57% of Firms in AI Regulation States Don't Know They're Non-Compliant — Here's the 3-Question Self-Check

57% of Firms in AI Regulation States Don't Know They're Non-Compliant — Here's the 3-Question Self-Check

You probably aren't reading IAPP newsletters. You're not subscribed to state legislative alert services. You run a 10–30 person accounting firm, law firm, or consulting practice, and HR is something you manage yourself between client deadlines.

That's exactly the profile SHRM had in mind when it published its 2026 State of AI in HR Report — a survey of 1,908 HR professionals conducted across organizations of all sizes. The finding that matters most to firms like yours: 57% of HR professionals working in states that already have AI employment regulations are unaware of their local compliance requirements (SHRM, 2026).

This is not a story about companies that are willfully ignoring the law. It's a story about awareness. And if you're a professional services firm owner managing HR yourself, the gap between what state legislatures are requiring and what you know about it is wider than you think.

Three questions tell you whether you have exposure. Let's run through them.

---

What SHRM's 2026 HR Data Actually Says (The Three Numbers That Matter)

The SHRM 2026 report surveyed organizations across 12 states, including those with active AI employment legislation. Three statistics define the scope of the problem.

57% of HR professionals in AI regulation states are unaware of their local compliance requirements. This is not a fringe finding. This is the median HR professional in a state that has already passed or is about to pass an AI employment law.

Only 12% of organizations have implemented compliant policies. Twelve percent. If you're in a regulated state, the odds are overwhelming that your firm is not in that group — and you probably don't know it yet.

67% of organizations not using AI cite lack of awareness of AI's capabilities as the primary barrier to adoption. The compliance problem and the adoption problem share the same root: professional services firm owners don't know enough about what AI does in their operations to manage it deliberately.

That last point matters because it means the compliance risk isn't just coming from firms that have deployed AI strategically. It's coming from firms where employees have been using AI tools without leadership ever making a formal decision. If you haven't decided whether your firm uses AI in HR processes, your firm is probably using AI in HR processes.

---

The Three-Question Self-Check for Professional Services Firms

You don't need a lawyer to answer these questions. You need about ten minutes and honest answers.

Question 1 — Do you use any software that ranks, scores, or recommends candidates or employees?

Think broadly. This includes:

• An applicant tracking system (ATS) that surfaces "top candidates" or assigns scores to resumes
• A background check platform that flags candidates based on risk algorithms
• A compensation benchmarking tool that recommends salary ranges based on market data
• A performance management platform that identifies high and low performers based on productivity metrics
• A scheduling or staffing tool that assigns work based on skills matching

If your ATS, payroll system, or HR platform updated its "intelligent" or "AI-powered" features in 2024 or 2025 — and most did — those upgraded features may now qualify as automated employment decision tools (AEDTs) under state law, even if you didn't make a deliberate choice to adopt AI.

If your answer is yes to any of the above: you likely have AI in your employment decision process whether you intended to or not.

Question 2 — Has anyone used AI to draft a job posting, performance review, or termination letter in the past 90 days?

This question catches the ad hoc exposure that doesn't show up in software inventories. You may not have adopted an AI platform. But if one of your managers used ChatGPT to draft a performance improvement plan, or your office manager used AI to write a job posting, or a partner ran a candidate's resume through an AI summarizer — that's AI in your employment process.

State AI employment laws don't only apply to enterprise AI systems deployed by IT departments. In most frameworks, the trigger is whether AI was used in a covered employment decision, regardless of how informally it was used.

If your answer is yes: you need a policy that defines what AI use is authorized and what documentation is required.

Question 3 — Do you know whether your state requires AI employment decision disclosures?

This is the awareness gap SHRM documented. Three states have the most immediate implications for professional services firms with HR AI compliance obligations in 2026:

• Connecticut: SB 5 is effective October 1, 2026. It requires employers using AI in employment decisions to provide advance notice to affected employees and candidates.
• Illinois: SB 317 addresses AI chatbot disclosure requirements in employment contexts. Check the current status on ILGA.gov for the final legislative outcome.
• Colorado: HB 1210, which would ban AI-based wage-setting systems, is pending Governor Polis's signature as of publication.

If your answer is "no, I don't know": you're in the 57%.

This is not legal advice. State AI employment laws are evolving rapidly. Consult a licensed employment attorney for guidance specific to your firm's situation. For full statutory text, see the IAPP State Privacy Legislation Tracker.

---

What the Answers Mean: State-by-State Exposure Map (CT, IL, CO Focus)

Here's what each state actually requires — one clear sentence per state, not a legal treatise.

Connecticut SB 5 (effective October 1, 2026): Employers using AI tools in employment decisions must provide written notice to employees and candidates explaining that AI is being used, what it is being used for, and how to request a human review. This is the most immediately actionable deadline for firms with Connecticut employees.

Illinois SB 317 (pending final outcome): If enacted, firms in Illinois using AI-powered chatbots in HR contexts — including recruiting, onboarding, or employee-facing processes — would be required to disclose that the employee or candidate is interacting with AI. Check ILGA.gov for the final session outcome.

Colorado HB 1210 (pending Governor Polis, ~June 7): This bill would prohibit the use of AI systems to set or recommend wages in a way that produces discriminatory outcomes. If your compensation benchmarking platform uses algorithmic recommendations, this is a direct concern — pending signature.

The compliance obligations differ by state, but the minimum viable response is the same: you need to know which AI tools your firm uses in HR-adjacent processes, and you need a documented policy before October 1, 2026 at the latest.

