AI Compliance Deadline 2026: What Professional Services Firms Must Do Before June 30

Why June 30, 2026 Matters for Your Firm

Two new AI laws have put a hard deadline on the calendar for professional services firms.

Colorado's Consumer Protections for Artificial Intelligence Act (SB24-205, known as CPAIA) requires compliance by June 30, 2026 for firms deploying “high-risk AI systems” that make consequential decisions — including hiring, client assessment, financial analysis, and health recommendations. Penalties reach $20,000 per violation.

Illinois HB 3773 is already in effect as of January 1, 2026. It requires employers to disclose when AI influences employment decisions — no grace period, no small-firm exemption.

If you use AI tools to screen candidates, assess clients, draft financial analyses, or make any decision that affects a person's opportunities or outcomes — these laws likely apply to your firm. This guide tells you exactly what to do before the clock runs out.

The Two Laws You Need to Know

What “High-Risk AI” Actually Means for Your Practice

Colorado's CPAIA defines “high-risk AI systems” as AI tools that make or substantially influence consequential decisions — decisions that significantly affect a person's access to, or the terms of, employment, credit, education, housing, insurance, healthcare, or legal services.

Compliance deadlines at a glance:

Examples by firm type:

• Law firms: AI tools used to screen client intake, assess case merit, recommend settlements, or evaluate prospective associates
• Accounting firms: AI tools that flag audit risk, generate financial projections used in client decisions, or assess client creditworthiness
• Staffing firms: AI resume screeners, candidate ranking tools, or any system that influences who gets referred for a position

If you are unsure whether your tools qualify, the conservative answer is: assume they do, and implement the required governance now. The cost of documentation is far lower than the cost of a $20,000-per-violation enforcement action.

The Compliance Checklist: Law Firms

Before June 30, law firms using AI should complete the following:

• Inventory your AI tools. List every AI tool in use at the firm — client-facing and internal. Include tools used by individual attorneys even if not firm-sanctioned.
• Classify decisions by risk level. Identify which AI outputs influence decisions about clients, candidates, or employees. These are your potential CPAIA exposures.
• Implement a written AI risk management policy. The policy must address how the firm governs AI use, who is responsible, and how errors are caught and corrected.
• Create a client notification process. When AI substantially influences a decision affecting a client, you need a documented process for notifying them and offering human review.
• Add AI disclosure language to engagement letters. Cross-reference your existing engagement letter clause (see Issue #11 — AI Engagement Letter Compliance) and make sure it addresses consequential AI use specifically.
• Train attorneys on ABA Opinion 512. Your attorneys' duty of competence under Rule 1.1 now includes understanding the AI tools they use. Document that training.
• Designate an AI compliance contact. Someone at the firm must own the response if a client or candidate requests human review of an AI-influenced decision.

The Compliance Checklist: Accounting Firms

Before June 30, accounting firms using AI should complete the following:

• Audit your AI tool stack. Include tax software with AI features, audit tools, advisory platforms, and any client-facing AI assistants.
• Identify consequential outputs. Focus on AI tools that influence financial recommendations, audit risk flags, or any output that directly affects client decisions.
• Draft or update your AI use policy. AICPA ethics standards (ET §1.300.040) require that you vet third-party tools handling client data. Your policy should name the approved tools and the vetting criteria.
• Document your human review process. For every AI-generated output that influences a client recommendation, document who reviews it and how.
• Update client engagement letters. Add language that discloses AI tool use and describes how client data is protected. For clients in Colorado, add specific CPAIA notice language.
• Check your data processing agreements. Every AI vendor handling client data needs a signed DPA. If you don't have one, request it now — some vendors require lead time.
• Appoint an AI compliance owner. This person is responsible for the firm's AI governance documentation and the first point of contact for any client inquiry or regulatory action.

The Compliance Checklist: Staffing Firms

Before June 30 (and retroactively for Illinois since January 1), staffing firms using AI should complete the following:

• Identify every AI touchpoint in the candidate journey. Resume parsing, candidate scoring, interview scheduling, reference check analysis, and match algorithms all count.
• Implement candidate disclosure notices. For Illinois candidates, disclosure must happen at the time of the AI-influenced decision. Draft a standard notice now.
• Extend disclosure to Colorado candidates. Under CPAIA, candidates affected by AI-influenced hiring decisions must be notified and offered a path to human review.
• Update your ATS contracts. If your applicant tracking system uses AI features, ensure your vendor agreement addresses CPAIA and HB 3773 compliance obligations.
• Document your human-in-the-loop process. Regulators want to see that a human reviews AI outputs before final hiring decisions are made. Document who does this review and when.
• Train recruiters on AI disclosure. Every recruiter who touches a candidate in Colorado or Illinois needs to know when and how to deliver the required notice.
• Review your Illinois job postings. Some attorneys read HB 3773 as requiring disclosure in job postings when AI is used in screening. Err on the side of transparency.

The One Document Every Firm Should Have Now

The single most important thing you can do before June 30 is have a written AI use policy.

A compliant AI use policy should cover:

1. Every AI tool the firm uses — name, vendor, purpose
2. Which decisions each tool influences
3. How humans review AI outputs before final decisions are made
4. How clients, candidates, and employees are notified of AI use
5. Who at the firm is responsible for AI compliance
6. How the firm responds to requests for human review

If you are a law firm, your policy should also reference ABA Opinion 512 and your state bar's AI guidance. If you operate in multiple states, note which regulations apply where.

The compliance deadline is June 30. A policy you write in May is better than one you write after an enforcement action in July.

FAQ: AI Compliance Deadline 2026