Governance Brief: New AI Laws for HR
In this 30‑minute livestream, Margaret Spence, founder of the Inclusion Learning Lab, warns HR leaders that AI tools used across the talent lifecycle now pose significant legal liability. She frames four critical questions about unconscious liability, vendor shields, governance, and the risk of an AI‑driven lawsuit (citing Mobley v. Workday). Spence explains that most employment‑practice liability insurance policies now exclude AI‑related claims, shifting risk squarely onto HR. She then walks through the emerging state and local AI statutes that directly affect hiring, promotion, performance, benefits, and employee monitoring: California’s AI Transparency Act and ADMT/CCPA rules, Connecticut’s AI governance framework (mirroring the EU AI Act), Colorado’s comprehensive AI law modeled on the EU regime, Illinois’ AI Disclosure Law amending the Human Rights Act, New York City’s Local Law 144 requiring annual bias audits, and Texas’s lighter disclosure approach. She highlights the practical implications—mandatory risk assessments, pre‑use notices, opt‑out rights, bias‑audit disclosures, and documentation of data sources and human review. Spence urges HR teams to inventory every AI tool, conduct risk assessments, create policies, train all employees on AI governance, and act within a 90‑day “governance window.” She promotes an online state‑law tracker, an on‑demand AI Readiness course, and her new book When AI Breaks the Law as resources for building a compliant AI governance program.
Chapters
Okay. All right, let me share my screen and then we will get started. Okay, so welcome to the livestream and the AI Governance program that we're doing today. It's a 30-minute quick brief, not a long program, just a short, to-the-point program on the new laws that are affecting HR. So there's 4 critical questions that I want everyone to think through right now. The first one is unconscious liability. Is your HR team using AI without realizing it's already become a legal liability? Is that happening in your organization? If AI makes a hiring mistake tomorrow, can your HR team explain it, defend it, and survive the fallout? Think about the Mobley v. Workday case. If that occurred in your organization, what would happen? When you think about vendor shield, and oftentimes we think the vendor contract is going to protect us. And so the bold question I wanna ask you is, are you actively governing AI inside of HR or talent development or any of the other spaces in the talent cycle, or are we just blindly hoping our vendor is doing it for you? And the ultimate exposure, the big exposure, the one that we have to totally think through is what happens when the very tool you rely on, the one that you use every day to scale hiring, to scale performance, to do all the things that you want to do with that tool, becomes a direct reason your organization gets sued. What would happen if your organization got sued tomorrow because of an AI tool that you are using inside of the talent stack? And many of us think, oh, it's just, um, the hiring tool, the ATS, the application process. I'm talking about everything. The tools that help you decide who is a high performer, the one that you use for scoring, maybe even the AI tool you're using to do surveys. Or if you are in benefits, the AI tool you've given to an employee like the Talkspace app and saying, here's a tool you can use for therapy and it's driven by AI and you never bothered to read the disclosure about the data going into that tool? These are some of the big questions that we have to address in HR. Now, everybody said to us, every person said to us, AI is going to be efficient. It's gonna make our jobs easier. It's gonna do exactly XYZ. Instead, what it's doing is giving us more work, more potential to litigation, more liability, and more exposure. So today, in the 30 minutes we have together, I want to go through the AI laws that are affecting HR specifically and what you need to watch out for. And in the end, I'm going to show you a tracker that we created on our website that allows you to track the various laws that are in the pipeline right now from— that will affect HR. So this is our governance brief: New AI in HR Laws: Navigating the State-by-State Compliance Blueprint and the Shifting Landscape of Algorithmic Liability in Workplace Tech. So here's what I know for sure. Many of you might think that you have insurance coverage that will cover you if something happens with the software inside of your organization. I'm here to tell you that most of the employment practices liability policies now have exclusion for AI-related litigation. So you may very well be standing on your own. The issue for us in HR is we can no longer sit back and say IT covers governance. The biggest exposure to an organization right now is not in IT. The biggest AI liability exposure is in HR and the tech stack that we create for our leaders and our direct reports inside of the HR talent cycle. It is not in what we think, which is cyber. Your IT department can cover cyber. Your IT department can prevent a bot from coming in and, you know, disrupting your whole organization. What IT cannot prevent is your AI hiring tool going rogue and creating a discrimination claim, an age-related claim, or your performance software going out and saying every woman over— between age 25 and 45 shouldn't be eligible for promotion because they're in childbearing age. And you not knowing that that is an issue. You're not knowing that that is an issue because there's no way for you to know unless you built that AI, what it is actually doing in the background, what data it is using, how it is using it, and what it is producing. So