---
type: Practice Guide
title: What company AI acceptable use policies need to cover
description: >-
  What company AI acceptable use policies should cover for hiring, monitoring,
  privileged work, notetakers, vendor terms, and employee use.
resource: 'https://openagreements.org/practice-guides/ai-policies/company-aup-essentials'
timestamp: '2026-04-20'
tags:
  - ai-policies
  - company-aup-essentials
---

# What company AI acceptable use policies need to cover[^about]

What company AI acceptable use policies should cover for hiring, monitoring, privileged work, notetakers, vendor terms, and employee use.

## Which AI hiring and workplace decisions need notices, audits, or appeal rights? {#ai-hiring-workplace-decisions}

**Short answer.** AI use in hiring and workplace decisions now needs a state-by-state policy overlay. Illinois, New York City, and Colorado create different duties for notice, bias audits, human review, correction rights, or appeal paths depending on the tool and decision.

The clearest reason company AI policies no longer fit inside a generic IT-use document is employment law. Illinois now regulates this in two layers. The narrower layer is the Artificial Intelligence Video Interview Act. For Illinois-based roles, employers using AI to analyze recorded interviews must give notice, explain how the system works and what it evaluates, and obtain consent before the interview goes forward."artificial intelligence may be used to analyze the applicant's video interview"[^820-ilcs-42-5] [^820-ilcs-42-5] The broader layer is Illinois Public Act 103-0804, effective January 1, 2026, which prohibits AI use in covered employment decisions when it has a discriminatory effect, bars "zip codes as a proxy for protected classes"[^illinois-general-assembly-public-act-103-0804], and requires notice when AI is used for those purposes. [^illinois-general-assembly-public-act-103-0804]

New York City and Colorado push the same point from different angles. NYC Local Law 144 is not about AI in the abstract. It is about automated employment decision tools that "substantially assists or replaces discretionary decision-making"[^nyc-dcwp-automated-employment-decision-tools-fre] in hiring or promotion. [^nyc-dcwp-automated-employment-decision-tools-fre] The FAQ makes clear that the law reaches screening, not just the final hiring decision, and it requires a completed bias audit plus notice 10 business days before using an AEDT. [^nyc-dcwp-automated-employment-decision-tools-aed][^nyc-dcwp-automated-employment-decision-tools-fre] Colorado is broader in structure. SB24-205 imposes "reasonable care"[^colorado-general-assembly-sb24-205-consumer-prot] duties, impact assessments, correction rights, and an appeal path with human review if technically feasible when a high-risk system makes or will be a substantial factor in making, a consequential decision. [^colorado-general-assembly-sb24-205-consumer-prot] But SB25B-004 extended those requirements to June 30, 2026, so Colorado is important and, as of April 20, 2026, slightly easy to overstate if the date is omitted. [^colorado-general-assembly-sb25b-004-increase-tra]

Fisher Phillips says the proposed IDHR rules would treat AI that `influence[s] or facilitate[s]` employment decisions broadly enough to cover resume screening, targeted recruiting, video or voice analysis, and third-party data. Those proposals are useful because they show where Illinois may be headed. They are still proposed, not final. [^fisher-phillips-sneak-peek-illinois-ai-workplace][^illinois-general-assembly-public-act-103-0804]

## Can using AI to monitor employees violate labor law? {#ai-employee-monitoring-labor-law}

**Short answer.** Yes, AI monitoring can become a labor-law issue when surveillance, scheduling, productivity scoring, or automated management chills protected employee activity. The policy should identify labor-sensitive uses, preserve human decision authority, and avoid overbroad monitoring rules.

AI usage policies also became labor-law documents once companies started using AI to monitor productivity, morale, scheduling, and communications. NLRB General Counsel Memo 23-02 says intrusive surveillance and automated management practices can have "a tendency to interfere with Section 7 rights"[^national-labor-relations-board-nlrb-general-coun]. [^national-labor-relations-board-nlrb-general-coun] And under *Stericycle, Inc.*, 372 NLRB No. 113 (Aug. 2, 2023), an employer rule that chills protected activity is presumptively unlawful unless the employer can show a legitimate and substantial business interest and the absence of a more narrowly tailored alternative. [^national-labor-relations-board-board-adopts-new]

Where the firms differ, it is mostly on emphasis. Wilson Sonsini spends more time on external transparency regimes, including the EU AI Act timing and California ADMT rules. Morgan Lewis and Proskauer spend more time on labor relations and the need for genuinely structured human oversight when AI reaches monitoring or bargaining-adjacent workflows. [^wilson-sonsini-2026-year-in-preview-ai-regulator][^morgan-lewis-how-ai-will-fundamentally-reshape-w][^proskauer-ai-at-work-safety-and-nlra-best-practi] But they are not really arguing about whether companies need AI AUPs. They are arguing about how much of the policy belongs in the general document and how much belongs in use-case-specific appendices.

