Executive summary (for busy CHROs/CIOs/GCs)
Statehouses moved faster than Washington in 2025 and 2026, reshaping compliance across AI in hiring, worker data rights, and paid family & medical leave (PFML). As you enter 2026, you’ll need an operating model—spanning HR, Legal, IT/Security, Payroll, and Operations—that treats AI-driven HR tools as regulated, designs worker‑data inventories and DSAR/DSR workflows for California’s CPRA, and coordinates multi‑state PFML implementations as Delaware, Maine, Maryland, and Minnesota go live. This article distills the rules, the risks, and a pragmatic cadence to keep your program audit‑ready.
The 2026 context: faster, broader, more connected
All 50 states floated AI‑related bills in 2025 and many enacted new measures. Meanwhile, New York City’s Local Law 144 continues to require bias audits and advance notices for automated employment decision tools (AEDTs), with enforcement that began July 5, 2023—a practical bellwether far beyond NYC’s borders.
At the same time, California’s CPRA (now fully applicable in the employment context) gives employees, applicants, and contractors rights to access, correction, deletion (with exceptions), while imposing notice‑at‑collection and retention disclosure duties—and a dedicated enforcer, the California Privacy Protection Agency (CPPA), with regulations effective March 29, 2023.
- Finally, a new wave of PFML programs requires you to integrate policy, payroll, and vendor operations across multiple jurisdictions—Delaware (benefits live Jan 1, 2026), Maine (benefits slated to start May 1, 2026), Maryland (benefits expected July 1, 2026, noting the state’s evolving timeline), and Minnesota (benefits live Jan 1, 2026).
- Bottom line: Compliance is now a team sport. The winners will operate a shared controls framework, harmonized evidence, and an audit‑ready cadence across AI, data privacy, and leave.
AI in hiring & HR: Treat AEDTs as regulated, high‑risk models
What the rules say
NYC Local Law 144 prohibits use of AEDTs unless you’ve completed a bias audit within one year of use, published a summary of results, and provided advance notices to candidates/employees. DCWP’s FAQs clarify definitions, scope (“used in the city”), and notice timing. Enforcement began July 5, 2023.
EEOC guardrails are real: In the iTutorGroup case, the EEOC secured a consent decree and monetary relief after software allegedly auto‑rejected older applicants—illustrating that algorithmic screening is fully subject to civil rights laws.
What good looks like
- Inventory every model/tool across recruiting, scheduling, performance, and separations; tag where outputs “substantially assist or replace” decisions. Maintain owners, data inputs, outputs, and change logs.
- Run annual bias assessments (or more frequently with material model updates). Publish summaries where required and version all evidence (data cohorts, methodology, exclusions). The NYC rule/FAQs outline audit expectations, including handling unknown demographic data.
- Embed notices and appeal routes in workflows. Provide 10 business days’ advance notice where applicable; document human‑in‑the‑loop overrides and rationales.
- Vendor governance: Insert audit rights, model transparency clauses, and change‑control SLAs in your contracts. (Aligned to DCWP enforcement posture and broader case law signaling.)
- Risk signal: If your ATS, scheduling, or performance ratings use any score, classification, or recommendation that materially influences employment decisions, treat it like a regulated model—even outside NYC—because plaintiffs and regulators will.
Employee data privacy: It’s no longer “just IT”
California CPRA in the workplace (the new normal)
Since Jan 1, 2023, California workers (employees, applicants, contractors) have consumer‑style rights: know/access, delete (with exceptions), correct, limit sensitive data uses, and opt‑out of selling/sharing. Employers owe notice at collection, retention disclosures, and must support DSR workflows. The CPPA’s first rule set became effective Mar 29, 2023.
Monitoring & biometrics—state specifics
New York (state) electronic monitoring: Since May 7, 2022, private employers must give written notice on hire (with acknowledgment) and conspicuous posting if monitoring email, calls, or internet use.
Illinois BIPA: Requires written notice and consent, a public retention/destruction policy, and reasonable security for biometrics (e.g., time‑clock fingerprints). Amendments in 2024 clarified electronic signatures count as written consent and limited damages stacking (still costly if non‑compliant).
Action steps
Worker‑data inventory & retention schedule. Catalog HRIS, ATS, time/attendance, collaboration, surveillance, and benefits data. Tie each category to a lawful basis and a defined retention timeline. (CPRA requires retention disclosures; BIPA requires a public disposal schedule.)
Publish/refresh employee & applicant privacy notices (separate from consumer‑facing) that cover categories, purposes, sharing/selling, sensitive personal information, and retention.
Operationalize DSR/DSAR workflows in California. Define intake, identity verification, exemption handling, downstream deletion/correction with vendors, and SLA tracking.
