Do AI Hiring Laws Apply to Small Businesses? The Exemption Map
7 min read · Last reviewed 1 Aug 2026
General information, not legal advice. Laws in this area change; verify against the official sources at the end of this guide and confirm specifics with employment counsel.
The most common assumption small-business owners make about AI hiring laws is that they are enterprise problems: surely a 12-person company is under every threshold that matters. The map says otherwise. The two strictest regimes, New York City's and Illinois', have no meaningful size floor at all, California starts at five employees, and Colorado repealed its one genuine under-50 exemption along with the rest of its AI Act in 2026: the replacement ADMT law applies to every deployer.
Here is the threshold-by-threshold picture, what happened to Colorado's carve-out, why being small is weak protection in practice, and the compliance stack that costs a small company almost nothing. General information, not legal advice.
The short answer: mostly, yes
If you use automated screening and hire in a regulated jurisdiction, some duty almost certainly reaches you regardless of headcount. The pattern across the laws is consistent: legislators aimed these statutes at the use of the technology, not at company size, because a biased algorithm rejects candidates identically whether its operator employs four people or four thousand.
Where size does appear, it exempts the expensive artifacts (risk programs, impact assessments) rather than the candidate-facing basics (do not discriminate, tell people, keep records). That design is actually good news for small employers, because the basics are cheap: a notice is a paragraph, records are an export, and non-discrimination is mostly about using job-related criteria you can explain.
The sections below walk the map from strictest to most forgiving.
Law by law: where the thresholds sit
NYC Local Law 144: no size exemption. Any employer using an automated employment decision tool to screen for an NYC-based job owes the independent bias audit, the published summary, and the 10-business-day candidate notice, whether it employs two people or twenty thousand.
Illinois HB 3773: sits inside the Illinois Human Rights Act, which covers employers with one or more employees. Effectively no floor: the non-discrimination and notice duties reach almost every Illinois employer.
California: the FEHA ADS regulations apply to employers with five or more employees, the standard FEHA threshold. The separate CCPA ADMT rules bind only businesses over CCPA thresholds (roughly $25 million revenue or 100,000+ consumers), which excludes nearly all genuine SMBs.
Colorado ADMT law (SB 26-189, effective January 1, 2027): applies to deployers of every size; the old AI Act's under-50 carve-out was repealed before it ever took effect, detailed in the next section.
Connecticut CART Act (disclosures from October 1, 2027): applies to businesses using automated employment decision processes; no size exemption in the employment provisions.
Federal Title VII: covers employers with 15 or more employees, and the ADEA at 20. But the federal floor is a poor comfort: the state mini-FEHAs sit far lower (California 5, New York 4, Illinois 1), and disparate-impact claims ride those state statutes just as well.
Colorado: the under-50 carve-out is gone
Colorado's original AI Act (SB 24-205) contained the one genuine small-business provision among the state AI laws: deployers under 50 full-time equivalents were conditionally excused from its risk-management programs, impact assessments, and public statements. If you built plans around that carve-out, update them, because it no longer exists.
On May 14, 2026, before the act ever took effect, Colorado repealed and reenacted it as SB 26-189, a narrower automated-decision-making technology law effective January 1, 2027. The new statute has no size threshold at all. Instead of exempting small deployers from heavy duties, it gives every deployer light ones: clear notice at the point of interaction, a plain-language explanation within 30 days of an adverse decision, data access and correction, meaningful human review on request, and three years of records.
For a small employer the trade is favorable: the paperwork you might once have needed an exemption from is gone for everyone, and what remains is the candidate-facing basics this guide recommends everywhere anyway. The catch is simply that "we are under 50, Colorado does not apply" stopped being true the moment the repeal passed; from 2027 the duties reach you at any headcount.
Why "too small to be noticed" is a bad plan
Enforcement in this space is complaint-driven, and the complainants are rejected candidates, a population automated screening produces by the hundreds per posting. A candidate who suspects an algorithm binned them does not check your headcount before filing with the NYC Department of Consumer and Worker Protection or the Illinois Department of Human Rights; agencies do not means-test respondents; and in NYC, penalties accrue per candidate and per day, which scales with your applicant volume, not your size.