The fourth consequence is that one company AI policy increasingly tends to turn into several. The firm guidance in this source set treats AI notetakers, in-house legal use, and labor-sensitive workflows as distinct modules rather than one generic software-use paragraph: notetaker modules get consent, retention, privilege, and internal-versus-external meeting rules; legal-team modules get a stricter overlay because confidentiality and professional judgment are different from ordinary employee productivity work; and labor-sensitive uses get explicit statements about monitoring, bargaining, and who retains decision authority. [^fisher-phillips-new-lawsuit-highlights-concerns][^american-bar-association-formal-opinion-512][^morgan-lewis-how-ai-will-fundamentally-reshape-w]

Colorado, the NLRB materials, Morgan Lewis, and Formal Opinion 512 all assume human review matters. None of them turns the phrase `human in the loop` into a safe harbor. The unresolved question is when review is meaningful and when it is ceremonial, especially in high-volume hiring, monitoring, or legal workflows. [^colorado-general-assembly-sb24-205-consumer-prot-2][^national-labor-relations-board-nlrb-general-coun][^morgan-lewis-how-ai-will-fundamentally-reshape-w][^american-bar-association-formal-opinion-512]

## What AI policy rules should in-house legal teams add for privileged work? {#legal-team-ai-policy-privilege}

**Short answer.** In-house legal teams need stricter AI rules than the company-wide baseline. The legal overlay should control privileged inputs, draft legal advice, lawyer review, vendor supervision, and final professional judgment.

For in-house legal teams, the company AUP is only the floor. ABA Formal Opinion 512 says lawyers must understand the "benefits and risks associated"[^american-bar-association-formal-opinion-512-2] with the technologies they use, and it says lawyers may not abdicate professional judgment to the tool. [^american-bar-association-formal-opinion-512-2] The point is not that the legal department needs a different brand of software policy. It is that, as Formal Opinion 512 applies the professional-responsibility duties of competence, confidentiality, and supervision to generative AI, ordinary company guardrails become a stricter workflow for privileged information, draft legal advice, and final legal judgment. [^american-bar-association-formal-opinion-512-2]

## What should a company AI acceptable use policy cover for everyday tools? {#company-ai-aup-tool-data-rules}

**Short answer.** A company AI acceptable use policy should work as a routing system for tools, data, approvals, and human review. The practical clauses usually cover approved accounts, tool tiers, data boundaries, prohibited uses, verification, training, exceptions, and special-use appendices.

The firms are more aligned than they first appear. Orrick, Cooley, Morgan Lewis, and Fisher Phillips all treat the modern AI AUP as a cross-functional operating document rather than a one-page ban on copying confidential material into chatbots. [^orrick-developing-an-ai-policy-for-your-startup][^cooley-top-ten-considerations-for-companies-usin][^morgan-lewis-ai-usage-policies-revisited-structu][^fisher-phillips-strengthening-your-ai-governance] The consensus structure is recognizable: scope, approved tools, data boundaries, prohibited or elevated-risk uses, human verification, training, and some mechanism for exceptions or higher-level approval.

Orrick is the cleanest statement of the shift. Its November 2024 note says an internal policy needs to tell employees which tools they can use, which account types they can use, who approves tools, and where higher scrutiny applies. The non-obvious point is that Orrick does not start with prompt content. It starts with accounts, approval chains, and business area sensitivity. Peripheral uses like marketing or debugging get one treatment; core proprietary development gets another. [^orrick-developing-an-ai-policy-for-your-startup] GitHub's October 2025 playbook lands in almost the same place from an operator's perspective: start with data classification, then tier tools, then create a sanctioned lane for experimental tools rather than pretending experimentation will stop. [^github-playbook-series-creating-clear-ai-policie][^nist-ai-risk-management-framework]

