Future of Work Legislation in 2026: The Rules Employers Now Face

13 min read | Updated September 5, 2026

Governments spent the last two years writing rules for how software may hire, watch, score and dismiss people at work. In 2026 those rules stopped being drafts. Some are already in force, some were softened at the last minute, and a few were struck down in court.

That mix is confusing, and the confusion is the practical problem. If you run a team, you need to know which duties actually apply to you today. If you work in one, you need to know what you can ask for.

This guide sorts the 2026 landscape into the parts that matter: monitoring, algorithmic management, employee data, automation-driven layoffs, retraining, and pay transparency. Every rule named here is one that has been signed, adopted or formally agreed, with its status and date.

Key Takeaways

• Workplace AI rules in 2026 are a patchwork. Illinois and Texas duties are live now, California and Colorado duties arrive on 1 January 2027.
• The EU postponed its high-risk AI rules for hiring and management tools to 2 December 2027, but transparency duties still start on 2 August 2026.
• The common core of almost every rule is the same: tell people the tool is being used, keep a human able to overturn it, and keep records.
• Pay transparency moved fastest of all. The EU deadline passed on 7 June 2026, and most member states missed it.
• Employers who inventory their tools now will meet the 2027 deadlines with ordinary project work rather than a scramble.

What “future of work legislation” actually covers

The phrase sounds broad, so it helps to narrow it. In practice, lawmakers are writing about six things:

• Electronic monitoring: software that tracks keystrokes, screens, location or output.
• Algorithmic management: systems that assign shifts, score performance or recommend discipline.
• Employee data and biometrics: what an employer may collect, keep and share, including fingerprints and face scans.
• Automation and layoffs: what must be disclosed when technology contributes to job cuts.
• Retraining: what an employer owes staff whose tasks change.
• Pay transparency: publishing salary ranges and reporting pay gaps.

Nearly all of it now runs through one idea: automated decision-making technology, usually shortened to ADMT. That is any system whose output materially shapes a decision about a person. A resume screener is ADMT. So is a scheduling engine that decides who gets the extra shift. A spreadsheet a manager reads and overrides is usually not.

Why the distinction matters: most 2026 rules attach duties to ADMT, not to “AI” in the abstract. If a human genuinely reviews and can change the outcome, several of the heaviest obligations fall away.

The 2026 map: which rules are actually in force

There is no single national standard in the United States, and the European timetable moved. Here is where things stand.

United States: a state-by-state patchwork

Illinois is the clearest case. An amendment to the Illinois Human Rights Act took effect on 1 January 2026. Employers must tell applicants and employees when AI is used to influence hiring, promotion, training, discipline, discharge or other terms of employment. The state’s Department of Human Rights adopted implementing rules that spell out what the notice must say, including the product name, the vendor, the decisions affected and the data categories used. Notices go to current employees annually and within 30 days of adopting a new system, and to applicants in the job posting itself. Records must be kept for four years.

Texas took a lighter approach. Its Responsible Artificial Intelligence Governance Act, effective 1 January 2026, bars developing or deploying AI with the intent to discriminate in employment decisions. Because it turns on intent, it is harder to trigger than the Illinois notice duty.

California has two separate tracks. Regulations under the Fair Employment and Housing Act have applied since 1 October 2025. They confirm that discrimination law reaches automated decision systems, make employers responsible for tools bought from vendors, and require automated-decision data to be kept for four years. They also make bias testing, or its absence, relevant evidence in a discrimination claim. Separately, the California Privacy Protection Agency finalised ADMT regulations that employers must meet by 1 January 2027. Those cover hiring, work allocation, compensation, promotion, demotion, suspension and termination, and require a pre-use notice, a documented risk assessment and, in most cases, a route to opt out or appeal.

Colorado reversed course. Its 2024 AI Act was enjoined by a federal court in April 2026 and then repealed and replaced. Governor Jared Polis signed SB 26-189 on 14 May 2026, effective 1 January 2027. The replacement keeps notice before ADMT is used and a 30-day explanation after an adverse decision, plus three years of records. It drops the annual impact assessments and risk management programme the original law required.

New York added a single question to its layoff notices. Since March 2025, employers filing under the state WARN Act must say whether technological innovation or automation contributed to the job cuts, and name the technology if so. In the first year, more than 160 companies filed and not one attributed layoffs to automation. That gap is worth remembering whenever you read a confident number about AI-driven job losses.

Connecticut passed a similar disclosure duty. SB 5, signed on 27 May 2026, requires employers to disclose AI’s contribution to mass layoffs from 1 October 2026, with further deadlines running to October 2027.

One more piece sits above all of this. Executive Order 14365, signed on 11 December 2025, directs federal agencies to challenge or preempt state AI laws seen as burdensome, and the Attorney General set up an AI Litigation Task Force in January 2026. No enforcement action had been brought as of mid-2026, and a June 2026 federal discussion draft explicitly preserved state authority over employment-related AI. For now, state law is what binds you. For more on the wider picture, see our overview of AI regulation in 2026.

