Deferred, Not Deleted: The AI Hiring Rules Already Governing You

Two of the most-watched deadlines in employment AI moved this year, and both moves were reported as reprieves. In Europe, the Digital Omnibus deferred the AI Act's high-risk regime for Annex III systems (the bucket that covers recruitment, selection, and worker management) from August 2, 2026 to December 2, 2027, adopted and in force with days to spare before the original date. In Colorado, Governor Jared Polis signed S.B. 189 on May 14, 2026, pushing the state's AI law to January 1, 2027 and replacing the Colorado Artificial Intelligence Act with a considerably lighter Automated Decision-Making Technology Act.

Read together, those two headlines invite a comfortable conclusion: the AI compliance wave broke early, and there is time. That conclusion is wrong in a specific and expensive way. What got deferred in both jurisdictions was the assessment-and-documentation layer. What did not get deferred anywhere is the layer employers are most likely to be caught on, because it generates a paper trail with dates on it.

What Slipped Was the Audit Layer

Look closely at what Colorado actually removed. Per Littler's analysis of the amended statute, the new law strips out the obligation to report discriminatory outcomes to the attorney general, to conduct impact assessments, to implement risk-management policies and programs, and to conduct annual reviews of AI tools. Skadden's read is that the replacement "significantly narrows Colorado's anticipated AI governance scheme, shifting from the more substantive obligations of the CAIA and its focus on discrimination to a regime centered around transparency." The duty of care aimed at preventing algorithmic discrimination is simply gone.

Europe's deferral has the same shape. The high-risk obligations that slipped to December 2027 are the heavyweight ones: conformity assessment, risk management systems, technical documentation, human oversight design. What stayed on the original timetable were the transparency duties under Article 50: disclosure that a person is interacting with an AI system, marking of synthetic content, notice for emotion-recognition and biometric categorization. Those applied from August 2, 2026, with a three-month grace period carrying systems already on the market to December 2, 2026. And the reach is not limited to European companies: as Jones Walker's AI practice notes, the Act applies to providers placing AI systems on the Union market "regardless of where the provider is established."

What Landed on Time Is the Notice Layer

While the two marquee regimes were being softened, a quieter one took full effect. Illinois HB 3773 amended the Illinois Human Rights Act as of January 1, 2026, and the implementing rules are unusually prescriptive about notice. Current employees must receive notice annually, and again within 30 days of the employer adopting a new or substantially updated AI system. Applicants get notice through job postings. The notice itself has to name the AI product and its developer, identify the covered employment decisions, explain the system's purpose and the categories of data it processes, give a point of contact, and describe the right to request a reasonable accommodation, all in plain language, in the languages the workforce speaks, and accessible to employees with disabilities.

"The amendments include a broader prohibition on the use of AI–including generative AI–in hiring or promotion decisions that result in discrimination based on protected characteristics." – Kelechi Ajoku, Associate, Hinshaw & Culbertson

Illinois notably does not require a formal bias or impact assessment, as Ogletree Deakins noted when the bill passed. That is the pattern worth internalizing: the surviving obligations across every one of these regimes are disclosure obligations. Even Colorado's stripped-down law keeps pre-use notice, a plain-language explanation within 30 days of an adverse decision, and a path to human review. Employers who spent the last two years preparing for an audit-centric future prepared for the wrong thing.

Records Are the Part Nobody Deferred

The retention clocks are already running, and they are long. California's FEHA regulations on automated-decision systems took effect October 1, 2025 and doubled the personnel record retention period from two years to four, expressly including ADS data. Illinois requires four years of retention for notices, postings, and AI-related disclosures. Colorado's surviving regime requires three. None of those clocks was paused by anything that happened this year.

California adds two teeth worth noting. Liability extends to an employer's agents, meaning anyone "acting on behalf of an employer" to perform a function the employer traditionally performs, which reaches the vendors running the screening tool. And while bias testing is not mandated, the regulations make "evidence, or lack of evidence, of anti-bias testing or similar proactive efforts to avoid unlawful discrimination" relevant to an employer's defense. Testing is optional in the way a seatbelt is optional: nothing requires it until the moment it matters.

For HR and legal teams recalibrating after a year of moving deadlines, the practical work looks like this:

• Inventory every tool that touches an employment decision. Screening, ranking, scheduling, performance flags. You cannot issue an accurate notice about a system nobody has catalogued.
• Treat notice as the live compliance surface. Illinois annual and 30-day notices, Colorado pre-use and adverse-decision notices, and EU Article 50 disclosures are all in force or imminent, and all are easy for a plaintiff to date-stamp.
• Set retention to the longest clock, not the local one. Four years in California and Illinois should become the default across a multi-state employer; per-state retention rules are a filing error waiting to happen.
• Put vendor obligations in the contract now. California's agent liability means a vendor's screening logic is your exposure. Documentation, testing evidence, and audit rights belong in the renewal you sign this year.
• Keep the impact assessments you already built. Colorado stopped requiring them and the EU postponed them, but they remain the cheapest available evidence of a proactive effort, and December 2027 arrives on schedule.

The deferrals were real, and they bought genuine time on the most burdensome requirements. But they also created a dangerous mismatch between what employers think is coming and what already applies. The obligations that survived every rewrite are the ones that ask a simple question with a documented answer: did you tell the person, and can you prove when? That question does not need a high-risk classification to be embarrassing in a hearing.