Cooley and Morgan Lewis give the policy its harder edges. Cooley says prompts and outputs are not confidential by default and that companies should think of many public-tool prompts as disclosures to a third party. [^cooley-top-ten-considerations-for-companies-usin] That moves AI policy out of the realm of etiquette and into trade-secret, patent, privacy, and contract risk. Morgan Lewis then turns that into drafting language: no customer data without written consent, no personal accounts for business use, no PII in ordinary tools, and no invention or proprietary work product "without sufficient human involvement, verification, and judgment"[^morgan-lewis-ai-usage-policies-revisited-structu]. [^morgan-lewis-ai-usage-policies-revisited-structu]

The first consequence is that account choice became a legal term, not just a procurement term. Orrick frames this directly: personal and free accounts rarely carry the protections a company expects, while enterprise tiers often do because they come with negotiated terms or stronger defaults. [^orrick-developing-an-ai-policy-for-your-startup] Cooley describes the same issue from the other end: absent those protections, prompts can look a lot like third-party disclosures, which changes the trade-secret, patent, customer-contract, and privacy analysis at once. [^cooley-top-ten-considerations-for-companies-usin] A policy that never distinguishes public tools from contracted tools is therefore missing the clause that probably matters most in daily practice.

The second consequence is that data classification and tool tiering became more stable than tool blacklists. GitHub's playbook is notable because it treats a policy as usable only if employees can tell, quickly, which data class belongs in which tool class. [^github-playbook-series-creating-clear-ai-policie] NIST's AI RMF reaches the same destination in more abstract language: govern, map, measure, and manage. The practical translation is that an AI AUP now works better as a routing system than as a long list of prohibitions. [^nist-ai-risk-management-framework][^nist-ai-rmf-core]

The third consequence is that over-restrictive policies seem to fail in a predictable way: they push use off the books. Fisher Phillips says the same thing in the narrower notetaker context when it notes that employees use these tools anyway, even when employers tell them not to. [^fisher-phillips-new-lawsuit-highlights-concerns-2] That is why sanctioned experimentation is showing up in serious policy design. A company that writes only do not use AI increasingly creates shadow AI. A company that sanctions approved tools, restricted tools, and experimental tools creates an audit trail and a place for the hard questions to go. [^github-playbook-series-creating-clear-ai-policie]

The legal drafting instinct is to define AI broadly so the document survives the next tool cycle. The operational instinct is to name the actual products employees use. The source set points toward a hybrid: broad definitions in the preamble, specific tool tiers in the operating sections. The exact balance remains more practice than law. [^orrick-developing-an-ai-policy-for-your-startup][^github-playbook-series-creating-clear-ai-policie]

## Should AI notetakers have their own meeting consent and retention rules? {#ai-notetakers-meeting-policy}

**Short answer.** Yes, AI notetakers should usually be handled in their own meeting-policy module. Their risks turn on participant consent, retention, privilege, training-use, and meeting metadata rather than ordinary prompt hygiene.

Fisher Phillips is where the new special-use modules become visible. Its AI notetaker article treats recording bots as a separate governance problem because consent, retention, privilege, and meeting metadata are different from ordinary prompt risk. The article says many jurisdictions require every participant to consent, and it frames notetaker use as something that increasingly belongs in an explicit policy rather than in a generic software-use paragraph. [^fisher-phillips-new-lawsuit-highlights-concerns-3] Its Illinois reporting makes the same broader point for HR workflows: once AI is used to influence employment decisions, the firm treats notice, posting, recordkeeping, and manager training as concrete rollout tasks rather than optional hygiene. [^fisher-phillips-illinois-employers-using-ai-for][^fisher-phillips-sneak-peek-illinois-ai-workplace-2]

Fisher Phillips is careful about this, and that caution seems right. The Otter.ai case is early. The complaint allegations have not been adjudicated. Still, the combination of consent, retention, training-use, and privilege questions is probably enough that many companies will keep treating notetakers as a separate policy domain rather than a footnote in the general AUP. [^fisher-phillips-new-lawsuit-highlights-concerns-3]

## How often should global AI acceptable use policies be updated? {#global-ai-policy-review-cadence}

**Short answer.** Global AI acceptable use policies need dated appendices and scheduled review cycles because external AI rules are changing quickly. A policy that sounds timeless can become inaccurate when state, EU, or agency effective dates move.

The fifth consequence is that global policies age faster. Wilson Sonsini's January 2026 summary treats August 2, 2026 as the operative date for certain EU AI Act transparency and high-risk-system obligations, but it also notes that the European Commission's November 2025 Omnibus proposals could push some high-risk-system applicability later. [^wilson-sonsini-2026-year-in-preview-ai-regulator-2] That means multinational AUPs increasingly need dates, appendices, and review cadences. Timeless prose is attractive. It is also increasingly inaccurate.