Europe: the AI Act slipped, pay transparency did not

The EU AI Act treats AI used in recruitment, task allocation and performance evaluation as high-risk. Those duties were due on 2 August 2026. Under the Digital Omnibus agreement reached on 6 May 2026 and confirmed by member states on 13 May, they move to 2 December 2027.

Two things did not move. Article 50 transparency duties still apply from 2 August 2026, so people must be told when they are interacting with an AI system. And the postponement is a deferral, not a cancellation: the substantive obligations, including risk management, human oversight and documentation, arrive intact in December 2027. Our guide to EU AI Act compliance works through the risk tiers in detail.

Pay transparency went the other way. The EU Pay Transparency Directive had to be written into national law by 7 June 2026. Only four member states managed it: Italy, Slovakia, Lithuania and Malta. Others, including the Netherlands, Sweden, the Czech Republic and Denmark, have signalled early 2027. The delay does not remove the duties, it just makes the map uneven.

Electronic monitoring: notice first, narrow scope second

Monitoring is the oldest of these fights and the one with the most settled expectations. New York has required written notice of electronic monitoring at hire since 2022. Newer state proposals and adopted rules keep repeating four ideas.

Tell people before you start. Say what is collected, why, how long it is kept, and whether it can affect employment decisions.

Keep the scope narrow. Monitor what the job requires. Off-duty tracking, personal devices and sensitive areas are where complaints and claims come from.

Do not discipline on the tool alone. Several proposals require independent corroboration and give the worker a chance to see the underlying record first. Even where that is not law, it is the practice that survives a tribunal.

Write down where the data goes. Map the flow from the tool to the vendor to your HR system, publish a retention rule, and keep safety monitoring separate from personnel files.

If you are choosing or configuring a tool, our practical guide to AI in employee monitoring covers what the independent evidence says about productivity and trust.

Algorithmic management: a human who can say no

When software scores a candidate, ranks a worker or drafts a discipline recommendation, the recurring legal answer is the same. Somebody must be able to explain the decision, and somebody must be able to overturn it.

California’s No Robo Bosses Act is the bill to watch. A 2025 version was vetoed in October 2025. A 2026 version, SB 947, passed the legislature in August 2026 and sits with the governor, who has until 30 September 2026 to act. It would require human review before an automated system drives discipline or termination, plus notice and an appeal route.

Whatever happens to that bill, the design pattern is already required elsewhere and is worth building now:

• Disclose before use. Name the tool, say what it decides, and describe the data it uses in plain language.
• Explain after the fact. Give the person the reason, a chance to correct wrong input data, and a deadline for the appeal.
• Make human review real. The reviewer needs to understand the output, see the other evidence, and hold the authority to change the outcome. California’s privacy rules say so explicitly.
• Keep the file. Inputs and outputs, four years in California and Illinois, three in Colorado.

Two techniques attract outright bans rather than conditions: emotion recognition in employment decisions, and wages set individually from surveillance data. Treat both as off the table. Our articles on algorithmic management and explainable AI go deeper on making decisions defensible.

For hiring specifically, the practical risk is not the notice. It is the model. Screening tools can reproduce patterns in past hiring data, which is what AI hiring bias means in practice, and California now treats the presence or absence of bias testing as evidence. Our review of AI hiring tools and the law sets out what the main categories of tool actually do.

Employee data and biometrics

Most US state privacy laws exclude employees. California is the exception: the California Consumer Privacy Act extends access, correction and deletion rights to staff, contractors and applicants. That single difference explains why so many national employers write their policy to the Californian standard and apply it everywhere. It is simpler than running two systems.

Biometric data sits in its own bracket. Illinois’ Biometric Information Privacy Act requires informed written consent before you collect a fingerprint or face scan, a published retention schedule, and destruction on a fixed timetable. It also allows individuals to sue, which is why it produces more litigation than any comparable statute. If you use biometric time clocks or building access, treat consent and deletion as the two controls that matter.

Practical steps that hold up in most jurisdictions: collect the minimum, write down your lawful basis, encrypt and restrict access, publish a retention schedule, and put deletion and breach-notification terms in every vendor contract. Our guide to data privacy at work covers the state-by-state detail.

Automation and layoffs: disclosure, not prohibition

No jurisdiction bars an employer from automating work. What is growing is the duty to say so.

New York and Connecticut now ask about automation in layoff filings. Expect other states to copy the question, because it costs a regulator nothing and produces data they currently lack.

A second strand carves out roles that cannot be handed to software. Illinois barred AI from replacing licensed mental health professionals and community college faculty. Oregon restricted advertising that presents AI as a licensed nurse. The pattern is licensed and safety-critical work, and it is likely to spread within those categories rather than across the whole labour market.

A third strand concerns your own output. Several states now require consent before an employer uses a worker’s likeness or voice to create a digital replica, and federal bills would extend that to training data. If you are negotiating a contract, this belongs in it.

The management response that works is dull and effective. Assess before you deploy, not after. Say early what the technology is expected to change. Where roles shift, move people rather than exit them, which is the subject of our guide to automation redeployment, and see job automation adaptation for what the measured evidence shows about which tasks are actually being absorbed.

