If you’re running AI anywhere in the employment lifecycle, there are three things worth watching: the laws in the states where you actually employ people, what enforcers and courts are doing with those laws, and the terms your AI vendors set for their own tools. That third one is the category HR functions almost never track, and it moves faster than the other two.
The reason this falls on you is simple: there is no federal rulebook. Back in 2023, the EEOC tried to set some goalposts for hiring software and algorithms, but that guidance has literally vanished from their site. Don’t let the missing page fool you, though, the underlying rules haven’t changed.
The heavy-hitter laws like the ADA, Title VII, and more, apply to an AI screening tool exactly like they apply to a human manager. While the federal government has slowed down on filing its own cases lately, private lawyers and state regulators are more active than ever.
Washington isn’t coming to save you with a single national standard, either. Recent efforts to pause state AI laws failed miserably in the Senate, and a new Justice Department task force is focused on court battles, not helping you with HR policy. You answer to the states, and some are moving fast.
So the states are writing the rules, and they’re not converging. Some are following the federal lead and putting nothing new on employers. Others are writing real duties into their civil rights law.
Most people don’t know it’s happening. As of February 2026, 19 of the most populous states had AI laws affecting employer or employment use. The Society for Human Resource Management (SHRM) found that 57% of HR professionals working in those states weren’t aware of them.
State Laws Are Moving Targets, Not Checklists
If you’re trying to build a static compliance program based on current state laws, you’re going to be behind in a few months. States are constantly updating the guidance and enforcement mechanisms that define how those laws actually apply to your HR tools.
You don’t need a map of every state’s current bills. You need a system that alerts you when the goalposts move for the locations where you actually employ people. To stay ahead, focus on these three filters:
- Follow the enforcement, not the headlines: Ignore the political noise. Only pay attention to the guidance that changes how an agency or court assesses your specific tools.
- Map your footprint: Ignore all-state analysis. If you don’t have employees in a state, its AI legislation is irrelevant to you.
- Shift to reactive agility: Don’t build policies for what if. Build a process that tells you exactly when a legislative change creates a mandate you need to act on.
Get these three right, and you stop chasing every headline out of a state you don’t even operate in. You start reacting only to the changes that actually create risk for your business.
Your AI Vendors’ Terms Change
The biggest risk in your HR tech stack is the AI terms. Most enterprise platforms now bury their AI policies in supplemental documents updated unilaterally, without notifying you. These terms often supersede your master agreement, granting vendors rights to your data that you never explicitly agreed to.
Here is how to keep control:
- Assume terms are temporary: Never treat an AI terms document as a fixed agreement. It is a living document that can (and will) change.
- Audit your silent permissions: Check if your hiring platform’s AI terms grant the vendor a perpetual, royalty-free license to use your interview data for their own model training. If they do, your private interview notes are fueling their product.
- Stop relying on IT/PEO: Your IT team manages software access, but they don’t audit legal compliance. PEOs manage rules for payroll and tax, not for your AI settings. This specific review falls squarely on your desk.
None of this requires a legal team on retainer. It requires someone who actually reads what you signed, and who checks back when the vendor quietly rewrites it.
Knowing What Changed Isn’t Knowing What to Do
You can subscribe to every law firm newsletter on the planet, but they’re all organized around the event, not your business. They tell you what Colorado did or what an agency withdrew, but they don’t tell you if that actually impacts your specific hiring platform or your team.
The reality is that information—the news of a law—is not the same as execution.
Most HR professionals know these laws exist, yet few have policies to show for it. Why? Because the gap between “reading the update” and “taking the right action” is where most people get stuck. If you’re spending hours parsing regulatory updates only to realize you didn’t need to do anything, you’ve wasted money you could have spent on actual compliance.
The goal isn’t to be the most informed person in the room. It’s to be the most defensible. When someone questions a decision your tool made, nobody cares what you read in a newsletter. They care about what you wrote down, how you configured your tools, and why you made the choices you did at the time.
That is why I built POLARIS. It is an AI compliance subscription that filters out the noise. Instead of sending you everything, I map your specific footprint, the states where you employ people and the tools in your stack, and send you a monthly briefing that tells you exactly what changed, whether it impacts you, and if you need to take action.
It’s not legal advice, that should always come directly from your employment attorney. This is an early warning system that tells you when you actually need to call your lawyer, so you aren’t paying for hours you don’t need.
Here’s What I Built Because Nobody Else Was Watching This
I’ve spent years sitting in the room when a compliance gap turns into a lawsuit, an investigation, or a very uncomfortable board conversation. The pattern is always the same: nobody was tracking the thing that mattered until it was too late to do anything but react.
You don’t need to become a regulatory analyst. You need someone who already thinks like a fractional CHRO and a lawyer watching your blind spots for you.
Get the briefing before you need the lawyer. Get Your POLARIS Briefing today.
FAQ
We only hire in one state, and our PEO handles compliance. Is this still a job for us? Often, yes. Your PEO handles payroll, tax, and general HR rules, but they aren’t reading the AI terms buried in your hiring platform’s contract. Those vendor terms don’t care how many states you’re in, and they are where your liability often hides.
Our AI vendor emails us when their terms change. Isn’t that enough? Not really. A vendor notification tells you a document changed. It doesn’t tell you what changed, why it matters, or if it conflicts with your compliance requirements. The analysis is still on you to do before you know if it’s a problem.
If we can only watch one of the three (Laws, Enforcement, Vendor Terms), which changes fastest? Vendor terms. A state law takes a legislative session to pass and months of rulemaking to enact. Conversely, a major hiring platform can update its AI Terms three times in four months without a single public hearing. That is where most companies get tripped up.
We only use AI for resume screening. Doesn’t that make this smaller? It rarely stays that way. AI features are often rolled out in payroll, scheduling, and performance tools as checkbox updates during renewal. If you aren’t tracking your entire stack, you likely have AI usage you aren’t accounting for.
