By the Shadow AI Policy team
The week of May 19–28, 2026 delivered a concentrated burst of AI governance activity on both sides of the Atlantic. EU regulators published long-awaited guidance on what counts as a "high-risk" AI system just days after Connecticut's legislature handed its governor a comprehensive AI employment law — the most watched state bill of the 2026 session. Meanwhile, the EU's AI Act Omnibus deal, struck on May 7, is still moving toward formal adoption with a hard July deadline, and the U.S. federal–state preemption battle showed no signs of resolution. This week's briefing covers four stories: (1) the EU Commission's May 19 draft guidelines on high-risk AI classification — and the public comment window closing June 23; (2) Connecticut Senate Bill 5, which passed with overwhelming bipartisan margins and heads to Governor Lamont's desk; (3) what the EU AI Act Omnibus deal actually changes for businesses deploying AI in Europe; and (4) the ongoing U.S. patchwork — from Colorado's employment AI deadline to the state attorneys general enforcement signal that compliance teams cannot afford to ignore.This week's most urgent action item: if your company uses any AI tool in hiring, performance reviews, or workforce management and you operate in Connecticut, Colorado, Illinois, or California, pull your current disclosure practices and vendor contracts now — multiple state deadlines land between June 30 and October 1, 2026. Don't wait for federal preemption to sort itself out; those laws are enforceable today.
What happened: On May 19, 2026, the European Commission published draft guidelines on the classification of high-risk artificial intelligence systems under the EU AI Act and launched a public consultation open until June 23, 2026. This is not a minor housekeeping document. Guidance on high-risk classification had initially been expected by February 2, 2026, ahead of the AI Act's original compliance milestones. The absence of final guidance, together with delays in the development of standards and other implementation tools, became a central issue in broader discussions on the operational readiness of the EU AI Act.
What's in the guidelines: The European Commission published three draft guidelines on classification, covering (i) general principles for high-risk classification, (ii) classification under Article 6(1) and Annex I (AI as a product or safety component of a regulated product), and (iii) classification under Article 6(2) and Annex III (the eight use-case categories). Under Article 6 of the EU AI Act, a system may be classified as high-risk via one of two routes: if the AI forms part of, or is itself, a product subject to EU product safety legislation (set out in Annex I); or if the AI is used in connection with specific high-risk use cases listed in Annex III. Annex III use cases include biometrics, critical infrastructure, education, employment, and law enforcement.
The "adding humans doesn't save you" warning: One of the guidelines' most consequential clarifications for HR teams is this: the Commission confirms that human involvement "has no effect on the classification of the system as high-risk," because human involvement cannot change the purpose for which an AI system is intended to be used. In other words, you cannot escape high-risk classification simply by putting a manager in the loop. Classification as high-risk is fact-specific and depends heavily on the intended purpose and deployment context of an AI system. Organizations should carefully assess AI system functionalities and intended uses, and align documentation to make their classifications defensible.
What to do now: The targeted stakeholder consultation is open until June 23, 2026. Feedback received will be incorporated into the final version of the guidelines before adoption by the Commission. If your organization uses AI in employment, education, or access-to-services contexts and sells into or operates within the EU, this is the document that will determine your compliance tier. Read it. Submit comments if you have operational concerns. The primary source is the European Commission's draft guidelines page.
What happened: On May 1, 2026, the Connecticut legislature passed SB 5, a wide-ranging law that imposes obligations on developers, deployers, and providers of artificial intelligence technologies and establishes several distinct regulatory frameworks. Governor Ned Lamont intends to sign the Act. The bill — formally the Connecticut Artificial Intelligence Responsibility and Transparency Act — cleared the state House in a 131–17 vote and the Senate 32–4, both with the kind of bipartisan margins that suggest this law will stick.
What it covers for employers: The law is a comprehensive online safety law with significant requirements relating to Automated Employment-related Decision Technology (AEDT). These AEDT requirements combine concepts from the current AI regulations in California and the European Union, taking a disclosure-focused approach that encourages, but does not impose, substantive pre-use design or audit mandates. Developers of AI tools used as a "substantial factor" in hiring, promotion, discipline, or discharge must provide deployers with compliance-related information. Deployers must notify affected employees and applicants of the technology's use, purpose, data categories, and sources.