As of January 13, 2026, Wilson Sonsini wrote that specific EU AI Act transparency and HRAI obligations would apply by August 2, 2026. In the same alert it noted that Omnibus proposals could move some HRAI timing to December 2027 at the latest. For global AUP drafting, that is not a contradiction. It is the current state of play. [^wilson-sonsini-2026-year-in-preview-ai-regulator-2]



[^about]: By Steven Obiajulu, J.D. Published by [openagreements.org](https://openagreements.org). Last reviewed 2026-04-20. License: CC BY 4.0. Steven Obiajulu, J.D. edits this topic article for Federal + multi-state coverage. It synthesizes legal sources and is not legal advice. This article is for informational purposes only and does not create an attorney-client relationship. CC BY 4.0. Cite as Steven Obiajulu, *What company AI acceptable use policies need to cover*, OpenAgreements (last updated April 20, 2026), https://openagreements.org/practice-guides/ai-policies/company-aup-essentials.

[^820-ilcs-42-5]: **820 ILCS 42/5** — "artificial intelligence may be used to analyze the applicant's video interview" *820 ILCS 42/5.* <https://www.ilga.gov/legislation/ilcs/documents/082000420K5.htm>

[^illinois-general-assembly-public-act-103-0804]: **Illinois General Assembly, Public Act 103-0804** — "zip codes as a proxy for protected classes" *Illinois General Assembly, Public Act 103-0804.* <https://www.ilga.gov/Legislation/publicacts/view/103-0804>

[^nyc-dcwp-automated-employment-decision-tools-fre]: **NYC DCWP, Automated Employment Decision Tools: Frequently Asked Questions** — "substantially assists or replaces discretionary decision-making" *NYC DCWP, Automated Employment Decision Tools: Frequently Asked Questions.* <https://www.nyc.gov/assets/dca/downloads/pdf/about/DCWP-AEDT-FAQ.pdf>

[^nyc-dcwp-automated-employment-decision-tools-aed]: **NYC DCWP, Automated Employment Decision Tools (AEDT)** — "prohibits employers and employment agencies from using an automated employment decision tool unless the tool has been subject to a bias audit within one year of the use of the tool, information about the bias audit is publicly available, and certain notices have been provided to employees or job candidates." *NYC DCWP, Automated Employment Decision Tools (AEDT).* <https://www.nyc.gov/site/dca/about/automated-employment-decision-tools.page>

[^colorado-general-assembly-sb24-205-consumer-prot]: **Colorado General Assembly, SB24-205 Consumer Protections for Artificial Intel...** — "reasonable care" *Colorado General Assembly, SB24-205 Consumer Protections for Artificial Intelligence.* <https://leg.colorado.gov/bills/sb24-205>

[^colorado-general-assembly-sb25b-004-increase-tra]: **Colorado General Assembly, SB25B-004 Increase Transparency for Algorithmic Sy...** — "The act extends the effective date of the requirements of Senate Bill 24-205 to June 30, 2026." *Colorado General Assembly, SB25B-004 Increase Transparency for Algorithmic Systems.* <https://leg.colorado.gov/bills/sb25b-004>

[^fisher-phillips-sneak-peek-illinois-ai-workplace]: **Fisher Phillips, Sneak Peek: Illinois AI Workplace Notice Rulemaking is Coming – What to Expect + Your 5-Step Action Plan** — "Under the new law, employers will need to provide notice to applicants and workers if they use artificial intelligence for hiring, discipline, discharge, or other workplace-related purposes." *Fisher Phillips, Sneak Peek: Illinois AI Workplace Notice Rulemaking is Coming – What to Expect + Your 5-Step Action Plan.* <https://www.fisherphillips.com/en/insights/insights/illinois-ai-workplace-notice-rulemaking-is-coming>

[^national-labor-relations-board-nlrb-general-coun]: **National Labor Relations Board, NLRB General Counsel Issues Memo on Unlawful Electronic Surveillance and Automated Management Practices** — "a tendency to interfere with Section 7 rights" *National Labor Relations Board, NLRB General Counsel Issues Memo on Unlawful Electronic Surveillance and Automated Management Practices.* <https://www.nlrb.gov/news-outreach/news-story/nlrb-general-counsel-issues-memo-on-unlawful-electronic-surveillance-and>

