Engage an auditor directly, with a scope of work written by your counsel, and treat the auditor's report as your work product — not the vendor's marketing collateral. The matching policy framework lives at AI acceptable use policy template.

Texas joined the comprehensive AI statute club with HB 149 — the Texas Responsible AI Governance Act — enacted in 2025; verify current text and effective dates at https://capitol.texas.gov/. TRAIGA borrows structure from the EU AI Act and Colorado SB24-205 but is narrower than either: it focuses on prohibited uses (manipulative AI, social scoring by government), creates a regulatory sandbox under the Texas Department of Information Resources, and imposes algorithmic-discrimination duties on developers and deployers of certain high-risk systems. Enforcement is by the Texas Attorney General. Penalty tiers run from $10,000 to $200,000 per violation, with cure-period provisions that NYC LL 144 lacks.

Beyond the comprehensive statutes, a thicket of sectoral rules now expects bias-audit-like documentation. The Department of Housing and Urban Development's 2024 guidance on tenant screening AI; the CFPB's adverse action notice expectations when AI is used in credit decisions; the FDA's published framework for AI/ML medical devices with the Predetermined Change Control Plan; New York Department of Financial Services Circular Letter No. 7 on AI in insurance underwriting — each of these now expects fairness testing documentation that looks a lot like a bias audit, even if the statute does not use the words.

State-level activity is accelerating. As of June 2026, more than 25 US states have either enacted or have pending comprehensive AI legislation. Connecticut, Virginia, New Jersey, and Washington all have bills in committee that follow the Colorado template — high-risk AI systems, impact assessments, algorithmic discrimination duties, AG enforcement. The pragmatic compliance posture for any multi-state employer is to assume the Colorado regime is the floor and design around it.

On the federal side, no comprehensive AI statute has cleared Congress as of June 2026. The October 2023 White House Executive Order on AI was rescinded in early 2025 and replaced with a lighter-touch directive emphasizing US AI competitiveness. NIST's AI Risk Management Framework remains the de facto federal reference and is increasingly cited by state regulators — the NIST AI RMF Generative AI Profile published in 2024 is the document your compliance team should be reading alongside the statutes.

Internationally, the OECD AI Principles, UK's pro-innovation approach (no comprehensive statute, sector-led), Canada's AIDA (delayed but pending), Brazil's PL 2338 (passed Senate in 2024), Korea's Framework Act on AI (effective 2026), and Japan's lighter guidance regime all shape multinational compliance. If you operate in the EU plus three of these jurisdictions, you are running at least five overlapping audit regimes. Map them to one matrix and pick the strictest as your global floor.

What is coming next that practitioners should be watching: the EU AI Office's harmonized standards under Article 40, which will define what 'conformity' actually means in practice; the next round of NYC DCWP rule revisions that may extend AEDT obligations to broader employment decisions; the Colorado AG's first enforcement actions in 2026 that will calibrate expectations; and the FTC's continued posture that AI-driven unfair or deceptive practices are squarely within Section 5 enforcement, regardless of state statute. The compliance burden is going up, not down. Build for it now.

If I were standing up an AI bias compliance program for a US multi-state employer with 5,000 employees and AI in hiring tomorrow, I would do four things. First, commission an NYC LL 144 bias audit on every AI hiring tool used for NYC roles, even tools used in only one role, even tools the vendor claims are 'not AEDTs.' The DCWP definition is broad and the penalty for being wrong is more expensive than the audit. Use a specialized algorithmic auditing firm, not the vendor's preferred partner.

Second, run a Colorado SB24-205 impact assessment on every high-risk AI system before February 1, 2026. The impact assessment scope is broader than NYC LL 144's bias audit — it covers algorithmic discrimination mitigation, data quality, post-deployment monitoring, and consumer notice. Document it like you would document a SOC 2 control narrative. The Colorado AG will be looking for substance, not boilerplate.

Third, if you have any EU footprint — even just EU-resident customers, EU-resident employees, or EU-targeted output of the AI — assume the EU AI Act applies and build the technical documentation and post-market monitoring system now. The August 2026 deadline for most high-risk obligations is a hard wall; do not start scoping in Q2.

Fourth, write one candidate notice template that satisfies NYC LL 144, Colorado SB24-205, Illinois AIVIA, California FEHA automated decisionmaking, and the EU AI Act Article 86 explanation right simultaneously. Deliver it to every candidate at the start of any AI-evaluated process, regardless of jurisdiction. Trying to gate notice by candidate location is more risk than it saves.

If I were a small employer — say, 50 to 200 employees, no NYC roles, no EU footprint — the calculus is simpler. The EEOC framework binds you regardless of state law; document your AI hiring tool selection, validate it under the Uniform Guidelines as best your vendor allows, run an internal adverse impact review quarterly during heavy hiring periods, and revisit each January. If Colorado roles appear, add the SB24-205 impact assessment. If NYC roles appear, hire the auditor.

The one thing I would not do in 2026 is treat AI bias audits as a one-time procurement event. The statute text is settling, but the enforcement posture and the harmonized standards are still being written. Build a compliance program that updates annually, not a checkbox that ages instantly. And for everything you build, validate that your AI vendors will support it — the AI vendor security questionnaire covers the procurement-side questions that map to these obligations.