19 states now regulate AI in HR. Does your team know that?

Andy Maren — April 14, 2026

There's a number in the SHRM 2026 State of AI in HR report that stopped me cold.

As of February 2026, 19 of the most populous states in the US have enacted AI laws or regulations that apply specifically to employer or employment AI usage.

And 57% of HR professionals working in those states are not aware of those policies.

Read that again. More than half of the HR professionals directly affected by state-level AI employment law don't know the laws exist.

I'm not writing this to make anyone feel bad. I'm writing it because I think it's a genuine organizational risk that's hiding in plain sight — and because "we didn't know" is not going to be a defensible position for much longer.

What these laws actually cover

AI regulation in employment isn't one thing — it varies significantly by state, and the scope is broader than most people assume.

The categories showing up most frequently:

Automated decision-making in hiring. Several states now require that applicants be notified when AI or automated tools are used in screening or selection processes. Some require that a human review be available. Illinois was an early mover here with its AI Video Interview Act; other states have followed with broader requirements.

Bias auditing. New York City's Local Law 144 — which has been in effect since 2023 and influenced state-level legislation — requires employers using AI hiring tools to conduct annual bias audits and publish summary results. Similar requirements are appearing in state legislation.

Transparency and explainability. Some regulations require that employees or candidates be able to request an explanation of how an AI system reached a decision affecting them — particularly for hiring, promotion, or termination decisions.

Data governance. Several states are extending existing data privacy frameworks specifically to cover employee data processed by AI systems, with requirements around consent, retention, and security controls.

The important thing to understand is that these aren't future requirements. They are current law in a growing number of jurisdictions. And unlike GDPR, which many organizations spent years preparing for, these state-level AI employment laws are arriving faster and with less runway.

Why payroll deserves special attention here

I want to flag something that the general conversation about AI employment law tends to underemphasize: payroll is a particularly high-risk area.

Payroll systems are increasingly incorporating AI-driven features — anomaly detection, predictive spend forecasting, NLP-based query interfaces, automated reconciliation. Many of these features are being added by vendors as default capabilities, which means organizations may be running AI on pay data without fully realizing it or having evaluated the governance implications.

Payroll data is also some of the most sensitive employee data an organization holds. Salary, bonus, tax withholding, banking details, garnishments, leave balances — the dataset is rich and the harm from misuse or misconfiguration is immediate and concrete.

If your state is among the 19 that have enacted AI employment law, your payroll AI features are not exempt.

What I'd actually do right now

If you're an HR leader trying to figure out where to start, here's a practical sequence:

Step 1: Find out where you operate. List the states where you have employees. Cross-reference against the states that have enacted AI employment law. SHRM and the National Conference of State Legislatures both maintain updated trackers.

Step 2: Inventory your AI touchpoints. Document every place in your HR and payroll workflow where AI is involved — including vendor-supplied features you may have enabled without a formal evaluation. This is harder than it sounds and usually takes a few conversations with IT.

Step 3: Ask your vendors the right questions. For each AI-enabled feature in your HCM or payroll system, you should be able to answer: What data does this tool use? Does it make or influence decisions that affect individual employees? Is it documented and auditable? Your vendor should be able to provide answers.

Step 4: Update your policies and notices. Most employment AI regulations include a notice requirement — employees or candidates must be informed when AI is used in consequential decisions. If your offer letters, job postings, or employee handbooks haven't been updated to reflect this, that's a gap worth closing.

Step 5: Put someone in the room. Governance doesn't happen by accident. Someone in HR or Legal needs to own the AI compliance question and have a standing seat at the table when technology decisions are made. If that person doesn't exist yet, this is the year to create the role.

I want to be clear: none of this requires a legal team on retainer or a six-month compliance project. It requires knowing what the law says in the states where you operate, knowing what technology you're running, and asking the questions that most HR teams haven't gotten around to yet.

The organizations that will handle this well aren't the ones with the most sophisticated AI strategy. They're the ones where HR leadership is informed, engaged, and asking the right questions before the auditor does.

Update your curiosity.

— Andy

Andy Maren is the founder of Trailhouse Solutions, an advisory firm for HR and payroll leaders navigating the shift to agentic AI and modern HR technology. She writes about what's actually happening in the market — without the keynote optimism.