The anti-discrimination twist: The bill amends Connecticut's anti-discrimination statutes to codify that automated decision-making is not a defense to a discrimination claim, going further than any other state, while allowing courts to consider proactive anti-bias testing as a mitigating factor. Employers who serve written notice to the Labor Department regarding layoffs are also now required to disclose to the department whether the layoffs are related to the employer's use of AI or other technological change, effective October 1, 2026.
Enforcement and key dates: Violations of this law are deemed unfair or deceptive trade practices pursuant to the Connecticut Unfair Trade Practices Act (CUTPA), enforceable exclusively by the Connecticut attorney general. There's no private right of action, and a temporary cure period through December 31, 2027, may be available at the AG's discretion. Most provisions take effect October 1, 2026, giving companies roughly four months to comply. Read the full legislative analysis at Littler's summary of the law and the original bill text via the CT Mirror's coverage.
If you need to update your AI acceptable use policy to account for Connecticut's new employer disclosure requirements, you can generate a tailored AI policy kit that incorporates current state-law obligations.
What happened: On May 7, 2026, negotiators from the Council of the European Union, the European Parliament, and the European Commission reached a provisional agreement on the terms of the Digital Omnibus on AI, marking the first set of amendments to the EU AI Act since its adoption in June 2024. The agreement still needs formal adoption — these amendments are expected to proceed through formal adoption in the coming months, with final approval anticipated in June and publication expected in July. It is important that they be in force ahead of the next key implementation milestone under the AI Act in August 2026.
The deadline changes that matter most: The most noteworthy change is the staggered deferral of certain compliance deadlines. For High-Risk AI Systems (HRAIS), the delays reflect a two-tiered approach: Annex III HRAIS (use-based) obligations are postponed from 2 August 2026 to 2 December 2027; Annex I HRAIS (product-regulated, including radio equipment, lifts, and medical devices) obligations are postponed from 2 August 2027 to 2 August 2028. However, the transparency obligations for chatbots take effect in August 2026, and the deferral for AI-generated content labeling is only four months (to December 2, 2026). These requirements may carry significant civil liability exposure and, in some cases, fines of up to €35 million or 7% of annual worldwide turnover, whichever is higher.
New prohibitions — effective December 2, 2026: Among the most visible changes to the AI Act is the introduction of two new prohibited AI-related practices: the use of AI systems to generate or manipulate non-consensual intimate material and child sexual abuse material (CSAM). The prohibition amends Article 5 of the AI Act to ban the placing on the market, putting into service, or use of AI systems that generate or manipulate realistic depictions of an identifiable natural person's intimate parts without that person's freely given, specific, informed, unambiguous, and explicit consent. Workplace policy teams should flag this: if your employees are using any AI image or video generation tool at work without a policy guardrail, this prohibition has direct relevance to your acceptable use policy.
Don't treat the delay as a free pass: The extended compliance deadlines provide additional time for implementation. However, given the complexity of the EU's AI regime, companies should not slow down their compliance and governance efforts. Harmonized standards and guidance needed for practical implementation may not be published until close to the new deadlines, leaving limited time to adapt. The full agreement summary is available from the EU Council press release, and detailed legal analysis from Latham & Watkins.
What's happening: The federal–state tension over AI law isn't resolving — it's intensifying. Through 2025, the administration made several attempts to impose a federal moratorium on state AI laws. The most prominent was a proposed 10-year freeze included in the "One Big Beautiful Bill Act." It was stripped before passage, with the Senate voting 99–1 to remove it. A similar attempt through the National Defense Authorization Act also failed. Meanwhile, states are filing in. State laws began to take effect in 2026 while the federal government signaled increased willingness to contest or preempt certain state approaches. That tension has become one of the defining features of the 2026 AI compliance landscape.
Colorado's employment AI deadline — June 30, 2026: Starting June 30, 2026, Colorado's SB 24-205 (the Colorado AI Act) introduces new compliance obligations for entities doing business in Colorado, regardless of their location, and relying on "high-risk" AI tools to make employment decisions (and other "consequential decisions") that affect Colorado residents. Covered employers must evaluate high-risk AI systems to identify and mitigate potential harm, and candidates and employees must be informed when AI influences employment decisions like hiring, firing, or promotion.
Federal employment law still applies — everywhere: Even in states without dedicated AI statutes, employers aren't off the hook. The federal baseline remains unchanged. Title VII of the Civil Rights Act, the Americans with Disabilities Act, and the Age Discrimination in Employment Act apply regardless of whether decisions are made by a hiring manager or informed by an algorithm. If an AI-assisted tool produces a disparate impact on a protected group, the legal analysis is the same as for any other selection mechanism. Courts aren't waiting. In January, a class action against an AI hiring platform alleges that certain applicant scoring and profiling practices may implicate the Fair Credit Reporting Act and analogous state laws.
State AG enforcement is real and coordinated: State attorneys general are actively pursuing AI violations. Enforcement actions against AI deployers increased significantly in 2025, with settlements targeting companies across industries. A 42-state attorney general coalition signals coordinated enforcement pressure that will intensify throughout 2026. Despite the Trump Administration's efforts to preempt state AI laws, these regulations remain enforceable until formally struck down. Businesses should comply with applicable state laws rather than waiting for federal courts to resolve jurisdictional disputes. For broader context on the patchwork, see Bloomberg Law's analysis at AI Hiring Compliance Is a Patchwork.
| State / Jurisdiction | Key Law | Effective Date | Core Employment Obligation |
|---|---|---|---|
| Illinois | HB 3773 (amends Illinois Human Rights Act) | January 1, 2026 | Anti-discrimination standards apply explicitly to AI used in employment decisions |
| Texas | TRAIGA (HB 149) | January 1, 2026 | Transparency, risk evaluation, and governance for AI in high-impact employment settings |
| New Jersey | Automated Employment Decision Tool Regulations | December 15, 2025 | Disparate impact discrimination rules cover automated employment decision technology |
| Colorado | SB 24-205 (Colorado AI Act) | June 30, 2026 ⚠️ | Risk assessments + employee/applicant disclosure when AI is used in consequential decisions |
| Connecticut | SB 5 (CT AI Responsibility and Transparency Act) | October 1, 2026 ⚠️ | AEDT disclosure to employees/applicants; AI-related layoffs must be disclosed to Labor Dept. |
| New York City | Local Law 144 | In effect (annual audits required) | Annual independent bias audit of automated hiring tools; advance notice to candidates |
| California | FEHA Amendments + CPRA Automated Decision Rules | In effect / expanding | Civil rights protections applied to AI screening; detailed recordkeeping of automated decisions |
Sources: SHRM; K&L Gates; Littler. Table reflects laws in effect or with imminent deadlines; consult counsel for your specific jurisdiction.
About Shadow AI Policy: We build AI acceptable use policy tools for HR and operations teams at 50–500 person companies. We publish guides on shadow AI, acceptable use policies, and AI governance, updated as regulations and AI tools change.
If you're a U.S. employer that uses any AI tool in hiring, firing, promotion, or performance management, you are likely already subject to at least one state law — and possibly several. Connecticut's SB 5 and Colorado's SB 24-205 both have deadlines in the next five months. If you operate in the EU or serve EU customers, the EU AI Act's transparency obligations for chatbots and AI-generated content take effect August 2, 2026, with high-risk system rules pushed to December 2027 but not eliminated. The common action for all companies this week is the same: inventory every AI tool touching employment decisions and pull your vendor's compliance documentation.
Yes, if you're in Connecticut, Colorado, Illinois, Texas, or New Jersey — and especially if you use AI-assisted hiring, resume screening, or performance management tools. Connecticut's disclosure obligations and anti-discrimination amendments take effect October 1, 2026. Colorado's risk assessment and disclosure requirements start June 30, 2026. A generic AI acceptable use policy that doesn't address how these tools are used in employment decisions won't satisfy either law. You need disclosure language, a process for notifying affected employees and applicants, and documentation of how the tool works and what data it uses.
It depends on whether you have EU employees, sell to EU customers, or use AI vendors whose tools are deployed in EU jurisdictions. The AI Act applies to deployers — the companies using the tools — not just the developers who built them. If your HR platform vendor sells into the EU, their EU compliance posture affects the contractual terms they offer you. More practically: if even one of your employees is based in the EU, the transparency obligations under Article 50 of the AI Act (chatbot disclosure, AI-generated content labeling) apply to your operations starting August 2, 2026. The delayed high-risk system deadlines don't change that.
Tailored to your industry and the AI tools your team uses. Free preview, $79 one-time or $149/mo with monthly updates.
Generate my policy kit →