Regulatory register / EU · UK · US · Canada
Most of the deadlines you have been sold are not real yet.
Version 2.0 · compiled 23 August 2026 · next review November 2026
01 / The register
One row requires an independent auditor. The rest do not.
Notice, disclosure, self-assessment and conformity assessment are all real obligations. None of them needs a signature from a firm like ours. We sell the first row only, and we will say so on the call.
| Regime | Status | Bites | What it demands |
|---|---|---|---|
| NYC Local Law 144New York City | Audit | In force | The only mandated independent third-party bias audit in these markets. Annual, per tool, with a published results summary and candidate notice. Penalties run to $500 for a first default and each further violation on the same day, and to $1,500 for subsequent defaults, with each day of use treated separately. The State Comptroller reported in December 2025 that the Department's enforcement was ineffective: of 32 disclosures the Department reviewed it identified one likely non-compliance, where the Comptroller found at least 17. The Department has accepted most of the recommendations.[01][02] |
| Illinois HB 3773Illinois | In force | 1 Jan 2026 | Amends the Human Rights Act. Prohibits AI use with a discriminatory effect in employment decisions, prohibits zip code as a proxy for a protected class, and requires notice. No audit mandate. The Department of Human Rights proposed implementing rules on 15 May 2026 and then withdrew them, so the statutory duties are live while the rules are not settled.[03][04] |
| Ontario, Working for Workers FourOntario | In force | 1 Jan 2026 | Publicly advertised job postings must disclose whether AI is used to screen, assess or select applicants. Employers with 25 or more employees on the day the posting goes up. Disclosure only, no audit and no assessment.[05] |
| EU AI Act, Article 50European Union | In force | 2 Aug 2026 | Transparency duties for conversational, generative, emotion-recognition and deepfake systems. Explicitly not deferred by the Digital Omnibus: Article 50 attaches to what a system does, not to a risk tier, so it fell outside the deferral and applies on the original date. One narrow grace period, to 2 December 2026, covers only the Article 50(2) marking of AI-generated content for systems placed on the market before 2 August 2026. No audit.[06][07] |
| EU AI Act, high-riskEuropean Union | Deferred | Moved by sixteen months. Annex III standalone systems, which include recruitment, selection, performance evaluation, promotion and termination, are deferred to 2 December 2027; Annex I embedded systems move to 2 August 2028. The Digital Omnibus was published in the Official Journal and entered into force on 27 July 2026, so this is settled law rather than a proposal. Conformity assessment, which is not a bias audit.[08] | |
| California ADMTCalifornia | Phasing | 1 Jan 2027 | CCPA rules on automated decision-making for significant decisions, including employment. Pre-use notice, opt-out, access to information about the logic, and documented risk assessments. Compliance is required by 1 January 2027 for existing uses, with risk assessment and pre-use notice obligations from 1 April 2027. The risk assessments are conducted by you. No independent auditor is required.[09][10] |
| Colorado SB 26-189Colorado | Rewritten | 1 Jan 2027 | Read this row carefully, because the market keeps getting it wrong. SB 24-205 never took effect. It was repealed and replaced on 14 May 2026. The replacement drops the duty of care, the algorithmic impact assessments and the risk management programme, and covers automated decision-making technology instead. What remains: disclosure, explanation after an adverse outcome, correction rights and human review. Nothing here needs an independent signature.[11][12] |
| United KingdomUnited Kingdom | No Act | Guidance stage | No UK AI Act. Automated decisions run through UK GDPR as amended by the Data (Use and Access) Act 2025, which replaced Article 22 with Articles 22A to 22D from 5 February 2026. The ICO published a report and draft guidance on automated decision-making in recruitment on 31 March 2026, drawing on evidence from more than 30 employers, and consulted until 29 May 2026. Its central finding is that many employers do not recognise that they are using automated decision-making at all.[13][14] |
| Canada, federalCanada | Dead | None | AIDA died with Bill C-27 when Parliament was prorogued in January 2025 and was not revived. There is no comprehensive federal AI statute. What applies is privacy law, human rights law, sectoral regulation, and the Directive on Automated Decision-Making, which binds federal institutions only.[15] |
- Requires an independent auditor
- In force, no audit required
- Real, not yet biting
- No obligation, or did not survive
The sources in the rail are commentary, cited so you can follow the reasoning. They are not what an auditor relies on when signing. That is the instrument itself, and re-reading it is part of the engagement rather than something we take on trust from a law firm's client alert.
02 / Interpretation
The 2027 wave is real. It is simply not 2026.
Take the market at its word in 2024 and you would have budgeted for a Colorado impact assessment that no longer exists, and an August 2026 EU high-risk deadline that moved sixteen months. Both were sold hard. Neither arrived. That pattern is why this register exists.
What actually changed in 2026 runs in two directions at once. Brussels deferred high-risk by sixteen months while leaving the Article 50 transparency duties exactly where they were, so the obligation that landed on 2 August 2026 is a disclosure duty rather than the conformity regime most readiness decks were selling. Colorado deleted its assessment duty outright. And in New York, the one jurisdiction with a real audit mandate, the State Comptroller reported that enforcement was not working.
If you screen candidates in New York City: your obligation is live, annual, and requires an independent signature. The Comptroller's finding cuts both ways. Enforcement has been weak, and the Department has now accepted most of the recommendations to fix it, which is a reasonable basis for expecting more scrutiny rather than less.
If you hire in Illinois: HB 3773 gives a claimant a cause of action without giving you a prescribed defence, and the implementing rules were proposed and then withdrawn. A voluntary independent audit is the most credible available evidence that you checked for discriminatory effect before anyone asked. That is a decision for your counsel, not a compliance box, and we would rather frame it that way than invent a deadline.
Everywhere else on this page: you need notice, disclosure, or your own assessment. None of that requires us.
03 / Corrections
What version 1.0 got wrong.
This register was first compiled on 16 July 2026. Five statements in it are no longer accurate, and one was an inference that should not have been drawn. A register that revises itself silently is worth less than no register at all, so the changes are listed rather than absorbed.
- 01The EU high-risk deferral is settled law, not a proposal. The Digital Omnibus was published in the Official Journal and entered into force on 27 July 2026. Version 1.0 described it as a provisional agreement.
- 02Article 50 was never deferred. Version 1.0 was right that it applies from 2 August 2026 but did not record the narrow grace period to 2 December 2026 for marking content produced by systems already on the market.
- 03The New York Comptroller's December 2025 report found enforcement of Local Law 144 ineffective. Version 1.0 framed the same report as enforcement sharpening. That was an inference, and it was the wrong one.
- 04Illinois proposed implementing rules on 15 May 2026 and then withdrew them. Version 1.0 recorded only that rules were in draft.
- 05The ICO published its recruitment report and draft guidance on 31 March 2026 and consulted until 29 May 2026. Version 1.0 expected guidance in summer 2026.
Not sure which row you are in?
That is the clarification session. Tell us where you hire and what screens your candidates, and we will tell you what applies. If nothing on this page requires an independent auditor, that is the answer you get, and it is free.