HR leaders have until 1 January 2027 to know which software is helping decide who gets hired, promoted, paid or let go. I think the fourth quarter is the only stretch in which most teams can find that out without a crisis, and the calendar gives them a reason to do it now.
The dates that fall in the next 92 days
The UK has two. A harassment duty takes effect on 30 October 2026, requiring employers to take “all reasonable steps” to prevent sexual harassment of their workers, according to Acas. From 1 January 2027, the same Acas page says, employees can claim unfair dismissal after six months in a job instead of two years, and the cap on unfair dismissal compensation goes. The government timeline update confirms the 1 October extension of the tribunal claim window from three months to six and the January qualifying-period change. Our own overview of the UK changes before 2027 lays out the sequence.
The United States has two more, both on 1 January 2027. The California Privacy Protection Agency says businesses that use automated decision-making technology (ADMT) to make significant decisions must comply with its ADMT requirements from that date, in its September 2025 announcement. Section 7001(ddd) of the approved regulation text defines a significant decision to include one that results in the provision or denial of “employment or independent contracting opportunities or compensation”. That covers hiring; allocation or assignment of work, salary, hourly or per-assignment pay, bonuses and other benefits; promotion; and demotion, suspension and termination. Colorado signed SB26-189 on 14 May 2026. The bill repeals and reenacts the state’s earlier AI act, and its summary says deployers must give consumers “clear and conspicuous notice” at the point of interaction with a covered ADMT, plus a plain-language description of the tool’s role within 30 days after an adverse consequential decision. Section 5 of the signed act says it takes effect on 1 January 2027 and applies to consequential decisions made on or after that date.
Then there is the conference. HR Technology Conference runs 20 to 22 October at Mandalay Bay in Las Vegas, per the event site. Three days in one building is a cheap way to put questions to product teams.
The EU delay is not a reason to wait
The strongest objection comes from Brussels. The European Commission’s AI Act page now says rules for high-risk systems in areas including employment apply from 2 December 2027, and it describes CV-sorting software for recruitment as a high-risk use. We reported the adoption in EU AI Act Digital Omnibus Formally Adopted. A CHRO could reasonably read the delay, plus a rewritten Colorado law, as permission to put the AI audit in next year’s budget.
I disagree for one reason. The work each regime asks for starts from the same list. Notice at the point of use, an explanation after an adverse decision and a human who can reconsider all require the employer to know where automated tools touch a decision. Most companies cannot say that today. A recruiting platform with a ranking feature, a scheduling tool that allocates shifts and a performance module that suggests ratings each count. Nobody has to write the inventory twice, and the first version always takes longer than planned.
The legal exposure also does not wait for a statute. As I argued in There Is No AI Exception in Employment Law, existing discrimination law already applies to these tools.
What to do before 31 December
California’s Phil Laird, General Counsel of the privacy agency, said when the rules were finalized: “Our goal has always been to give consumers meaningful rights and also provide practical compliance pathways for businesses.” A pathway only helps a team that has located its own tools. I would run three steps.
First, list every system that ranks, scores, screens, schedules or flags a person, including features switched on inside the HRIS or applicant tracking system without a procurement ticket. Second, for each, record who owns it, what decision it touches and whether a human can override it. Third, send each vendor three written questions: where the tool is used in California, Colorado or the EU, what notice it produces, and how long it keeps decision logs. Ask them in Las Vegas on 20 October if you are attending, by email if you are not.
Where I could be wrong is scope. Both laws turn on definitions of covered decisions and covered tools, and I have read only California’s definition of a significant decision closely. Have counsel confirm how each applies to your tools. If either turns out narrower, the inventory still serves the UK dates and the 2027 EU deadline.
Put the vendor questions in writing before HR Tech opens on 20 October, and have the inventory in front of your counsel by 15 December.
Sources
- Acas, Employment Rights Act 2025: https://www.acas.org.uk/employment-rights-act-2025
- GOV.UK, Plan to Make Work Pay and Employment Rights Act timeline update: https://www.gov.uk/government/publications/implementing-the-plan-to-make-work-pay-and-employment-rights-act/plan-to-make-work-pay-and-employment-rights-act-timeline-update
- California Privacy Protection Agency, announcement of 23 September 2025: https://cppa.ca.gov/announcements/2025/20250923.html
- California Privacy Protection Agency, approved regulations text: https://cppa.ca.gov/regulations/pdf/ccpa_updates_cyber_risk_admt_appr_text.pdf
- Colorado General Assembly, SB26-189: https://leg.colorado.gov/bills/sb26-189
- Colorado General Assembly, SB26-189 signed act (session law): https://leg.colorado.gov/laws/session-laws/SB26-189/131/download
- HR Technology Conference: https://www.hrtechnologyconference.com/
- European Commission, AI Act: https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai
