On 24 July 2026 the Official Journal published Regulation (EU) 2026/1744, which pushed the AI Act's Annex III high-risk obligations from 2 August 2026 to 2 December 2027. In the same four months Colorado repealed and reenacted its AI statute, Connecticut passed one that starts on 1 October 2026, and Illinois withdrew the rules it had proposed eighteen days earlier.
If your compliance plan was built around 2 August 2026 and the EU, it is now pointed at the wrong date and the wrong continent.
Most pages in this market recite the EU AI Act and stop. Below is the actual set, each row with the instrument, the date it bites, the party it binds and the document it asks you to produce. Read it against the statutes before you spend money with anybody, including me.
| Jurisdiction | Instrument | Applies from | Binds | What it actually requires |
|---|---|---|---|---|
| New York City | Local Law 144 of 2021 NYC Admin. Code §§ 20‑870 – 20‑874 |
In force 5 July 2023 |
Employers and employment agencies using an AEDT for a New York City role. No size threshold. | An independent bias audit conducted no more than one year before use; a published summary of results on your website; notice to candidates at least ten business days before use. Still the only law anywhere that mandates a bias audit as such. |
| California | FEHA employment regulations 2 CCR § 11008.1 et seq. |
In force 1 Oct 2025 |
FEHA employers with five or more employees and their agents. A vendor performing a function the employer traditionally performed is itself an employer under § 11008(b). | Four-year retention of automated-decision-system data under § 11013(c). Anti-bias testing is not mandated; § 11009(f) makes evidence of such testing, or the lack of it, relevant to both claim and defence. In practice a sharper incentive than a mandate. |
| Illinois | HB 3773 / P.A. 103‑0804 775 ILCS 5/2‑102 |
In force 1 Jan 2026 |
Employers with one or more Illinois employees for twenty or more calendar weeks. Deployers only; no vendor duties. | Notice to applicants and employees where AI is used for covered decisions, and a civil rights violation to use zip codes as a proxy for a protected class. IDHR's notice rules were proposed 15 May 2026 and withdrawn 2 June 2026 with no revised timeline. The statutory duty applies regardless. |
| Illinois | AI Video Interview Act 820 ILCS 42 |
In force 1 Jan 2020 |
Employers using AI to analyse video interviews for Illinois positions. | Written consent plus an explanation of how the AI works and what characteristics it evaluates; destruction of the video and all copies within thirty days of request; where AI alone decides who advances to an in-person interview, an annual race and ethnicity report to the Department of Commerce and Economic Opportunity by 31 December. |
| New Jersey | N.J.A.C. 13:16 57 N.J.R. 12(2) |
In force 15 Dec 2025 |
Employers covered by the Law Against Discrimination. | No filing and no audit. It codifies three-step disparate-impact burden-shifting and expressly names AI and automated tools as a source of it, giving the example of a system trained to evaluate applicants by reference to the existing workforce. |
| Texas | HB 149 (TRAIGA) Tex. Bus. & Com. Code ch. 552 |
In force 1 Jan 2026 |
Developers and deployers promoting, advertising or doing business in Texas, or serving Texas residents. | No notice, audit, assessment or retention duty on private employers. § 552.056(b) turns on intent, and § 552.056(c) provides that disparate impact alone is not sufficient to show it. Substantial compliance with the NIST AI Risk Management Framework is an affirmative defence, which is the one place in the United States where governance documentation converts directly into a legal shield. |
| European Union | Reg. (EU) 2024/1689 art. 50 transparency |
In force 2 Aug 2026 |
Providers and deployers, including those outside the EU where the output is used in the EU. | Candidates interacting directly with the system must be told they are interacting with AI. Systems placed on the market before 2 August 2026 that generate synthetic content have until 2 December 2026 to meet the art. 50(2) machine-readable marking duty, under art. 111(4). |
| Connecticut | SB 5 / P.A. 26‑15 CART Act |
19 days 1 Oct 2026 then 1 Oct 2027 |
Developers and deployers of automated employment-related decision technology. No employee threshold identified. | From 1 October 2026: developers must give deployers the information they need to comply, or assume the disclosure obligations by contract; WARN filers must evaluate and report whether a reduction relates to AI or technological change. From 1 October 2027: written pre-decision notice naming the tool and the categories and sources of data it analyses. Use of an AEDT is expressly not a defence to a discrimination complaint. |
| Colorado | SB 26‑189 C.R.S. §§ 6‑1‑1701 – 6‑1‑1709 |
1 Jan 2027 signed 14 May 2026 |
Developers and deployers doing business in Colorado. No employee or revenue threshold at all. | A developer documentation package: intended uses, known harmful uses, categories of training data, known limitations, monitoring instructions, and notice of material updates. Three-year record retention by both parties. No bias audit and no impact assessment — the reasonable-care duty, risk-management programme and impact assessments were deleted with SB 24‑205, which never took effect. Attorney General rules at 4 CCR 904‑6 are still open; hearing 26 October 2026. |