as much as we wanna say that the AI vendor told us everything was okay, the reality, it's not. And for those of you who are joining me for the first time, my name is Margaret Spence, and I am the founder of the Inclusion Learning Lab. And we, and I also write extensively on AI governance on Substack at AI Governance for HR. What I have done, and just to give you just a tiny blueprint before we go get deeper into the laws itself, I have a unique background that is very different from most HR leaders. I started my career in risk management and then in workers' compensation litigation, and then I moved to HR quite by accident, and then I've done talent development and inclusivity work. So when AI came onto the board, I said to myself, wait a minute, who's doing governance? Governance is something that we do inside of risk management every day in every organization. We as risk managers don't need to go out and certify in AI. We need to just understand what the risk is and, and how things can happen and how litigation derives from that risk. So that's the experience that I'm giving you today. So this is where we are. The laws have changed. There are lots of federal rulings out there that will affect how we govern AI in HR. Insurance is gone. The Employment Practices Liability carriers are introducing absolute exclusion for automated systems. The 9:00 AM phone call will come from your general counsel. Based on state legislation. So today we're gonna go through a couple of the states at a high level, and I'm gonna break them down for you one by one. There's California, Colorado, Connecticut, Illinois, New York, and Texas. Texas we're not gonna touch on too much because Texas, um, didn't create a law that directly affects HR, but I think it's worth us talking through. So let's talk about California. And I've— the information I have on the screen is actually from our online tracker and how we track the laws by state. California's AI Transparency Act has gone into effect. It went into effect on August 2nd. It covers generative AI providers. We must offer AI detection tools and support disclosure Watermarks metadata for AI-generated images, audio, and video. So the question is, if we're using AI-driven audio, for example, we're using one of the learning and development softwares that we use for developing content, right? Let's say we're using that and we didn't disclose to our employees that we're using that particular thing? Do we now have to disclose? These are questions that you need to start asking your general counsel. I'm not going to answer these from a legal standpoint because I am not an attorney. I'm a risk manager and HR leader. But the question that we have to ask is, if we are using audio transcript, video transcript in recruiting, candidate vetting, employee relations investigation, internal communications, and training content. What do we need to do if we are operating in California? We have employees in California. What do we need to do to comply? If you wanna put in the chat, how many of you were already aware that California had an AI Transparency Act, SB 942? How many of you were already aware that this law was in place? It's, it's fairly new, but leading up to it, there is all kinds of rules that go behind this California AI Transparency Act. The next one is California ADMT regulation, which is the CCPA. And so really what I want you to do is take note of these. Okay, again, I'm not giving you legal advice. I'm not telling you how to implement these in your organization. What I am saying to you is these exist and you need to know how they impact HR. And it's up to us as HR leaders to do the diligence and the due diligence with our teams and our legal counsel to make sure that we are in compliance. Employers using automated decision-making technology for, for significant employment decisions without meaningful human involvement must complete a risk assessment, provide pre-use notice, and honor opt-out and assess rights. This law will go into effect January 1, 2027. The functions affected by the California law is hiring, work assignments, compensation, promotion, demotion, and termination. And I would argue even, um, health insurance if you're giving someone an automated app. Who would be covered by this in January? Job applicants, employees, independent contractors subject to ADMT if you're using a decision-making technology to hire, terminate, or retain them in your workforce. Okay, let's keep going. Connecticut. This one I think surprised everyone. Connecticut quietly put in an AI governance law that mimics the EU AI Act, and we'll talk about the EU AI Act at the very end of this for those of you who are global. The Connecticut framework combines employment transparency with a broader AI and privacy disclosure obligation. Connecticut is important because it connects AI directly to employment discrimination and transparency. If automated employment-related decision technology is used, the employer has notice and disclosure obligations. And the state is also adding privacy notice requirements when personal data is used to train large language models. That makes Connecticut both employment law and data governance, an employment law and data governance state. So it gives Connecticut a dual purpose, right? It's not just about filing layoff notices, it's how is AI being used in the employment process. So let me give you an example, and the example would be the Mobley v. Workday case where the applicant applied. He— AI was used to instantly reject him and his data was gathered. In Connecticut, you would have had to notify that applicant that you're using the AI, how it's being used, what it's supposed to do. So here's the best practice, and