The discrimination-claim exposure is worse than the fine schedules. A disparate-impact claim under a state statute with a low threshold carries back pay, damages, and attorney's fees, and the first discovery request will be for your screening records. A small employer with no records, no notice, and a black-box tool has nothing to answer with; the same employer with criteria, evidence, and an export answers in an afternoon.
There is also a commercial angle: larger customers and partners increasingly ask vendors and contractors about their hiring practices, and "we comply with the AI hiring laws" is becoming a routine representation in contracts. Being small exempts you from none of that.
The cheap compliance stack for a 10-person company
The full stack for a company under every paperwork threshold costs roughly an afternoon plus habits. (1) Notice: one honest paragraph in every job posting stating that an automated tool assists screening, what it assesses, and that a human decides; a free generator builds it from your criteria. (2) Records: export and keep each screening's criteria, scores, evidence, and outcome; four years covers the strictest retention rule you might face. (3) Human decisions: never auto-reject; have a person make the final call on evidence, and let the records show it. (4) Job-related criteria: screen on things you could defend out loud (experience, skills, availability), never on proxies like ZIP code, and check your funnel with a free four-fifths self-check a few times a year. (5) Vendor diligence: use tools that can show what they assess and export what they did; if NYC is in your hiring map, ask for the current independent audit summary.
This is the design brief SiftFirst was built against: human-set criteria, a quoted line of evidence behind every score, no auto-rejection, saved screenings as the record, and free tools for the notice and the self-check. The 2-minute compliance check will tell you which of the duties above actually apply to where you hire.
Key takeaways
- ✓NYC LL144 and Illinois HB 3773 have effectively no size floor; California's FEHA ADS rules start at 5 employees; only federal Title VII waits until 15.
- ✓Colorado's under-50-FTE exemption is gone: SB 26-189 repealed and reenacted the AI Act with no size carve-out, and from January 1, 2027 the (lighter) notice, adverse-decision, and records duties apply to every deployer.
- ✓Enforcement is complaint-driven by rejected candidates, so exposure scales with applicant volume, not headcount.
- ✓The candidate-facing basics every small employer should do anyway: notice in the posting, exported records, human final decisions, job-related criteria, periodic four-fifths self-checks.
- ✓The whole small-company stack costs roughly an afternoon to set up when the screening tool exposes its criteria and exports its records.
Screening built for these rules
SiftFirst scores candidates against criteria you set, quotes the resume line behind every score, never auto-rejects, and exports the records these laws expect. The candidate notice generator and bias audit self-check are free.
FAQ
We are under 15 employees, so federal law does not cover us. Are we in the clear?
Only federally. Title VII's 15-employee floor does not protect you from the Illinois Human Rights Act (1+ employees), California FEHA (5+), New York's state and city human rights laws (4+ and effectively no floor for LL144's tool rules), or Colorado's ADMT duties from 2027. For most small employers, the binding rules are state and city rules.
We use a third-party tool. Is compliance the vendor's problem?
No. Every regime here puts the employer (the deployer) on the hook for how the tool is used on its candidates; California explicitly extends liability through agents, and the Mobley v. Workday litigation shows vendors can be liable in addition to employers, not instead of them. What you can and should push to the vendor: documentation of what the tool assesses, audit summaries where required, and exportable records. What you cannot push: the notice, the records of your decisions, and the decision itself.
We hire remotely across many states. Which thresholds apply?
Duties generally follow the candidate's or the job's location, not your headquarters, so a fully remote employer can owe NYC duties for one NYC-based role and Illinois duties for one Chicago applicant. Tracking per-candidate jurisdictions is miserable; adopting the strictest common baseline (notice for all, records for all, human decisions for all, an audit trail if NYC is in the map) is almost always cheaper than the tracking.