| California | CPPA ADMT regulations 11 CCR §§ 7220 – 7222 |
1 Jan 2027 | Businesses over the CCPA thresholds using ADMT for a "significant decision", which expressly includes employment opportunities and compensation. | Pre-use notice; an opt-out right or, in the alternative, appeal to human review; an access right covering the logic of the system and how it generated the output. A risk assessment completed before processing begins, reviewed every three years, with executive written attestation. First submission to the CPPA is due 1 April 2028. |
| European Union | Reg. (EU) 2024/1689 ch. III ss. 1–3, as amended by Reg. (EU) 2026/1744 |
2 Dec 2027 was 2 Aug 2026 |
Providers of Annex III point 4 employment and recruitment systems. Annex I systems moved to 2 August 2028. | Arts. 9–15 and 16–22 in full: risk management, data governance, Annex IV technical documentation, logging, transparency to deployers, human oversight, accuracy, robustness and cybersecurity, conformity assessment under art. 43, CE marking. Deployer fundamental rights impact assessment under art. 27. The dates are fixed; the conditional trigger mechanism the Commission proposed was dropped. |
| California | SB 947 No Robo Bosses Act of 2026 |
Pending Governor has until 30 Sep 2026 |
Employers using an automated decision system for discipline or discharge. | Passed both houses 30–31 August 2026 and is not law today. If signed: no reliance on an ADS alone, human review and independent verification where it is the primary basis, written post-use notice, enforcement by the Labor Commissioner, Attorney General or local prosecutors. Proposed operative date 1 July 2027. Its predecessor, SB 7, was vetoed in October 2025. |
Federal position. The EEOC withdrew its 2022 and 2023 AI technical assistance, and its National Enforcement Plan for FY2025–FY2029, approved 4 June 2026, drops the previous plan's technology priority and commits the agency to eliminating disparate-impact theories in its investigations. Title VII, the ADEA and the ADA continue to apply to these tools, and disparate impact remains available to private plaintiffs and under state law. No federal statute preempts any row above. The Great American AI Act discussion draft of 4 June 2026 would expressly preserve state workplace AI laws; it has not been introduced.
Regulation (EU) 2026/1744 entered into force on 27 July 2026. Most commentary covered the headline date and stopped there. Four of its effects matter more to a company building hiring AI than the date itself.
Article 111(2) keys its grace period to "the date of application of Chapter III referred to in Article 113". Because that date moved, a non-public-authority Annex III system placed on the market or put into service before 2 December 2027 sits outside Chapter III sections 1 to 3 until it is subject to significant changes in its design. Two conditions on that. The Omnibus narrowed it, so the grace applies only where the type and model was already placed on the market. And if your deployer is a public authority, full compliance is required by 2 August 2030 regardless. Read together, the release schedule for your next major version is now partly a regulatory decision rather than only a product one.
A new Article 4a permits processing of special categories of personal data where strictly necessary for bias detection and correction, subject to cumulative safeguards. The most common reason hiring vendors give for not testing is that they do not hold race or gender data. That reason has changed status: the Act now supplies a basis for obtaining it for exactly this purpose, while California's § 11009(f) makes the absence of testing admissible against you and Texas makes documented testing an affirmative defence. Three instruments now point the same way.
Article 113(3)(c) defers Chapter III sections 1, 2 and 3. Article 6 sits in section 1 and is deferred with it. Article 49, on registration in the EU database, sits in section 5, which was not deferred, as do article 43 on conformity assessment, article 47 on the declaration of conformity and article 48 on CE marking. On the face of the text, registration applies from 2 August 2026 while the classification rules that would give it content do not. Covington and Freshfields both read article 49 as not deferred. There is no Commission guidance resolving it, and when I checked, the Commission's own AI Act Service Desk was still serving the unamended article 113. Anyone telling you this is settled has not read section 5.
Member State employment and works-council regimes, and the GDPR including article 22 on automated decision-making and the DPIA duty, run on their own timetables and were untouched. Annex III point 4(a), covering targeted job advertising, filtering applications and evaluating candidates, is textually unchanged, so the classification you would have reached in July still holds. What moved is when you must be able to evidence it. The Omnibus also added a simplified technical documentation route for SMEs at article 11(1), and now allows the article 27 impact assessment to cross-reference an existing DPIA rather than duplicate it. The work got slightly smaller and considerably later. It did not go away.
