Notices and records for automated decisions

There is no single US definition. Colorado's replacement law regulates automated decision-making technology. California's privacy regulator uses the same phrase and applies its rules to significant decisions, which include employment, as reported by Hunton. California's civil rights regulations refer to automated-decision systems used by employers. Illinois refers to artificial intelligence used in recruitment, hiring, promotion, discipline and similar decisions. New York City's law covers automated employment decision tools.

The terms overlap without matching. A resume-screening tool is likely to fall under all of them. A scheduling tool or a spelling checker is unlikely to fall under any. Between those two sit scoring and ranking tools that a person reviews before deciding, and whether those are covered depends on the wording of each rule.

Start with an inventory. List each system that scores, ranks, filters or recommends in a decision about a person, what decision it feeds, and who the affected people are. Whether a particular system is in scope under a particular rule is a question for counsel.

The table lists the rules covered in this guide with the status found in the research as of 12 November 2026. Most of these descriptions come from law-firm summaries. The Colorado description comes from a Davis Wright Tremaine alert that was read in full. Treat the table as a starting point and read the rule itself before acting.

Two heavier regimes were cut back or delayed during 2026. Colorado repealed its original law before it took effect. The European Union postponed its high-risk obligations. The remaining duties are lighter and centre on notice, explanation and records.

Colorado's original AI Act, SB 24-205, never took effect. On 14 May 2026 the Governor signed SB 26-189, which repeals it and puts a disclosure-and-rights framework in its place from 1 January 2027, according to Davis Wright Tremaine. The risk-management programme, impact assessments and duty of care in the old law were removed.

Under the new law, as that alert describes it, developers must give deployers technical documentation and tell them about material updates. Deployers must give a pre-use notice and an adverse-outcome notice within 30 days. They must offer a route to correct inaccurate personal data and provide meaningful human review and reconsideration to the extent commercially reasonable. Developers and deployers must both keep compliance records for at least three years. Notices have to be accessible to people with disabilities and people with limited English proficiency.

Enforcement belongs to the Attorney General alone. There is no private right of action, and a 60-day cure period runs until 1 January 2030. The Attorney General was required to adopt rules on the format of adverse-outcome disclosures by 1 January 2027. The research did not confirm whether those rules were finished.

The first set comes from the Civil Rights Council under the state's fair employment law. Mayer Brown reports that these regulations took effect on 1 October 2025 and that employers must keep records related to automated-decision systems, including inputs, outputs, selection criteria and audit findings, for four years. The period used to be two years.

The second set comes from the California Privacy Protection Agency. Hunton reports that the regulations took effect on 1 January 2026, and that businesses using automated decision-making technology for significant decisions must meet the specific requirements by 1 January 2027. Those requirements are a pre-use notice, an opt-out that can be submitted in at least two ways, and access.

A California employer may be covered by both sets. The first is about discrimination and evidence. The second is about telling people in advance and letting them opt out. One notice and one record store can serve both if they are designed with both in mind.

Illinois HB 3773 has been in force since 1 January 2026. Hinshaw reports that it makes discriminatory use of AI in employment decisions a civil rights violation and makes failure to give notice of AI use a separate violation. It does not require a bias audit or an impact assessment. Seyfarth reports that the Illinois Department of Human Rights published proposed notice rules on 15 May 2026 and withdrew them on 2 June 2026. The statute applies, and the form of a compliant notice is undefined.

New York City's Local Law 144 has applied since July 2023. A New York State Comptroller audit published in December 2025, covering July 2023 to June 2025, called enforcement ineffective. The city agency received two complaints about these tools in the whole period. DLA Piper's summary of the audit says the Comptroller reviewed 32 companies and found 17 instances of potential non-compliance, where the agency's own review had found one. The agency disputed that non-compliance is widespread and accepted most of the recommendations.

Weak enforcement does not remove the obligation. It does explain why many employers have treated these rules as low priority, and why private lawsuits have become the stronger pressure.

In Mobley v. Workday, a federal court in California preliminarily certified an age-discrimination collective in May 2025 for applicants aged 40 and over rejected through Workday's system. CDF Labor Law reports that in June 2026 the court largely denied Workday's motion to dismiss the latest complaint, that an early appeal was refused in July 2026, and that a class motion is pending.

Kistler v. Eightfold AI was filed in January 2026. Jones Walker reports that it alleges Eightfold's candidate scores are consumer reports under the Fair Credit Reporting Act, which would bring disclosure, authorization and dispute rights with them. Eightfold denies this, and no ruling was found.

In Colorado, Davis Wright Tremaine reports that xAI said it would file a new motion for a preliminary injunction against the replacement law by 11 June 2026, and that a grant could delay the effective date. The research found no outcome for that motion.

The surviving rules ask for evidence that people were told and that their requests were answered. A policy document does not show that. A dated entry per person does.

The checklist below combines the duties described above. No single rule requires every item, and retention periods differ: at least three years in Colorado and four years for California employment records. Consentra's Decision Notices tracks these notices and requests per person.

• An inventory of each automated system, the decision it feeds and the vendor that supplies it.
• The pre-use notice: its exact wording, the version in use on each date, and the languages and accessible formats offered.
• Proof of delivery for each person: when the notice was shown or sent, through which channel, and to what address or account.
• Adverse-outcome notices, with the date of the decision and the date the notice went out, so the 30-day period can be checked.
• Each request to opt out, correct data, get an explanation or have a person review the decision, with the date received, who handled it and the result.
• Technical documentation and update notices received from the vendor.
• System inputs, outputs and selection criteria for employment decisions, kept for the period the rule requires.
• A log of when each rule and date was last checked, because the dates have changed more than once.

Colorado is the clearest example. The original law was repealed before it ever applied, and the replacement faces a motion that could delay it. The Attorney General's rules on notice format were due on the same day the law takes effect.

The EU followed a similar path. Addleshaw Goddard reports that Regulation (EU) 2026/1744 entered into force on 27 July 2026 and moved stand-alone high-risk obligations, which include employment systems, from 2 August 2026 to 2 December 2027. Obligations for systems built into products moved to 2 August 2028.

Plan for 1 January 2027 in California and Colorado, and check both again before that day. A notice and record process built for the common duties will still be useful if one date moves, because the same duties appear in several rules.