TL;DR
- The core decision: write one global notice that satisfies the strictest regime you touch, or maintain per-jurisdiction notice and accept the candidate experience cost.
- When doing nothing is correct: if you only use AI for sourcing, scheduling or other tasks that don't feed an employment decision, no specific US notice is required and the EU rules still apply.
- What has to be true: your notice has to land at the right moment, name the use, and not bury it in a privacy policy link.
- How the options split: strictest standard everywhere, per-jurisdiction routing, or a layered approach that defaults high and adds jurisdiction-specific language for known applicant pools.
- Decision rule: if the candidate could be assessed by an automated system, tell them before the assessment.
- What to expect from getting it right: fewer candidate complaints, cleaner audit trails, and a careers page that doesn't need a rewrite every time a state moves.
The Notice That Almost Went Out
Priya runs talent for a 600-person SaaS company with offices in New York, Chicago, Austin and Berlin. Last Tuesday her product team pushed a new resume screening model to production. By Thursday her legal inbox had three emails asking, in different tones, whether the careers page disclosed AI. It didn't. She had forty-eight hours to publish something, and the draft her agency sent was three paragraphs of "innovation" copy with the word AI nowhere in it.
The temptation in that moment is to fix the careers page and move on. The page is a symptom, not the problem. The real problem is that Priya's hiring now lives under notice rules that don't line up. New York City wants an annual bias audit result and a specific kind of disclosure. Illinois wants notice when AI feeds an employment decision, and bars a specific feature in the model. California wants pre-use notice for automated decision tools. The EU wants people told when they're interacting with an AI system, full stop. A single sentence on a careers page satisfies none of them, and a single paragraph satisfies some of them badly.
The real question isn't what to put on the careers page. The real question is what to put in the candidate flow, at what moment, and which standard you're choosing to live by.
Best tools for AI in the Workplace
When You Do Not Need to Act Yet
Not every team with an AI tool owes a candidate a notice today. Being honest about this keeps the rest of the article useful. There are four honest stages.
Your current setup is genuinely fine. AI shows up in sourcing, scheduling, calendar holds, or writing suggestions to a recruiter, and none of it touches who advances. Picture a small accounting practice in Des Moines. The only model in the stack writes Boolean strings and books interview slots. Nobody is ranked. Could you draw a line from a model output to a candidate who didn't move forward? If that line doesn't exist, the US rules in scope don't ask you for notice. Article 50 in the EU is broader and still reaches people in scope of it, because it fires on interaction rather than decisions. Add a careers-page chatbot next quarter and you've changed stage without meaning to.
There's friction, not risk. You use AI to rank or summarise candidates and a human makes the next call. On paper, the person decides. In practice, a coordinator in Austin opens a list sorted by match score, reads the first twenty names before lunch, and never scrolls. The ordering did the deciding. So the question isn't whether a human sits in the loop. It's how much of the list that human opens, and ATS click data answers it better than opinion. Notice is the safer path here and silence is defensible. Either way, write the decision down, dated and signed. The person explaining it later won't be you.
There's real risk. AI scores, screens, or rejects candidates, with or without human review. A regional grocery chain running hourly hiring is the clean example. Its assessment advances anyone above a threshold overnight, no recruiter awake. You're inside the rules that require notice, and sequence matters as much as wording. A notice landing after the assessment isn't one. This is where careers-page-only fixes quietly fail. Candidates arriving from a job board aggregator never load your careers homepage. They land three screens into a hosted apply flow. Put the line where the application is, not where the marketing is.
The edge case. You have applicants in jurisdictions that never make the headlines, and vendor tools whose AI use you can't describe. The usual shape is mundane: an ATS added an AI "fit summary" in a quarterly release, the notes went to an admin who has since left, and nobody in talent knows. A vendor questionnaire comes before a careers page rewrite. Ask which steps involve a model, and whether any output changes ordering or eligibility. Then ask whether it switches on by default for new requisitions. Get it in writing from someone whose name you can put in a file. A support chat is not that.