You can check every sentence above against Regulation (EU) 2026/1744 and the consolidated AI Act in about forty minutes. That is the point. A firm's regulatory reading is the only part of its competence you can verify before paying for it, so it is on the page rather than behind a form.
The three triggers I actually see, in the order they tend to arrive.
An enterprise prospect has sent a sixty-question AI governance questionnaire and the deal is sitting behind it.
The most common trigger and the most valuable to solve, because the return is a closed deal rather than an avoided penalty. It is also the one this market prices worst: platform vendors answer it with a subscription and a monitoring cadence, and audit firms answer it with a scoping call. What you need is a set of drafted positions you can lift into the questionnaire, each tied to the evidence it rests on, with the weak answers flagged privately to you before the buyer finds them.
Your customer's obligation is not discharged by your audit, and they have worked that out.
Local Law 144 binds the employer and the employment agency, not the tool vendor. The Colorado and Connecticut notice duties fall on the deployer. California's four-year retention duty is the employer's. A vendor-side audit satisfies none of them. But a vendor whose documentation lets its customers discharge their own duties wins procurement against one that leaves them to commission a second audit. The question is not whether you are covered. It is whether you are useful.
The vendor-side liability theories are being tested right now.
In Mobley v. Workday (N.D. Cal.) the court held on 22 June 2026 that FEHA may reach a California-based vendor even for hiring outside California. In Kistler v. Eightfold AI (N.D. Cal.), argued 4 August 2026 with a ruling pending, the theory is that an AI hiring vendor is an unregistered consumer reporting agency under the FCRA. Against that, the enforcement picture is quiet: the New York State Comptroller's audit of Local Law 144 enforcement, issued 2 December 2025, found the Department of Consumer and Worker Protection had received two complaints in two years, and that on reviewing 32 companies it identified one compliance issue where the Comptroller's own auditors found at least seventeen instances of potential non-compliance.
Report 2024‑N‑6, Office of the New York State Comptroller. I cite the enforcement gap rather than hide it. It is also precisely the finding that gets quoted when enforcement changes, and it came with recommendations that DCWP move from complaint-driven to proactive review.Of roughly twenty-five firms selling into this market, two publish a price. Everything below is delivered as documents. Nothing to install, no access to your production systems, no data pipeline, no integration work by your engineers, and no procurement cycle.
For the company that does not yet know which of the twelve instruments in §1 reach it. Most of the value in this field sits in the scoping, and the scoping should be cheap.
The main engagement. A point-in-time position on where you stand against every regime that reaches you, and the documents you need to be able to show for it. Priced below the published flat rate for a single-tool bias audit, because it is a different and earlier piece of work.
A review is a snapshot, and this field does not hold still. Three of the instruments in §1 changed in the last four months: Colorado's statute was repealed and reenacted, the EU timeline moved by sixteen months, and Illinois withdrew its rules eighteen days after proposing them.
Published so you can judge whether this is the sequence you would want applied to your product, and so a technical founder can decide before the first call whether there is anything here they do not already know.
Is the system within Annex III point 4(a)?
Does it place targeted job advertisements, filter or sift applications, or evaluate candidates? Any one of the three and it is prima facie high-risk. This is the classification the July amendment did not change.
Does article 6(3) take it back out?
Is the function narrowly procedural, does it only improve the result of a previously completed human activity, or is it preparatory to the assessment? If so the system may sit outside. But article 6(3) does not save a system that performs profiling of natural persons, you must document the assessment under article 6(4), and on the better reading you must still register it. The Commission proposed deleting that registration duty in the Omnibus; the co-legislators reinstated it.
Is the vendor itself an employer in California?
Does it perform a function the employer has traditionally performed, such as recruitment, screening, hiring, promotion or pay? If so it is an employer under 2 CCR § 11008(b), and § 11008(h) expressly includes within "employment agency" persons providing those services through an automated-decision system. This is the test Mobley gave teeth to.
Does the technology substantially influence a Connecticut employment decision?
Scheduling, workplace-safety monitoring, productivity tracking and purely descriptive or diagnostic output sit outside the CART Act's definition. Prediction or recommendation that substantially influences hiring, promotion, discipline, discharge, renewal, training selection, tenure or terms of employment sits inside it.
Does it materially influence a Colorado consequential decision?
Unresolved, and I say so rather than guess. The Attorney General is weighing a low-threshold presumption rebuttable by documented independent human judgment against a higher test turning on substantially larger independent factors, and is separately considering whether developers must disclose the testing performed, the methodology and the results, which would reintroduce a testing artefact by rule. Hearing 26 October 2026 on 4 CCR 904‑6. Anything built now should be built to survive the stricter reading.