Retraining: from perk to expectation

Retraining duties are the least codified part of this landscape and the one most often written into collective agreements instead of statute. The direction is clear anyway.

Give notice when duties change. Offer structured training and pay for the hours. Give internal candidates priority for open roles, and write down the skills someone has gained so the next manager can see them. Partnerships with community colleges and unions work better than generic e-learning, because the curriculum tracks local demand.

Measure the result. If a programme cannot show that people moved into different work, it is a benefit, not a redeployment plan. Our overview of upskilling and reskilling covers which skills are actually growing.

The same logic supports human-in-the-loop rules, usually written HITL. That simply means a person reviews or can override an automated output. Train the reviewers, or the review becomes a rubber stamp and the legal protection disappears with it. Our piece on AI ethics in the workplace covers what employees are owed.

Pay transparency: the fastest-moving duty

Pay transparency has moved from an HR debate to a filing obligation faster than any other item here.

Under the EU directive, employers must give candidates pay information before an interview and may not ask about salary history. Pay secrecy clauses are prohibited. Gender pay gap reporting starts in June 2027 for employers with 150 or more staff, annually above 250 and every three years for 150 to 249. Employers with 100 to 149 staff report from June 2031. An unexplained gap of 5% or more triggers a joint pay assessment with worker representatives.

The practical work is not the report. It is the job architecture underneath it. You need defensible role bands built on objective criteria such as skills, effort, responsibility and working conditions, and you need managers who can explain a pay decision the same way twice. Our guides to pay transparency and global pay parity cover the design questions, including whether to pay by location.

Unions, bargaining and remote compliance

Where workers are represented, AI has become a bargaining subject in its own right. Agreements increasingly cover which tools may be used, what data they may collect, whether output can trigger discipline, and what happens to people whose roles change. Joint technology committees tend to surface problems earlier than a compliance review does, and they cost less than a dispute.

Remote work creates a different problem: the same person can be subject to several legal regimes at once. Where someone physically works determines tax, payroll, and often which monitoring and privacy rules apply. Define eligible countries, cap how long someone may work abroad, and document work locations and equipment. Treat roaming as a controlled benefit rather than an open permission. Our digital nomad policy guide and our piece on managing cross-border remote teams set out the mechanics.

Contractors are the other exposure. Classification rules keep tightening, and a misclassified contractor is a payroll and benefits liability rather than a saving. Our overview of gig economy regulation covers where those rules are heading.

A practical plan for employers and employees

If you run or advise a team

• Inventory first. List every tool that touches hiring, scheduling, evaluation, discipline or monitoring, with its vendor and what it decides. Most compliance failures start with a tool nobody knew was in use.
• Map tools to jurisdictions. Illinois notice duties are live. California and Colorado duties land on 1 January 2027. Work backwards from those dates.
• Write the notices once. A single plain-language template, adjusted per state, beats fifteen improvised ones.
• Name the human. For each consequential decision, record who reviews, what authority they hold, and how fast an appeal is answered.
• Fix the contracts. Vendors should owe you data minimisation, deletion on termination, audit rights and cooperation in a discrimination claim. You remain responsible for their tool either way.
• Keep the records. Four years covers Illinois and California; three covers Colorado. Pick the longest and apply it everywhere.

A governance group with legal, HR, IT and worker representation makes these decisions faster than routing each one through a manager. Our guide to building an AI governance model covers how to structure it, while HR trends for 2026 and our look at the future of human resources put it in context.

If you work in one

• Ask directly whether an automated tool was involved in a decision about you, and what data it used.
• Ask for the notice. In Illinois it should already be in the job posting and the handbook.
• Request correction of wrong input data before you argue about the conclusion. Bad inputs are the most common and most fixable problem.
• Keep your own record of what you were told and when. Appeal windows are short.
• If you suspect the tool discriminates, document the instances, ask HR for the decision rationale in writing, and take it to your state labour or civil rights agency. Retaliation for asking is separately unlawful in most states.

What to watch next

Three things will shape the next two years.

Whether federal preemption bites. The December 2025 executive order set up a fight with the states. If the litigation task force wins, the patchwork thins. If it does not, the patchwork gets denser. Employment AI has so far been carved out of preemption drafts.

Whether the December 2027 EU date holds. The high-risk deadline has already moved once. Build for the obligations rather than the date, because the substance did not change.

Whether disclosure produces data. New York’s first year returned nothing. If automation-related layoff reporting stays empty while employment shifts anyway, expect lawmakers to redesign the question rather than drop it.

Sector rules are the quieter trend. Health care, education, logistics and public safety keep attracting specific duties, because the consequences of a bad automated decision there are immediate.

Conclusion

The rules that survived 2026 all point the same way. Tell people when software is deciding something about them. Keep a human who can overturn it. Keep the records that prove both.

That is a smaller ask than the volume of legislation suggests, and it is largely the same work in Illinois, California, Colorado and the EU. An employer that does it once, properly, meets most of the incoming deadlines with ordinary project work. An employer that waits for a specific statute to force each step will do the same work later, under pressure, and with less choice about how.

For workers, the practical gain is narrower but real: a right to know, a right to correct the record, and a route to a human being.