See also: Multi-State AI Compliance for Professional Services Firms for the broader regulatory landscape including New York's developing framework.

---

Why the Small Firm Owner Is Exposed (And Why the Big Firm Isn't)

SHRM's 2026 report documents a 27-point AI adoption gap in HR: 60% of large organizations have AI deployed within their HR function, versus only 33% of small firms. If you read that as "small firms are safer because they haven't adopted AI," you're reading it backwards.

Large firms that deliberately adopted AI in HR have also, by necessity, involved legal and compliance teams in that adoption. There were vendor contracts. There were data processing agreements. There were employee notice processes. The deliberate adoption created a documentation trail.

Small professional services firms — where the managing partner is also the de facto HR director — are in the opposite position. AI crept into HR processes through individual employee tool choices, not executive decisions. The office manager is using Copilot. The recruiter is using an AI resume screen. The senior associate used ChatGPT to draft the termination letter last quarter. None of that was sanctioned. None of it was documented.

Unauthorized AI use in employment decisions creates the same legal exposure as authorized use — but without the documentation to defend it.

The firm owner managing HR directly is also statistically the last to hear about new employment law requirements. SHRM's finding that 67% cite awareness as the primary barrier isn't an indictment of firm leadership. It's a description of a structure in which critical regulatory information doesn't reach the person who needs to act on it.

That gap is exactly what publications like The Crossing Report are built to close — not with legal analysis, but with operational intelligence that translates regulatory developments into firm-level action before the deadline lands.

---

The One Policy Document You Need Before June 30

You don't need a 20-page AI governance framework. You need a single-page policy acknowledgment that covers three things.

1. Authorized AI tools for HR-adjacent decisions. A list of the specific tools your firm has approved for use in hiring, performance review, compensation, or termination processes. Include the platform name and the specific use case. "ChatGPT for any purpose" is not sufficient — "ChatGPT for first drafts of job postings, subject to human review and editing before posting" is.

2. Disclosure language for employees and candidates. A short statement that your firm uses AI tools in certain HR processes, identifying what those tools are and what decisions they inform. This can be a paragraph in your employee handbook or a standalone acknowledgment. Connecticut SB 5 requires this before October 1; building it now covers you for every state following Connecticut's lead.

3. A human review process for AI-assisted decisions. A documented process by which any employee or candidate can request that a human (not AI) review an employment decision affecting them. This doesn't need to be elaborate — the manager responsible for the decision reviews the AI output manually and documents that review. Most state frameworks require this pathway to exist; few require it to be used in every case.

Have employees sign the acknowledgment. Keep the signed copies.

This one document — one page, three sections, employee signatures — satisfies the reasonable-care standard in the current state-level AI employment frameworks. It doesn't require outside legal help to draft. It requires you to make a list of your tools, write a disclosure paragraph, and designate a review process.

June 30 is the practical deadline if you want buffer before Connecticut's October 1 effective date. The firms that act now are the ones that won't be scrambling in September.

---

FAQ

Does my professional services firm need an AI employment policy in 2026?

If your firm has employees in Connecticut, Illinois, or Colorado, yes. Connecticut SB 5 (effective October 1, 2026) requires employers using AI in employment decisions to provide advance notice to affected employees. Illinois SB 317 (pending final session outcome) would require chatbot disclosure. Colorado HB 1210 (pending Gov. Polis signature, expected ~June 7) bans AI-based wage-setting systems. SHRM's 2026 research found 57% of HR professionals in states with AI employment regulations are unaware of their local requirements.

What counts as AI in an employment decision?

Under most 2026 state laws, any software that uses machine learning or AI to rank, score, or recommend candidates for hire, promotion, or termination qualifies. This includes ATS systems with AI resume screening, compensation benchmarking tools using algorithmic recommendations, and AI-assisted scheduling or productivity monitoring. If your ATS, payroll, or HR platform upgraded its "intelligent" features in 2024 or 2025, check whether those features now qualify as automated employment decision tools (AEDTs).

What is the minimum HR AI policy a small firm needs in 2026?

The minimum viable policy has three components: (1) a written statement identifying which AI tools are authorized for use in hiring, performance review, or compensation decisions; (2) a disclosure to employees and candidates that AI tools are used and for what purpose; (3) a process for employees to request human review of any AI-assisted employment decision. A one-page document that employees sign satisfies the reasonable-care standard in most state frameworks.

Is the AI jobs gap between large and small firms a compliance risk?

Yes. SHRM found 60% of large organizations have AI in their HR function vs. 33% of small firms. This gap is a compliance risk for small firms: they're less likely to have adopted AI deliberately, but more likely to have employees using AI tools ad hoc — drafting job postings, summarizing resumes — without a policy in place. Unauthorized AI use in HR processes creates the same exposure as authorized use, without the documentation to defend it.

What does SHRM's 5.7x job-shift-to-displacement ratio mean for my firm?

SHRM found organizations are 5.7x more likely to shift job responsibilities due to AI than eliminate positions entirely. For a 10–25 person professional services firm, the primary risk is not mass layoffs — it's role drift: accountants reviewing AI outputs rather than producing documents from scratch, paralegals whose work shifts as AI handles first drafts. The compliance implication is that job descriptions, performance metrics, and onboarding materials may need updating to reflect AI-augmented role definitions.

---

Subscribe to The Crossing Report for weekly coverage of AI regulation developments affecting professional services firms. Premium subscribers receive the full HR AI compliance checklist.