Does the tool substantially assist or replace discretionary decision-making for a role in New York City?
If so, Local Law 144 applies, to the employer and the employment agency rather than to the vendor. The follow-on question is the commercially important one: does your documentation let your customer discharge its own duty, or does it leave them to commission a second audit at their own cost?
What is the evidence, and where is it?
Every finding resolves to a document that exists, one that partly exists, or one that does not. That is the whole output. A finding that cannot be closed by producing or correcting a specific artefact is an opinion, and an opinion is not what a regulator or an enterprise procurement team is asking you for.
The most expensive mistake in this field is buying the wrong instrument. If one of the following is what your buyer or your regulator actually wants, this engagement is the wrong purchase, and you should hear that on the first call rather than in the third week.
Local Law 144 requires an independent bias audit computing selection or scoring rates and impact ratios from your data across EEO‑1 categories and their intersections, signed by the auditor. That is statistical work with a statutory definition. Published flat rates for a single tool currently run around $5,500 to $6,500, with turnaround from five business days to four weeks. Pay them. What this review does is tell you whether you need one, what it must cover, and whether your data can support it, before you commission it.
Only a certification body accredited by ANAB, UKAS or an equivalent body can issue that certificate, and an accredited body cannot both consult on and certify the same client. Pre-certification gap analysis is commonly quoted at $5,000 to $15,000 and implementation consulting well above it. If a customer is asking for the certificate, this review is the step that tells you the size of the gap and what certification will actually cost. It is not a substitute for it.
Conformity assessment under article 43 and CE marking are formal acts with defined actors. Sector trust marks with a public directory behind them belong to the scheme that operates them, and a buyer asking for the mark wants the mark. None of these is issuable by an advisory practice, and any advisory practice implying otherwise is worth walking away from.
There are firms that put underwriting capital behind an AI assessment. If what you need is risk transfer rather than a defensible position, that is a different market and a different product, and I will point you at it.
This is regulatory and assurance advisory work. It does not create a lawyer-client relationship, it is not privileged, and it is not a substitute for counsel admitted in your jurisdiction. Where a question turns on litigation exposure or needs privilege, it belongs with your lawyers, and the review is built to be handed to them.
A readiness review is a close reading of instruments against a product. The question it turns on is always the same one. When may an automated system lawfully take part in a decision about a person. What has to be written down before it does. Who remains accountable when it is wrong. And what a reviewing body will actually accept as evidence that any of it was done.
The rest is currency, which is most of the job. It means reading the AI Act as amended, twelve United States instruments and the rules made under them in their present form; tracking amendments as they land rather than as they are summarised; and knowing what a regulator and an enterprise procurement team will each accept as evidence. In the last four months that has meant catching that Colorado's operative statute was repealed and reenacted, that the EU timeline moved by sixteen months, that Illinois withdrew its notice rules eighteen days after proposing them, and that the Commission's own guidance page was still publishing superseded text.
Credentials and prior work are set out on the first call and in the engagement letter. Until then, what is checkable is the reading itself. Sections 1, 2 and 5 are on this page in full, with citations, so it can be tested against the instruments before you spend anything.
Article 49 registration timing. Whether registration and the article 6(3) filing apply from 2 August 2026 or only from 2 December 2027 is genuinely unsettled, for the structural reason at §2.3. No Commission guidance resolves it.
Colorado "materially influence". Undefined until 4 CCR 904‑6 is finalised. Hearing 26 October 2026.
Illinois notice rules. Withdrawn 2 June 2026 with no revised timeline published. The statutory duty is unaffected by the withdrawal.
California SB 947. Passed both houses; not law. The Governor's deadline is 30 September 2026, and the enrolled text differs from the version introduced in February.
Colorado litigation. The disposition of X.AI LLC v. Weiser following the repeal of SB 24‑205 is not on any public record I could reach.
Federal preemption process. Whether Commerce published the Executive Order 14365 evaluation of conflicting state laws, and whether the FTC and FCC steps were taken, is not confirmed by any source I found after April 2026. Figures circulating about a published list of affected states are unsubstantiated and I do not repeat them.
A redacted Readiness Review for a Series B conversational screening platform. Eleven findings with severities and the provision each sits under, the component classification table, role determination for five jurisdictions, the obligation calendar dated to 2 December 2027, questionnaire readiness, and the ninety-day roadmap. It also carries a section headed what this engagement delivered, and what it did not, which is the part worth reading before you commission anything from anyone.
It is the actual format at the actual level of detail, not a brochure describing one. No form and no email gate.
That is enough to tell you, the same day, whether any of this reaches you, which of the three engagements fits, and whether you should be buying something else instead. No call is needed to get that answer, and there is no form on this page.
advisory@aequivra.com