[^national-labor-relations-board-board-adopts-new]: **National Labor Relations Board, Board Adopts New Standard for Assessing Lawfulness of Work Rules** — "the NLRB issued a decision in Stericycle Inc., adopting a new legal standard for evaluating employer work rules challenged as facially unlawful under Section 8(a)(1) of the National Labor Relations Act." *National Labor Relations Board, Board Adopts New Standard for Assessing Lawfulness of Work Rules.* <https://www.nlrb.gov/news-outreach/news-story/board-adopts-new-standard-for-assessing-lawfulness-of-work-rules>

[^wilson-sonsini-2026-year-in-preview-ai-regulator]: **Wilson Sonsini commentary** — "In 2026, businesses will face an increasingly complex regulatory environment for Artificial Intelligence (AI)." *Wilson Sonsini, 2026 Year in Preview: AI Regulatory Developments for Companies to Watch Out For.* <https://www.wsgr.com/en/insights/2026-year-in-preview-ai-regulatory-developments-for-companies-to-watch-out-for.html>

[^morgan-lewis-how-ai-will-fundamentally-reshape-w]: **Morgan Lewis commentary** — "A three-tiered model consisting of human-in-the-loop, human-on-the-loop, and human-in-command provides a practical governance framework" *Morgan Lewis, How AI Will Fundamentally Reshape Work in Labor Relations.* <https://www.morganlewis.com/pubs/2026/03/how-ai-will-fundamentally-reshape-work-in-labor-relations>

[^proskauer-ai-at-work-safety-and-nlra-best-practi]: **Proskauer commentary** — "the employer must evaluate whether the integration is a mandatory or permissive subject of bargaining under the NLRA." *Proskauer, AI At Work: Safety And NLRA Best Practices For Employers.* <https://www.proskauer.com/pub/ai-at-work-safety-and-nlra-best-practices-for-employers>

[^fisher-phillips-new-lawsuit-highlights-concerns]: **Fisher Phillips commentary** — "The complaint alleges the app unlawfully records conversations in popular video conferencing platforms without the consent of all participants." *Fisher Phillips, New Lawsuit Highlights Concerns About AI Notetakers: 7 Steps Businesses Should Take.* <https://www.fisherphillips.com/en/insights/insights/new-lawsuit-highlights-concerns-about-ai-notetakers>

[^american-bar-association-formal-opinion-512]: **American Bar Association, Formal Opinion 512** — "benefits and risks associated" *American Bar Association, Formal Opinion 512.* <https://www.americanbar.org/content/dam/aba/administrative/professional_responsibility/ethics-opinions/aba-formal-opinion-512.pdf>

[^colorado-general-assembly-sb24-205-consumer-prot-2]: **Colorado General Assembly, SB24-205 Consumer Protections for Artificial Intel...** — "reasonable care" *Colorado General Assembly, SB24-205 Consumer Protections for Artificial Intelligence.* <https://leg.colorado.gov/bills/sb24-205>

[^american-bar-association-formal-opinion-512-2]: **American Bar Association, Formal Opinion 512** — "benefits and risks associated" *American Bar Association, Formal Opinion 512.* <https://www.americanbar.org/content/dam/aba/administrative/professional_responsibility/ethics-opinions/aba-formal-opinion-512.pdf>

[^orrick-developing-an-ai-policy-for-your-startup]: **Orrick commentary** — "it's really important for the policy to instruct employees on what account is okay to use and what account isn't." *Orrick, Developing an AI Policy for Your Startup.* <https://www.orrick.com/en/Insights/2024/11/Developing-an-AI-Policy-for-Your-Startup>

[^cooley-top-ten-considerations-for-companies-usin]: **Cooley commentary** — "When you submit a prompt on a Generative AI platform, the platform may retain rights to re-use that information or to publish the output." *Cooley, Top Ten Considerations for Companies Using Generative AI Internally.* <https://www.cooleygo.com/top-ten-considerations-for-companies-using-generative-ai-internally/>

[^morgan-lewis-ai-usage-policies-revisited-structu]: **Morgan Lewis commentary** — "without sufficient human involvement, verification, and judgment" *Morgan Lewis, AI Usage Policies Revisited: Structure, Trends, and Transparency.* <https://www.morganlewis.com/blogs/sourcingatmorganlewis/2025/12/ai-usage-policies-revisited-structure-trends-and-transparency>

