If you’re like most business owners, you’re waiting for Washington to step in and settle the messy state-by-state rules on AI. The core question is preemption, the legal principle that a federal law can override state law.
For AI, the debate is whether Congress will pass a law that wipes out the new state-specific AI rules already on the books. Regardless of that political fight, the majority of your AI-related legal risk is already preemption-proof. Existing federal laws against discrimination (like those protecting race, age, and disability) already cover how you use technology, and they require your attention right now.
1. Wait-and-See Is the Most Expensive Posture in the Room
Most small business owners I talk to are treating the federal AI fight like it’s a scoreboard. They’re watching Washington, reading the news, and putting off the HR work until the rules settle.
That’s a trap. The foundational rules aren’t moving. Federal laws still hold you responsible if your hiring practices produce discriminatory results, even if you didn’t intend for them to.
Courts have recently ruled that AI vendors can be treated as your agents. This means that when you hand hiring tasks over to software, you are still legally responsible for the software’s actions, just as if a human employee had performed them.
AI liability lives in a gap most companies have built into themselves:
- Your HR manager understands your handbook but not the technical side of the software.
- Your lawyer understands the law but has likely never seen the inside of your hiring platform.
- The risk sits exactly where those two don’t meet.
You need to look at your software contracts and the law at the same time. This work — checking your inventory, reviewing contracts, and keeping proper records — survives any outcome in Washington. Waiting is the most expensive posture you can take because the clock is already running.
2. What the Preemption Fight Actually Decides (and What It Doesn’t)
Here’s where the fight stands:
| Date | Event |
| July 2025 | Senate voted 99–1 to strip the federal moratorium on state AI regulation from the budget reconciliation bill |
| December 2025 | Congressional leaders released defense bill text without the moratorium |
| December 2025 | White House issued an executive order targeting state AI laws; a bipartisan 36-state letter opposed it |
But that’s just noise. Look at the substance. Even a successful federal push would only reach narrow, state-specific AI laws. It cannot reach the federal anti-discrimination laws that already exist. It cannot reach state civil rights acts updated to cover automated systems. It cannot reach the contract law governing your vendors. And it cannot change the fact that you are responsible for the tools you choose to use.
3. Where AI Actually Lives in Your HR Stack (Most SMBs Don’t Know)
The first reason “we don’t really use AI” is wrong: you almost certainly do, and you don’t know it. Resume parsing in your applicant tracking system (ATS) is AI. Video interview scoring is AI. Shift and scheduling tools that suggest assignments are AI. Productivity monitoring and keystroke analytics are AI. Performance management software that generates review language is AI.
And your managers are probably using their own AI accounts to help make hiring, promotion, or termination decisions. Just because you don’t know it’s happening doesn’t mean your company escapes liability.
New laws don’t just ask if you bought an AI product. They ask if a computer process influenced a major employment decision. California’s rules define this very broadly: if a program screens resumes, scores interviews, or suggests shifts that impact who gets promoted, it counts.
You can’t comply with what you can’t list. Walk your full stack — ATS, HRIS, payroll, performance, scheduling, monitoring, video interviewing, and every add-on module — and document where AI is making or shaping decisions about people. Most owners I do this with are surprised by what’s already there, and that surprise is the whole point of the exercise.
4. The State Map for Multi-State Employers
If your employees and applicants sit in more than one state, you don’t get to pick the easiest regime. You plan against the hardest one and roll the result across the company.
California, The Strictest Standard in the Room
Its automated decision system rules took effect October 1, 2025 under the Fair Employment and Housing Act. They apply if you have at least five employees with at least one in California. The recordkeeping clock is four years, and vendors used for recruitment, screening, hiring, or compensation are treated as employers themselves — which closes one of the favorite vendor liability shields cold.
Illinois, Strict Enforcement with a Private Right to Sue
The amended Civil Rights Act took effect January 1, 2026. It prohibits AI-driven hiring and promotion decisions that produce protected-class discrimination, requires notice when AI influences employment decisions, and mandates four years of recordkeeping covering the AI product name, the developer, decisions affected, and data categories used. Enforcement runs through the Illinois Department of Human Rights with civil penalties, attorneys’ fees, and a path to private litigation.
Connecticut, Durable Obligations, Coming Soon
The new AI law sets most rules for October 2026, with transparency requirements following in 2027. The key provision: using AI is no excuse for discrimination, and testing for bias doesn’t give you a get-out-of-jail-free card.
Texas, Employer-Friendly, But Don’t Build to It
The new AI law for Texas also takes effect January 1, 2026, but it requires proof that you intended to discriminate, a meaningful difference from the California standard. That friendlier bar doesn’t help you if you also operate in California. Building your plan to the lower Texas standard won’t protect you where the standard is higher.
Colorado, The Political Ceiling
Colorado recently rewrote its AI law and eliminated the requirement that companies disclose how the AI made the decision — the provision employers fought hardest. Treat it as the political ceiling for state AI laws right now: durable, narrower obligations survive; reach further than the industry will accept and the statute gets rolled back before it ever bites.
The Enforcement Reality
The real threat isn’t just the wording of a law, it’s who enforces it. New York City’s rules have gotten significant press and produced real results. At the federal level, the EEOC has pulled back on AI guidance, meaning the real action is happening in state capitals, not Washington.
5. The Vendor Trap: What Mobley v. Workday Changed About Your Contracts
The conversation with your software providers must change. In Mobley v. Workday, the court made clear that companies can’t escape liability by pointing to AI, opening the door to massive class-action suits involving millions of applicants.