Monitoring & biometrics policies. For New York: standardize onboarding acknowledgments and postings. For Illinois: ensure written notice/consent before collection; publish the retention/destruction policy; and validate vendor device settings.
Paid Family & Medical Leave (PFML): The 2026 expansion wave
By 2026, 13 states plus DC have enacted PFML programs, with new benefits rolling out this year. For multi‑state employers, the challenge is harmonizing eligibility, wage replacement, job protection overlays, and payroll contributions.
What’s changing now
- Delaware: Contributions began Jan 1, 2025; benefits live Jan 1, 2026. The state positions PFML as primary payor and caps weekly benefits at $900 (2026–27). Employers with 10–24 DE employees must cover parental leave; 25+ cover all leave types.
- Maine: The state has set benefits to begin May 1, 2026 (after 2025 contributions). Rulemaking has been active, with timeline debates in 2025; the official PFML site confirms a May 1 launch.
- Maryland: Payroll deductions are slated for July 1, 2025; benefits expected July 1, 2026, noting subsequent state communications about potential extensions to 2027–2028. Track the FAMLI site for official timing and thresholds (680 hours in prior 12 months).
- Minnesota: Benefits live Jan 1, 2026; among the more generous programs with up to 20 weeks combined (12 medical + 12 family, capped at 20) and progressive wage replacement.
- Tip: Maintain a jurisdiction matrix with: eligibility (hours/tenure), benefit caps, contribution rates, coordination rules (employer STD/top‑ups), and private‑plan options.
PFML action steps for 2026
- Stand up a leave governance model. Centralize a policy library (with state addenda), define vendor interfaces (state portals, TPAs, private plans), and publish adjudication SLAs.
- Map payroll codes to state programs. Configure contributions, wage caps, and offsets (e.g., Delaware as primary payor; voluntary top‑offs by agreement). Test quarterly.
- Coordinate job protection overlays. Align state PFML, FMLA, and employer policies to run concurrently where allowed; codify notice requirements and medical certification standards per state.
- Private plan strategy. Where permitted (DE, ME, MD, MN), assess private or self‑insured plans for parity and administrative efficiency; track rolling application windows (e.g., DE now accepts on a rolling quarterly basis).
Build a cross‑functional operating cadence (what “good” looks like)
- Quarterly steering group: HR, Payroll, Legal, and IT/Sec review key metrics—error rates, cycle times on DSARs and leave claims, audit findings, and incident trends.
- Evidence strategy: Keep version‑controlled policies, training records, bias audits, job‑posting artifacts, DSAR logs, and payroll test results in a shared repository with role‑based access. (This aligns with DCWP’s complaint‑based enforcement realities for LL144 and CPRA’s audit posture.)
- Third‑party governance: Standardize Data Processing Addendums, AI transparency clauses, security questionnaires, and audit rights for HR tech—especially for AEDTs and leave/benefits TPAs.
Frequently Asked Questions (FAQ)
1) We don’t hire in NYC. Do we still need a bias audit?
LL144 is a NYC law, but it’s become a de facto benchmark. If your tool “substantially assists or replaces” employment decisions, you risk exposure under federal EEO laws (see iTutorGroup) and other state AGs. Many enterprises run LL144‑style audits nationwide for consistency and defensibility.
2) What counts as an AEDT “bias audit”?
DCWP rules expect an independent audit analyzing disparate impact across sex and race/ethnicity, with rules on handling unknown demographics and permissible exclusions. Publish the results summary.
3) For CPRA, do we need a separate employee privacy notice?
Yes. Employment‑context data is now fully covered. Provide notice at collection detailing categories, purposes, sharing/selling, sensitive PI handling, and retention; then support access/correction/deletion workflows for California workers.
4) What’s the difference between New York’s e‑monitoring law and usual handbook language?
NY requires individual notice on hire with acknowledgment and a conspicuous posting—not just a handbook clause. Ensure the statutory language is included.
5) We use biometric time clocks in Illinois. What must we do?
Before collection: written notice + written consent (electronic signatures suffice under 2024 amendments); publish a retention/destruction policy; and secure biometric data. Noncompliance has driven high‑value litigation.
6) Which PFML states “go live” in 2026, and what are the big rocks?
- Delaware: benefits and $900 weekly cap; PFML is primary payor.
- Maine: benefits May 1, 2026 (after 2025 contributions).
- Maryland: contributions July 1, 2025, benefits targeted July 1, 2026 (watch official updates).
- Minnesota: benefits Jan 1, 2026; up to 20 weeks combined—among the most generous.
7) How many PFML jurisdictions should we monitor now?
Plan for 13 states + DC by 2026, with additional changes likely; maintain a living compliance matrix.