Is it legal to use AI in interviews? A 2026 guide by jurisdiction

The rules at a glance

United States: one city and three states

New York City

Local Law 144 covers automated employment decision tools: software that issues a score, classification or recommendation used to substantially assist or replace hiring or promotion decisions. Before using one on NYC candidates, an employer needs an independent bias audit from the past year, a public summary of it, and a notice to candidates at least 10 business days ahead (DCWP). Fines run up to $500 for a first violation and $500 to $1,500 for each later one, and each day of use counts separately. A December 2025 audit by the New York State Comptroller found enforcement "ineffective" (DLA Piper).

Illinois

The Artificial Intelligence Video Interview Act has applied since 1 January 2020 to employers that use AI to analyze recorded video interviews for Illinois-based positions. Before the interview, you must tell the applicant that AI may be used, explain how it works and what general characteristics it evaluates, and get consent. You may share the video only with people whose expertise or technology is needed, and you must destroy it within 30 days of the applicant's request. An employer that relies solely on AI analysis to decide who gets an in-person interview must report demographic data to the state (DCEO).

HB 3773 amended the Illinois Human Rights Act from 1 January 2026. It is now a civil rights violation to use AI that has the effect of discriminating on the basis of protected classes in recruitment, hiring, promotion and other employment decisions, or to use zip codes as a proxy for protected classes. Employers must also give notice when they use AI for these decisions. The state proposed notice rules in May 2026 and postponed them in June (Ogletree), so the duty is in force without detailed rules on timing or method.

Colorado

SB 26-189, signed on 14 May 2026, repealed and replaced the 2024 Colorado AI Act. From 1 January 2027, organizations that use automated decision-making technology to materially influence consequential decisions, employment included, must give clear notice, explain an adverse outcome in plain language, let people correct inaccurate data, offer meaningful human review where commercially reasonable, and keep records for three years. The Attorney General enforces it, and it creates no new private right of action.

California

Since 1 October 2025, Civil Rights Council regulations under the Fair Employment and Housing Act have made clear that an automated-decision system can violate anti-discrimination law. Employers must keep automated-decision data for at least four years, and evidence of anti-bias testing, or its absence, is relevant to a claim.

Separately, the state privacy agency's rules on automated decision-making technology apply from 1 January 2027 to businesses covered by California's privacy law. An employer using it for hiring must give a pre-use notice, answer access requests and run a risk assessment. Candidates can opt out, though an employer may refuse an opt-out for hiring decisions if the technology works as intended and does not discriminate.

European Union: one ban in force, more duties to come

The AI Act has banned AI that infers people's emotions in the workplace since 2 February 2025 (Article 5), except for medical or safety reasons. The Commission's guidelines extend that to job candidates (Lewis Silkin). Since 2 August 2026, Article 50 has required AI systems that talk with people to be designed so that people know they are dealing with an AI.

Annex III lists recruitment AI as "high-risk", subject to narrow exceptions. The employer duties that follow, such as human oversight, log-keeping and informing workers, apply from 2 December 2027 after the Digital Omnibus (Hunton). GDPR Article 22 already limits decisions based solely on automated processing. Our EU AI Act explainer has the full timeline.

United Kingdom: automated decisions, with safeguards

In the UK, the main rules come from data protection law. Since 5 February 2026, the Data (Use and Access) Act 2025 has replaced UK GDPR Article 22 with Articles 22A to 22D (Bratby Law). Solely automated decisions with significant effects are allowed in more cases, but only with safeguards: telling people about the decision, letting them make representations and challenge it, and letting them obtain human intervention (GOV.UK). Special category data stays more restricted.

The regulator is watching recruitment. A 2024 ICO audit of AI recruitment tools found some let recruiters filter out candidates with certain protected characteristics, or inferred gender and ethnicity from names. Its follow-up, Recruitment rewired, says many employers are likely relying on solely automated decisions without meaningful human involvement, and must improve transparency and apply human involvement consistently to all candidates in a hiring stage.

India: a data law that reaches every candidate

India's Digital Personal Data Protection Act 2023 is a data protection law, not an AI law, but it reaches every résumé and interview recording. The DPDP Rules 2025, notified in November 2025, phase duties in. Consent managers register from 13 November 2026, and most obligations, including notice, breach reporting and erasure, apply from 13 May 2027 (Hogan Lovells). Penalties reach ₹250 crore (PIB). Whether the Act's employment exemption covers candidates is unsettled; our DPDP explainer sets out the text.

A checklist that works across all of them

1. Inventory your tools. For each one, note what it outputs (a transcript, a summary, a score, a ranking), who sees it, and where your candidates live.
2. Disclose before use. Tell candidates in plain words, before the interview, that AI is involved, what it does and what it assesses. NYC needs 10 business days; Illinois needs it before a video interview; the EU needs it by the first interaction at the latest.
3. Get consent where required. Illinois requires it for AI analysis of video interviews. In India, consent is the safe basis for anything beyond the application.
4. Offer a human alternative. NYC's notice must let candidates request an alternative process, and Colorado and the UK give rights to human review or intervention. Gartner advises letting candidates opt out of AI interviews, and in a Greenhouse survey 46% of US job seekers wanted a human option.
5. Keep a person accountable for the decision. Give reviewers the competence, training and authority the EU AI Act asks of human oversight, and apply review consistently to every candidate, as the ICO expects.
6. Keep records. California expects four years for automated-decision data, Colorado three years of records, and the EU at least six months of system logs from December 2027.
7. Audit for bias where the law requires it, and monitor everywhere else. NYC needs an annual independent audit; California treats anti-bias testing as relevant evidence.
8. Collect less, and delete on time. Take only the data the role needs, set retention periods, and honor deletion requests. Illinois sets 30 days for video interviews.
9. Do vendor due diligence. Ask for bias audit summaries, a plain description of what the tool outputs, confirmation that it does not infer emotions, a data processing agreement and a subprocessor list.

A vendor can support each of these duties; none can take one over for you. Itya is a structured interview platform: one rubric per job, consent capture before recording, transcripts and scorecards that cite the moment behind each rating, and a DPA and subprocessor list on our trust page. Features like these can help you meet specific duties, such as notice, consent records and record-keeping. Which duties apply depends on where you hire and how you use any tool's output.