The 11pm Questions
Do I actually use AI, or does my vendor? You inherit the notice duty when a vendor's tool does the screening. The duty attaches to the employer whose hiring decision it was, not to the software that computed the answer. Most teams answer too fast, because the honest answer is usually "both, and I can't describe the second part." Ask for the model's use case in writing, and ask which release turned it on. Get it wrong and you don't merely stay silent. You publish a description that doesn't match the tool, and a wrong statement is worse than none. Now there's a document with your name on it.
When does the notice have to appear? Before the candidate is assessed, not in a privacy policy they will never read. A footer link isn't enough. A notice only works if it can still change what the candidate does, which means before they submit. The common failure isn't legal, it's engineering. Counsel approves the wording, a ticket gets written, and the copy lands on the confirmation screen, the easiest template to edit. Nobody catches it, because nobody on the team ever applies to their own jobs.
Can a candidate opt out? In California's automated decision-making rules, candidates can opt out in defined cases. Build the workflow before you need it. An opt-out routed to a shared inbox nobody owns is a promise made in public and broken in private. Work out who receives the request and what the alternative human path looks like. Speed is what breaks first. A request arrives at six on a Friday, sits over the weekend while the tool keeps running, and the candidate is rejected on Monday by a system that never saw it. Log every one, with its outcome.
What counts as an employment decision? Hire, reject, advance, hold. Anything that changes the candidate's path. Teams argue their way out with "a human made the call", which is true and beside the point when the human only saw what the model surfaced. The better test is counterfactual: if the model had produced a different output that morning, would this person's path have changed? If yes, it's a decision. The expensive mistake is scoping the notice to the offer stage, where a person visibly decides, and staying quiet at the screening stage these rules were written about.
Does resume parsing count? If parsing scores or filters candidates, it sits in the risk tier. If it only reformats text for a human, it doesn't. Populating a field is data entry. Assigning a match score is assessment. The grey zone catches people out. A parser misreads a two-column CV, leaves the experience field empty, and a knockout rule configured two years ago drops the candidate for no experience. No score exists anywhere in that chain. A machine still did the rejecting. Ask which automatic rules fire on parsed fields, and who has rights to switch them off.
How the Approaches Actually Split
Strictest standard everywhere. One notice, written to the highest bar, shown to every candidate in every flow. It's right when you want a single source of truth and one audit trail, and the only approach that survives a lean legal team with high volume. A warehouse operator hiring across several states publishes the same paragraph on every requisition: what the tool does and where the audit summary lives. The cost is real. Candidates in states with no rule read a notice built for New York City, with a link to a bias audit summary, and a handful write back with questions your recruiters can't answer. It also fails on one specific edge. The strictest standard carries a state-specific element, the published results summary, which may not exist for every tool you run. So you either point at an audit you didn't commission or write carefully around the gap. And when one jurisdiction moves, you rewrite for everybody, including the people the change never touched.
Per-jurisdiction notice. Each candidate sees the notice for the law that applies to them, based on a location signal. Right when exposure matters more than page simplicity, and when the signal is something you control rather than something you're told. The version that works keys off the requisition instead of the person. A hospital group hiring nurses for fixed sites knows exactly where each job is, so the notice is chosen by the job record before the candidate types a character. The version that breaks keys off the candidate. Remote roles have no location. Someone in Jersey City applying to a Manhattan-based team has two plausible answers and the system picks one. A person relocating gives you the address they're leaving. Then there's maintenance, the quiet killer: every variant is a separate string to be reviewed and versioned, and on the day one state changes its wording you update four of the five.
Layered default plus jurisdiction overlay. A short, plain-language notice on every flow, with jurisdiction-specific language added when the system can tell the candidate is in scope. Right when most of your volume sits in low-rule states and a meaningful slice sits in high-rule ones, which is roughly where Priya's company lands. The base line names the use in a sentence someone can read standing up. The overlay adds what New York City asks for, on requisitions based there. The way it fails is worth understanding, because it's silent. Detection layers fail open. No error is thrown when an overlay doesn't render, no ticket gets raised, and the first to notice is a regulator reading a screenshot from a candidate. The second failure is drift. The overlay starts as a sentence, gains a clause after every legal review, and turns into the paragraph nobody reads, the outcome this approach existed to avoid. Log which variant was served with each application.