this is what I just want to get right to best practice. None of us need to be a lawyer to understand exposure. What we have to do is be able to go to the law and say, oh wait, I have employees in Connecticut, I'm covered by Connecticut, I need to know what I should be doing. And we have created an HR-driven AI governance program designed to help you implement across all states. Illinois. Next up is Illinois. Illinois is another state where they have created a few different things for you to think about, right? Illinois has major AI legislation. They actually have two. And this one, the Illinois AI Disclosure Law, goes into effect January 1st. 2027. It amends the Illinois Human Rights Act to prohibit, to prohibit AI use in ways that can be discriminatory. It affects full employment lifecycle. It bars using AI as a proxy for protected class. So for example, if your AI is using zip codes as a way of identifying people or colleges that they've gone to, or if it's using identifier data that you don't know about, This is a time for you to reach out to your vendor and say, tell me the how the data is being used inside of the AI, what information is being tracked, and how do I know that this is okay? So the Illinois law will affect recruitment, hiring, promotion, renewal of employment, selection, training for apprenticeship, discharge, discipline, tenure, terms, privilege, conditions of employment, everything. It says job applicants, employees across every protected class, um, and even conviction and arrest records and work authorization status, right? This one goes into effect January 1st. So we have time to comply with these. We have time to ask the questions from our vendors. That are— that we are using for AI in HR, all vendors must be required to disclose how the AI is being trained. What information is it gathering? How is it storing? How are you navigating it? Is it using any of the triggers to violate protected class status? So this is Illinois. The next one is New York City, not New York State, but New York City. And here's my pet peeve, and I'm gonna give all of you my pet peeve about AI governance right now. And this is a huge pet peeve because we will not come up with a national law across every state that is similar to the EU AI Act. We are going to have this patchwork of compliance. This patchwork of every city, every state, every municipal government putting in a law that governs AI. In New York, there is Local Law 144 that talks about automated employment. Employers and employment agencies using an automated employment decision tool to screen candidates, evaluate employees for promotion, must have independent bias audit every year, and they must publish the result and notify candidates in advance. It is not our job to do a bias audit. It is the vendor's job to give you the bias audit. This is also the same bias audit that is required under the European Union AI Act, the EU AI Act. I think it should be something that we ask for as a best practice across every single item we have in our tech stack. So what is the best practice? First off, we need to know where every AI tool is in our organization. Many of you are making rules and they are quite draconian. Do not use AI for this. Don't put this in, don't put that in, don't put that in. But you have no idea where AI is being used inside of the hiring or the HR process. You do not know if a leader is picking up his cell phone and typing in, "How do I write Margaret up? This is what she's done, and this is the thing she's done, and this is what she's done. Give me the proper language to write her up." Those are the things that we need to be governing. Those are the things that we need to be training against. Because what I foresee happening in 2027 is all of the lawyers that sue us under workplace litigation are gonna say, "Oh, you fell down at work? You have a workplace injury? Did you— maybe you have an AI discrimination case at the same time." And so they will then say, "Oh, let's do a subpoena for your manager's phone to see if he used Gemini, which is included in his phone plan." And you as the HR leader will have no idea about that. So what do we need to do? We need to create policies and practices that are not written down, but scenario-based training for our leaders and our frontline employees. The policies you're writing means nothing because people are bypassing them. If you say, I can't use ChatGPT, I only have to use Copilot, somebody has ChatGPT on their cell phone. Or their iPad or their non-sanctioned device, and they will use it because you have restricted them without giving them the appropriate guardrails, which is training them on AI governance. Every single employee needs to be trained on AI governance. Let's keep going. New York has a RISE Act, which is a larger frontier AI model. It's for developers. You must publish safety frameworks, report critical safety incidents. For example, ChatGPT reported that they had a model that found its way out of a container and went out on the internet and hacked a company, and the company couldn't stop the hacking. So they went to China and got an open-source AI model to come into their environment to stop the hacking. Okay, HR leaders, imagine if one of the AI tools that you are using went rogue in your organization and sent out 100 job offers to people, and you now have 100 candidates that you have to tell, oh, our AI made a mistake. These laws that are being written about how vendors interact with us are there for our own protection, and we should absolutely want these laws on the books because we cannot say the vendor has our back. Here's what happens in most vendor contracts. Most vendor contracts has a cap on liability. Maybe they will say will cover your liability to 3 times the amount of money you paid for this software. So what happens if you get a $100 million judgment because the software went rogue? The Mobley v. Workday case has proven to us that AI itself and the AI vendor does not, um, eliminate your requirements. They are your agent. They stand in your place, but they do not shield you from liability. They do not shield you from liability. So I've gone through all of this. We have a few minutes left. Any questions on what I covered? Any questions on the laws that I covered? I wanna talk a little bit before I keep going about Texas. And about the EU AI Act. I've written a new book called When AI Breaks the Law: AI Governance for Talent Leaders. It goes live on Amazon and it's up for sale on August 19th. I'd love for you to pick it up, but that's not why I'm doing this. There's a part of the process. There isn't a book written right now for AI governance for HR. We do not have a blueprint that we are using. Which is why I went out and studied and put this together for us in HR. So let's talk a little bit about Texas for one second. Texas. Texas is one of the 5 AI laws that take effect before 2027. 3 of these AI laws have already gone into place. For Texas, Texas took a different approach from everyone else. Texas basically said, we are not going to govern employment, but we are going to cover, um, some disclosures. They don't have an employment transparency like Colorado or Illinois. And I didn't talk about Colorado. Colorado has a new law also that goes into effect, and Colorado is gauging their law off of the European Union AI Act. They're basically mimicking the— the Colorado— Colorado's mimicking the EU AI Act. The Colorado Act is one of the most comprehensive state laws that applies when AI is used in consequential decisions, including employment. Colorado is the state most clearly saying if AI maturely influences an employment decision, the employer has duties. These duties include risk management, impact assessment, notices, explanations, and reporting if the algorithm— if algorithm discrimination is discovered. For HR, that means hiring, promotion, discipline, termination, and the tools are no longer treated as if they are in a black box. Your vendor can no longer say to you, you cannot get the information about this tool. Many employers have employees in Colorado, and as the Colorado law comes online, it will be the standard by which other states begin to apply the AI laws that will affect HR. The right now, the most comprehensive law is in Colorado. It, it talks about high-risk AI. It talks about even reasonable care that we have to impact, and it has some decisive trade practices, and it also has civil penalties for violating the law. While Texas did not take that track, Texas basically tried to govern the development of AI systems. They didn't really deep dive into HR and how it's used in employment, but that doesn't mean that someone living in Texas cannot file suit against you. I want everybody to understand that the Mobley v. Workday case is what prompted me to say the new discrimination is AI. The new elimination is AI. The new exposure for employers is AI, and we don't talk about it enough. We don't talk about it enough. If anyone has any questions, please put it in the chat. Um, as I wrap up, I wanna tell you that you have a 90-day governance window. We really have September, October, November. To implement governance. Connecticut has closed the AI vendor made the call. Colorado and California will close the door even more. If an AI tool influences hiring, promotion, and termination decision in your organization, you must show beyond, "Oh my gosh, it's there." We have to show evidence. If AI eliminates a candidate, Can HR show what happened? Most organizations cannot answer the 4 powerful questions: What AI tool is influencing talent decision and how it is influencing the talent decision? What data shapes the outcome within your organization? And what human review occurred and what documentation exists to prove how the AI is operating. On our website at inclusionlearninglab.com, we have a new course that we have built called AI Readiness, AI Governance Readiness, and the— it is on demand. We update it constantly because this is not a one-and-done. It is the framework for what good governance looks like, and it's the framework for when AI breaks the law. And my book, When AI Breaks the Law, was written specifically because of the Mobley v. Workday case and the fact that I don't know that we are talking enough about the exposure that is built into HR. So I want to thank all of you that showed up live today. I want to thank you for being a part of this program today, and I'm going to stop the share. If you have any questions about anything I covered, Um, if you have any questions about, um, the laws, about what you should do next, how you should navigate these laws in your organization, put it in the chat, send me an email, connect with me on LinkedIn, um, and visit us at inclusionlearninglab.com. I look forward to the next AI governance brief. We'll do them a couple times a month as things come up and as new laws are shaping and case law is shaping what we do. Thank you. Yeah, I'm glad this was very informative. And especially within organizations, we cannot assume that we know what AI is doing. And the European Union AI Act is online as of, um, August 2nd, and it will also govern what we do internationally. Many of you may have employees outside of the US. There is a global HR law that is sitting outside the US, and we have a patchwork of stuff inside the US. So thank you for joining us. See you on the next event. Take care, everyone.