Is your vendor contract protecting you? Probably not. A Stanford study found that most AI contracts shift almost all risk to the customer. Only 17% of vendors commit to following applicable law, and very few promise to cover your legal costs if their software causes a discrimination claim. Bloomberg Law reached the same conclusion: employers remain responsible for employment decisions even when informed by third-party technology, and contracts must address data use, audit rights, and accountability. Your standard SaaS contract almost certainly doesn’t.
Three clauses to add at your next renewal:
- A promise that the tool complies with local employment laws
- A requirement for the vendor to cooperate with bias audits
- A hold harmless agreement where they cover costs if their algorithm is found discriminatory
If they refuse all three, you know exactly how much they trust their own product. That answer is worth having before you’re in litigation.
6. Notice and Recordkeeping: Build to the Highest Bar Once
The architecture isn’t complicated. The trick is doing it once, at the right level, instead of building separate compliance stacks for separate states.
Candidate and employee notice
Match the strictest content requirement in your footprint and apply it to the whole workforce. Illinois sets a useful ceiling, your notice should name the AI tool and developer, describe which decisions it touches, list the data categories used, and explain the accommodation request process. Roll that into your application portal, offer letters, and employee handbook. You’re now satisfying Connecticut’s pre-decision disclosure requirement before it even kicks in.
Bias-audit cadence
Build to a 12-month audit cycle with documented methodology, results, and remediation steps. Retain underlying data for four years to match California and Illinois requirements. If your vendor won’t cooperate, audit the outputs yourself: run protected-class breakdowns of applicants screened, advanced, rejected, hired, and terminated against AI-touched decisions.
Decision-log discipline
For every consequential AI-touched employment decision, log what the AI recommended, who reviewed it, what the human decided, and why. This applies to every hire, no-hire, promotion, discipline, and termination. This is the document set that wins or loses a disparate impact case, and the first thing state AGs will request when they come looking.
You’re not building five compliance programs. You’re building one that covers all of them.
7. The 60-Day Plan: What to Actually Do Before the Next Renewal
| Weeks | Task | What It Means |
| 1–2 | Stack inventory | Walk every HR system and add-on. Document where AI makes or shapes decisions about people. Don’t trust the vendor checklist — verify what the software actually does. |
| 2–3 | Jurisdictional exposure map | List every state where you have employees, applicants, or remote workers. Map each AI use case to the highest-bar state in your footprint. That state sets your ceiling. |
| 3–5 | Contract review | Pull every software contract. Identify missing compliance promises and confirm whether the vendor will cover your defense costs if their tool triggers a claim. Build a must-have clause list for renewal. |
| 4–6 | Notice template rollout | Draft one notice that satisfies the strictest state. Push it into the application portal, offer letter pack, and employee handbook. |
| 5–7 | Recordkeeping protocol | Stand up the four-year retention rule, define the bias-audit cadence, and write the one-page decision log your managers will actually use. |
| 7–8 | Appoint an owner | “HR will handle it” isn’t a plan. Name one person who understands both the contracts and the technology and owns the program end-to-end. |
None of these steps protects you alone. Together, they convert “we have AI in our HR stack and no plan” into a defensible posture before any candidate, employee, regulator, or AG asks you to prove it.
8. Build the Plan Now, Not After the Lawsuit
The preemption fight will keep moving. The vendor contracts won’t renegotiate themselves. The recordkeeping clock has already started in California and started, or starts soon, in Illinois and Connecticut. The agent-liability doctrine has been live since Mobley v. Workday. None of that waits.
The companies that handle this well aren’t the ones with the biggest legal budgets. They’re the ones with somebody in the room who can read the statute and the SaaS contract in the same sitting.
If you’ve got AI in your HR stack (you do), multi-state exposure, and no plan for either, that’s exactly what I do as a fractional CHRO: a practical AI-in-HR inventory, vendor contract review with a clause punch list, bias-audit recordkeeping built to the highest-bar state, notice templates that work across your footprint, and a named owner so the program outlasts the engagement.
Most Owners Don’t Know What’s Already in Their Stack
That’s usually where we start. I work with multi-state employers as a fractional CHRO to build practical AI compliance programs, not theoretical ones. Stack inventory, vendor contract review, bias-audit recordkeeping, and notice templates that actually hold up across your footprint.
By the time we’re done, you’ll know exactly what AI is touching in your HR stack, where your vendor contracts are leaving you exposed, and what a defensible posture looks like before a candidate, employee, regulator, or AG asks you to prove it.
If that lines up with where you are, let’s talk. Get the plan built before someone else forces the timing. Contact me today.
FAQ
We’re a small business. Are we exempt? Probably not. California’s rules start at just five employees, and federal discrimination laws apply to small teams too. Size is not the shield most people assume.
Our vendor says they handle compliance. Is that enough? No. Marketing language is not a legal defense. You are the employer, and you are responsible for the decisions — even when they’re based on a vendor’s tool. Read your contract. The vendor likely disclaims the very things their sales team promised.
If Congress passes a preemption moratorium, doesn’t all of this go away? No. Even if preemption succeeds, it would only reach state-specific AI statutes. Title VII, the ADEA, the ADA, vendor-as-agent liability, and contract law would all remain untouched. Roughly 80% of your exposure is preemption-proof.
We don’t really use AI in HR. Why does this apply to us? Because you probably do and don’t know it. Resume parsing in your ATS, scheduling algorithms, video interview scoring, productivity monitors, and the generative AI features your HRIS and payroll vendors quietly enabled all count under these laws. California’s definition covers any computational process that makes or facilitates an employment decision. The inventory step in the 60-day plan exists because most owners I run it with are surprised by how much is already in their stack.