Five Diagnostic Questions
Does AI output change who advances? Don't ask the vendor and don't ask the committee. Take one requisition from last month, pick a rejected candidate, and reconstruct the path from application to rejection, naming every automated step. If you can reconstruct it, the answer is in front of you. If you can't, that's an answer too, and a more urgent one. If the output changes who advances, you're inside notice rules in more than one place. If it genuinely doesn't, you've a writing problem rather than a legal one.
Do you know which law applies to the candidate reading the page? Open the ATS and check whether the application record stores a location captured at apply time, and which notice was served with it. Not whether the field exists in the schema. Whether it's populated. Pull thirty recent applications and count the blanks. If most sit empty or default to the head office, you can't route on that signal, whatever the configuration screen claims. Default to the strictest standard until the data improves.
Can you name the AI in the notice? Write one sentence saying what the system does to the candidate, in words a person would use out loud. Then take it to the recruiter who runs that requisition and ask if it's true. That conversation is the whole test. Vague wording fails the specificity test in most regimes, and recruiters are the ones who discover the "assistant" in your draft is a scoring model with a friendlier noun. If nobody can name the use without hedging, you don't have a notice problem yet. You have an inventory problem.
Do you have the annual audit, where required? Find the URL of your published summary and open it in a private window, the way a candidate would. Check that it loads without a login and names the tool you're actually running. Then look at the date. NYC's rule needs an independent bias audit and a published summary, and the two duties fail separately. If the notice is live and the summary isn't, you've exposed yourself twice: you've stated in public that you use the tool while the duty attached to that statement sits visibly unmet.
What does the candidate see after they click apply? Ask someone outside the team to apply to a live role on their own phone and network, screenshotting every screen. You'll get a different answer than from your own laptop with a session open. Count the screens before any AI-related copy appears. If the answer is five, the flow needs redesigning and not the copy. If they saw nothing until the rejection email arrived, stop reading and fix that today.
The Jurisdictions, Compared
The useful comparison isn't which one is strictest. It's what each duty fires on, and where each leaves a candidate no better informed. Take local advice before writing final wording.
New York City Local Law 144
Requires notice to candidates alongside an annual independent bias audit and a public results summary. In force since 1 January 2023, enforced from 5 July 2023. It earns its place as the oldest live rule of its kind in the US, the template other teams copy, often without checking whether their own jurisdiction asked for the same. The three duties fail independently, which is the part teams miss. A careers-page notice with no published summary draws attention to its own gap. Where it genuinely falls short is the audit. A talent lead in Chicago opens the vendor's audit summary and finds it covers the model across the vendor's whole customer base, not her applicant pool, the pool the rule cares about. The summary also tells a candidate almost nothing about her own application. It meets the duty while leaving the person it was written for none the wiser.
Illinois HB 3773
Took effect 1 January 2026, requires notice when AI is used in employment decisions, and bars ZIP code as a proxy for a protected class. It earns its place because it reaches into the model rather than stopping at disclosure, which nothing else in scope does. You can't satisfy it with wording alone. A recruiting operations lead in Peoria asks whether ZIP code is a feature and gets a clean no, then asks again and learns the model uses commute distance, computed from the same field. Neither answer is a lie. Where it falls short is the notice half, thinner on timing and wording than New York City's, so a team can meet Illinois to the letter and still publish something evasive. The confirmation duty is the other weak point, since it lands on an employer with no way to inspect the model.
The California automated decision system regulations
California Civil Rights Council regulations on automated decision systems took effect 1 October 2025, and the California Privacy Protection Agency has separate automated decision-making rules carrying opt-out rights and disclosure duties. It earns its place because it's the first regime in scope to give candidates a pathway out rather than only a right to be told. That changes the engineering, not the copy. Where it falls short is how easily the two strands get merged. A people operations manager in Sacramento opens a project plan titled "California" and finds, a month in, that the opt-out workflow and the discrimination-testing work have different owners and different evidence. The FEHA and CPPA strands don't join up. The opt-out carries a quieter weakness. It only reaches candidates who read the notice while there was still time to act, a much smaller group than the one the rule protects.
