Most small business owners tracking AI regulation are watching the wrong law. Colorado’s AI Act has been rewritten twice and now doesn’t take effect until January 1, 2027. California’s AI Transparency Act, arriving in August, mainly obligates AI vendors rather than the businesses that use their tools. Meanwhile, a law that already applies to companies of any size, anywhere in the country, has been enforceable since July 2023: New York City’s Local Law 144.
That gap matters because the laws getting headlines are the ones with the longest runway, and the law with zero runway left is the one most owners have never heard of. Here’s what’s actually enforceable right now, what’s coming, and the three moves that cover both.
The Hiring Law That’s Already Enforceable, No Matter Where You’re Based
Local Law 144 requires any employer or employment agency using an “automated employment decision tool,” or AEDT, to evaluate a candidate or employee for a job located in or associated with New York City to commission an independent bias audit within the year before using the tool, publish a summary of that audit on its website, and give candidates at least ten business days’ notice before the tool is used on them, per the official NYC rules governing the law. There is no employee-count threshold. A 12-person company hiring one remote employee who will work on a New York-based account is in scope the same way a 1,200-person firm is.
The New York Department of Consumer and Worker Protection enforces the law with civil penalties, and a state audit of DCWP’s enforcement record confirms the penalty structure runs per violation, with each day of noncompliance and each candidate who wasn’t properly notified counted separately. That adds up fast for a tool used across dozens of applicants a month.
The part owners miss: “automated employment decision tool” doesn’t mean a dedicated AI hiring platform. It covers resume screeners, applicant-tracking-system “smart match” ranking features, and video-interview scoring tools the moment they substantially assist a hire, promotion, or termination decision rather than just organize paperwork. If your ATS has a feature that ranks or scores candidates and you’ve never looked at whether it’s been bias-audited, you likely don’t know your own exposure yet.
The Federal Law Everyone Forgets: FTC Section 5
Local Law 144 covers hiring. For everything else, including AI chatbots, dynamic pricing tools, and AI-generated marketing content, the relevant authority is already on the books. The Federal Trade Commission has stated plainly that there is no AI exemption from Section 5 of the FTC Act, which prohibits unfair or deceptive business practices. On July 1, 2026, the FTC went further, publishing a proposed policy statement applying that prohibition specifically to companies whose AI systems are manipulated or steered in ways that contradict what a reasonable consumer would expect. The public comment period runs through July 31, 2026, which means the final policy language is still being shaped, but the underlying authority to act is not new and isn’t waiting on that comment period to close.
The FTC isn’t only watching how you use AI with your own customers, either. It’s actively punishing AI vendors who mislead small businesses into buying AI products in the first place. In March 2026, the agency settled with Air AI over deceptive claims about business growth, earnings potential, and refund guarantees sold to entrepreneurs and small businesses, with an $18 million judgment attached to the order. That’s the other half of the compliance picture: vet the AI vendor selling you the tool with the same scrutiny you’d apply to the tool’s output.
What About Colorado?
Colorado’s AI Act is real, but it’s no longer urgent. Governor Polis signed SB 26-189 on May 14, 2026, pushing the effective date to January 1, 2027, and stripping out most of the original law’s risk-management and impact-assessment requirements in favor of a narrower notice-and-transparency framework. If you have employees or customers in Colorado, it’s worth a calendar reminder for later this year, not an emergency project this week. Our full breakdown of the 2026 regulatory landscape covers Colorado, the federal executive order, and California in more depth.
The Playbook: Three Moves, In Order
1. Inventory what’s actually making decisions. Walk through your hiring stack and your customer-facing stack separately. Does anything rank, score, screen, or recommend candidates? Does anything price, approve, deny, or respond to a customer without a human reading it first? That list is your exposure map, and most owners have never written it down. If you’re still mapping out what these tools even are before you audit them, our AI basics guide is the place to start.
2. If a tool touches a New York City-associated role, get audited before you use it again. An independent bias audit is the DCWP requirement, and firms like BABL AI and Warden AI specialize in exactly this audit. Neither publishes flat-rate pricing since cost scales with tool complexity, but the broader market for these audits runs roughly $5,000 to $50,000 per engagement according to a 2026 small-business AI compliance guide, so get a quote before assuming it’s out of reach. Publish the summary, give candidates the ten-day notice, and you’re compliant.
3. Regardless of where you’re based, put a plain-language AI disclosure in writing now, while it’s cheap. You don’t need outside counsel to draft a first version. Termly has a free tier, with its Starter plan at $14 a month (about $10 if billed annually) and Pro+ at $20 a month (about $15 annually). iubenda‘s Essentials plan runs about $7 a month per site billed monthly, with its more complete Advanced tier around $28 a month, both cheaper on annual billing. Either one turns “what does our business use AI for, and who does it affect” into a published page in an afternoon, which is the same information California, Colorado, and the FTC are all converging on wanting businesses to have on hand regardless of which specific law ends up applying to you.
None of this is about slowing down how your team uses AI; our practical guide to AI for small business covers where the real gains are once your documentation is in order. It’s about being able to answer, in writing, what a tool does and who it touches before a candidate, a customer, or a regulator asks. That answer costs an afternoon to build now. Reconstructing it after a DCWP complaint or an FTC inquiry costs a lot more, and by then you’re writing the disclosure to defend a decision instead of to guide one.
Pull up your hiring software’s settings page this week and check one thing: does it rank, score, or recommend candidates. If the answer is yes, you already have a Local Law 144 clock running, whether anyone told you or not.
FAQs
Does Local Law 144 apply to my small business if I’m not based in New York City?
Yes. The law applies to any employer or employment agency evaluating a candidate for a job located in or associated with New York City, regardless of where the company itself is headquartered, and there is no employee-count threshold, per the official NYC rules.
What counts as an “automated employment decision tool”?
Any tool that substantially assists or replaces a human hiring, promotion, or termination decision, including resume screeners, ATS ranking or “smart match” features, and video-interview scoring software, not just dedicated AI hiring platforms.
Is Colorado’s AI Act still coming?
Yes, but it now takes effect January 1, 2027 under SB 26-189, signed May 14, 2026, and focuses on notice and transparency rather than the original law’s full risk-management requirements.
Does the FTC’s new AI policy create a brand-new law I need to follow?
No. Section 5 of the FTC Act already prohibits unfair or deceptive practices with no AI exemption. The July 2026 proposed policy statement clarifies how that existing authority applies to AI systems that manipulate consumer behavior; the comment period runs through July 31, 2026.