[^fisher-phillips-strengthening-your-ai-governance]: **Fisher Phillips, Strengthening Your AI Governance with Fisher Phillips’ New AI Policy Templates** — "Employers need clear, structured AI policies to ensure compliance, risk mitigation, and responsible AI use in the workplace." *Fisher Phillips, Strengthening Your AI Governance with Fisher Phillips’ New AI Policy Templates.* <https://www.fisherphillips.com/en/news-insights/strengthening-your-ai-governance-with-fisher-phillips-new-ai-policy-templates.html>

[^github-playbook-series-creating-clear-ai-policie]: **GitHub, Playbook series: Creating clear AI policies and guardrails** — "By creating clear, practical policies and a framework for tiered tool usage, companies can build the trust necessary to empower employees and safely scale AI adoption." *GitHub, Playbook series: Creating clear AI policies and guardrails.* <https://github.com/resources/insights/creating-clear-ai-policies-guardrails>

[^nist-ai-risk-management-framework]: **NIST, AI Risk Management Framework** — "The NIST AI Risk Management Framework (AI RMF) is intended for voluntary use and to improve the ability to incorporate trustworthiness considerations into the design, development, use, and evaluation of AI products, services, and systems." *NIST, AI Risk Management Framework.* <https://www.nist.gov/itl/ai-risk-management-framework>

[^nist-ai-rmf-core]: **NIST AI RMF Core** — "The AI RMF Core provides outcomes and actions that enable dialogue, understanding, and activities to manage AI risks and responsibly develop trustworthy AI systems." *NIST AI RMF Core.* <https://airc.nist.gov/airmf-resources/airmf/5-sec-core/>

[^fisher-phillips-new-lawsuit-highlights-concerns-2]: **Fisher Phillips commentary** — "The complaint alleges the app unlawfully records conversations in popular video conferencing platforms without the consent of all participants." *Fisher Phillips, New Lawsuit Highlights Concerns About AI Notetakers: 7 Steps Businesses Should Take.* <https://www.fisherphillips.com/en/insights/insights/new-lawsuit-highlights-concerns-about-ai-notetakers>

[^fisher-phillips-new-lawsuit-highlights-concerns-3]: **Fisher Phillips commentary** — "The complaint alleges the app unlawfully records conversations in popular video conferencing platforms without the consent of all participants." *Fisher Phillips, New Lawsuit Highlights Concerns About AI Notetakers: 7 Steps Businesses Should Take.* <https://www.fisherphillips.com/en/insights/insights/new-lawsuit-highlights-concerns-about-ai-notetakers>

[^fisher-phillips-illinois-employers-using-ai-for]: **Fisher Phillips commentary** — "Illinois employers will need to provide notice to applicants and workers if they use artificial intelligence for hiring, discipline, discharge, or other workplace-related purposes." *Fisher Phillips, Illinois Employers Using AI for Workplace Purposes Will Soon Need to Provide Notice: 10 Quick Takeaways and 5 Things You Should Do to Prepare.* <https://www.fisherphillips.com/en/news-insights/illinois-employers-using-ai-workplace-purposes-need-provide-notice-quick-takeaways-things-to-prepare.html>

[^fisher-phillips-sneak-peek-illinois-ai-workplace-2]: **Fisher Phillips, Sneak Peek: Illinois AI Workplace Notice Rulemaking is Coming – What to Expect + Your 5-Step Action Plan** — "Under the new law, employers will need to provide notice to applicants and workers if they use artificial intelligence for hiring, discipline, discharge, or other workplace-related purposes." *Fisher Phillips, Sneak Peek: Illinois AI Workplace Notice Rulemaking is Coming – What to Expect + Your 5-Step Action Plan.* <https://www.fisherphillips.com/en/insights/insights/illinois-ai-workplace-notice-rulemaking-is-coming>

[^wilson-sonsini-2026-year-in-preview-ai-regulator-2]: **Wilson Sonsini commentary** — "In November 2025, the EC published a set of legislative proposals which would make important changes to the legal framework for providing and deploying AI in the EU, such as extending the date of applicability of the rules on HRAI from August 2, 2026, to December 2027 at the latest." *Wilson Sonsini, 2026 Year in Preview: AI Regulatory Developments for Companies to Watch Out For.* <https://www.wsgr.com/en/insights/2026-year-in-preview-ai-regulatory-developments-for-companies-to-watch-out-for.html>