The EU AI Act Article 50 duties
Article 50 transparency obligations applied from 2 August 2026 and require telling people when they're interacting with an AI system. It earns its place because it's the only rule in scope that fires on interaction rather than decisioning, which pulls things into view a US-shaped policy would never flag. A careers-page chatbot answering questions about parental leave decides nothing, and it's still an AI system a person is interacting with. Where it falls short for US-only teams is the assumption underneath the planning, that an American company hires under American rules. The duty follows the person, so an applicant in Berlin brings it into your flow whether or not you have an office there. The rule's own weakness is fatigue. An interaction-based duty puts a banner on every widget, and a candidate who has dismissed four dismisses the fifth unread, including the one that mattered.
The Colorado replacement law
Colorado repealed and replaced its original AI Act with SB 26-189, the Automated Decision-Making Technology Act, signed 14 May 2026 and effective 1 January 2027, narrower than the law it replaced. It earns its place for a reason that has little to do with Colorado. It's proof these rules can shrink as well as grow, which means a playbook written against a repealed statute is now confidently wrong. Where it falls short is what that does to your documents. Teams still quote the old law in internal memos and, occasionally, in candidate-facing notices, which reads as sloppiness to a candidate and as something worse to a regulator. It's also the entry most likely to be over-prepared for, because people already built for it once. Go and find every internal document naming a Colorado obligation, then check which statute each one cites.
States with no specific requirement
A long list of states, and it's where most of your candidates actually sit. It earns its place because the decision there is a brand and risk call rather than a legal one, the only entry you get to design freely. You can write plainly, at the length you choose, with no compliance element bolted on the end. Where it falls short is the reading teams give it. "No rule" gets treated as "no duty", and a complaint from a candidate in one of those states can still land inside a general anti-discrimination frame, where the question isn't whether you gave notice but whether the screen treated people differently. Silence carries its own second cost. A candidate rejected four minutes after applying at 11pm writes in to ask why, and the recruiter has no answer that doesn't describe an automated step nobody disclosed.
The Decision Table
| Situation | Scale | Setup | Primary Pain | Recommended Starting Point |
|---|---|---|---|---|
| AI scores or screens, no human veto | High exposure | Global careers page, one apply flow | One sentence cannot satisfy NYC, IL, CA at once | Layered default plus jurisdiction overlay |
| AI ranks, human decides | Medium exposure | Single careers page, US-only volume | Knowing whether notice is "safer" or required | Strictest standard everywhere, US only |
| AI in scheduling and sourcing only | Low exposure | Mixed tools, lean legal team | Over-noticing candidates who do not need it | Short plain-language statement on careers page |
| EU applicants in flow | Cross-border | Global careers page, EU apply path | Article 50 is interaction-based, not decision-based | Add a pre-interaction line for EU candidates |
| High-volume hourly hiring | Operational | High apply volume, US-only | Cannot tailor per candidate at scale | Strictest standard everywhere, accept the cost |
| Vendor does the screening | Inherited exposure | ATS with embedded AI | Cannot describe what you do not know | Vendor questionnaire before notice goes live |
| Candidates from 20+ states | Fragmented | Public sector or remote-first | Location data is unreliable | Layered default plus jurisdiction overlay |
| Pilot mode, no production decisions | Pre-exposure | Internal tool, no candidate touch | Premature notice creates false signal | Internal documentation, no candidate notice |
The Cost of Getting This Wrong
The invoice is the cheap part. Legal hours land in one budget line, a settlement lands in another, and both eventually stop. The costs that don't stop never appear on an invoice at all.
The first is that your careers page becomes evidence. Once a regulator or a claimant's lawyer has read it, every later edit changes a document that has already been cited, and rewrites made after that point read as an admission the earlier version was wrong. The practical effect is that the page ossifies. A paragraph that used to take an afternoon now takes three weeks and two reviewers, and the version candidates read is the one easiest to defend, not the one easiest to understand.
The second is recruiter trust, which moves faster than anyone expects. A recruiter who has had to apologise twice for a screen she didn't design starts routing around it. She pulls candidates by hand, works her own network, and stops feeding the tool anything real. Now its output no longer represents your pipeline, the renewal case falls apart in a budget meeting, and nobody connects the two events.
The third is candidate trust, and you can't measure it because it shows up as absence. A job seeker who felt screened by a machine without warning rarely complains. She just doesn't apply to the next role, and tells two friends in the field not to bother.
The fourth is the AI programme itself. One disclosure story travels inside a company, and the next model, however good, sits in committee for two quarters while people who were never involved ask careful questions. The team that shipped fast becomes the team nobody signs off.
So the real choice isn't between a compliant notice and a faster hire. It's between a careers page that reads as honest in 2027, or a careers page that reads as a 2025 draft patched together under pressure.
When You Are Ready to Go Further
If you're past the diagnostic stage and into the question of which tools and which wording patterns hold up under audit, that's the work HROpsLab does. We are a review publication. We don't sell software, we don't sell consulting, and we don't take referral fees from the vendors we cover. What we publish is independent comparison work on HR and operations platforms, including how their AI features are built, disclosed, and audited. The HROpsLab editorial team has spent years on this beat, and the comparison reports and case studies are where the trade-offs are spelled out without a sales motion attached. If that's useful, the links below are the front door.
Frequently Asked Questions
Can one careers page notice cover every state?
In practice, no. The rules don't line up on timing or on what must accompany the notice, and at least one requires a state-specific element that reads oddly elsewhere. A single sentence will fail in some states. A single paragraph will read as evasive in others, because wording broad enough to cover everything names nothing. The honest answer is a layered default with jurisdiction-specific language where the system detects the candidate is in scope, plus a log of which variant each applicant saw. Can't produce that log? Run the strictest standard until you can.
When does the notice have to appear?
Before the AI is used on the candidate, which usually means during the apply flow rather than in a footer. Notice arriving after the assessment isn't notice in any of these rules, and a link inside a privacy policy is a place candidates don't go. The detail that catches teams out is the entry point. Applicants from a job board aggregator often never load your careers homepage, so a careers-page-only fix leaves much of your volume uncovered. Apply to your own live role on a phone and count the screens before the copy appears. That takes two minutes.
Can a candidate opt out of AI use?
Under California's automated decision-making rules, in defined cases, yes. The opt-out has to be operational rather than theoretical, so the workflow has to exist before the first request lands. Decide who receives it and what the alternative human path looks like. Then decide how fast it has to move, because timing breaks first: a request that sits over a weekend while the tool keeps running is a promise you made in writing and didn't keep. Record every request with its outcome. That record is your only evidence the pathway was ever real.
What counts as an employment decision?
Any step that changes the candidate's path. Hire, reject, advance, hold, and screen, where screening means a step the candidate wouldn't have passed without the AI. The test that settles most arguments is counterfactual: had the model returned something different that morning, would this person have ended up elsewhere? A human clicking the final button doesn't move a decision out of scope when that human only saw a list the model ordered. The common scoping error is writing the notice around the offer stage, where a person visibly decides, and staying silent at screening.
Does resume parsing count?
It depends on what the parser does. If it scores, ranks or filters, it sits inside the rules. If it only reformats text for a human, it doesn't. Ask the vendor for the use case in writing, then ask which automatic rules fire on the fields the parser fills in. That's where the grey area lives. A parser that misreads a CV and leaves the experience field blank, feeding a knockout rule, has produced a machine rejection without scoring anybody. Nothing in that chain looks like AI on a configuration screen.
What about candidates who apply from anywhere?
Location signal is unreliable, and a candidate who lists one state and works in another is a normal case, not an edge case. Remote roles have no location at all, and a person mid-relocation will usually give you the address they're leaving. Default to the higher standard, and route jurisdiction-specific language where the signal is trustworthy, which in practice means keying off the requisition rather than the applicant. A job tied to a physical site knows where it is. Before relying on candidate-supplied location, check how many of your recent applications carry a usable value in that field rather than a default.
HROpsLab is an independent review publication covering HR and operations software, and we don't sell anything.
