Legislative and Regulatory Updates: October 2026

Regulatory activity impacting employers continues to accelerate around the world as lawmakers and regulators respond to evolving workplace, technology, and compliance concerns. Organizations operating across multiple jurisdictions face increasing complexity as new requirements emerge and existing regulations continue to evolve. This monthly update highlights noteworthy developments that may affect hiring, background screening, workforce management, and compliance practices.

Global Developments

EU AI Act and GDPR

• At a time when the regulation of artificial intelligence (AI) is a topic of hot debate, Spain’s data protection authority, the Agencia Española de Protección de Datos (AEPD), has stepped in to remind organizations of their legal obligations under the General Data Protection Regulation (GDPR) and the EU AI Act. (source: ogletree.com)
  Read More

EU-US Data Privacy Framework

• On July 31, 2026, the European Data Protection Board (EDPB) formally asked the European Commission to assess whether a United States Supreme Court decision from late June threatens the legal foundation of the EU-US Data Privacy Framework (DPF), the mechanism that has allowed personal data to flow from the EU to certified U.S. companies without additional transfer safeguards since July 2023.  (source: Heward Mills)
  Read More

Mexico

• The Mexican Institute of Social Security (Instituto Mexicano del Seguro Social (IMSS)) will now issue the employers’ registration identification card (Tarjeta de Identificación Patronal (TIP)) in digital format. The administrative decision was taken through an agreement published in the Official Gazette of the Federation (Diario Oficial de la Federación (DOF)) on September 8, 2026. (source: ogletree.com)
  Read More

Workplace Privacy

• Workplace privacy becomes significantly more complex when an organization’s workforce spans multiple countries. In this episode, Karla Grossenbacher, who specializes in US workplace privacy, and Yana Komsitsky, who specializes in international workplace privacy, discuss the differences in the legal frameworks between the US and jurisdictions outside the US. They also explore practical approaches for how multinational employers can apply global privacy principles to employee and candidate data, including when, unlike the US, consent may not provide the protection employers expect. (source: Seyfarth Shaw LLP)
  Read More

US Federal developments

• AI is changing the economics of employment litigation. For employers defending claims under the Fair Work Act, the issue is not just that more self-represented applicants are using generative AI (which they are), or that the volume of claims is rising (which it is). It is that AI is changing how those claims are presented, pursued, and defended. (source: Seyfarth Shaw LLP)
  Read More

• AI tools can streamline employee lifecycle events, such as recruiting, hiring, evaluations, and productivity monitoring, but they can also create privacy, effectiveness, and discrimination risks. As a result, many employers assess applicable local, state, federal, and international laws, conduct appropriate bias and privacy reviews, provide required notices and accommodations, and maintain meaningful human oversight. Companies that use AI across jurisdictions may want to establish ongoing compliance, monitoring, vendor management, and data protection practices as AI-related employment law continues to evolve. (source: ogletree.com)
  Read More

Background Checks

• Labor Code section 432.7 prohibits most California employers from asking applicants about, or relying on, convictions that have been judicially dismissed or sealed to make hiring decisions. Section 432.7 also contains a list of exemptions for employers that are required by law to run background checks or restrict hiring based on criminal history. A recent case clarifies that employers falling within one of those Section 432.7 exemptions are still subject to the general rule unless a specific law permits the employer to consider the criminal history. (source: jdsupra.com)
  Read More

Disparate Impact 

• On September 29, 2026, the U.S. Small Business Administration (SBA) became the latest federal agency to rescind the disparate impact provisions of its regulations under Title VI of the Civil Rights Act of 1964. The rule change will affect small business concerns that apply for or receive SBA financial assistance but does not change eligibility for SBA contracting programs. (source: ogletree.com)
  Read More

• On September 17, 2026, the attorneys general (AG) of fourteen states issued joint guidance reaffirming that disparate impact liability remains lawful, constitutional, and enforceable under both state and federal law. The guidance responds directly to the federal government’s efforts over the past two years to narrow or eliminate disparate impact enforcement, and signals those states’ commitment to continuing to enforce civil rights laws under disparate impact theories. (source: ogletree.com)
  Read More

Drug Testing

• The number of employees testing positive for marijuana use in workplace drug tests has grown significantly in recent years, according to a summer 2026 report from Quest Diagnostics, a drug testing vendor. (source: ogletree.com)
  Read More

Equal Employment Opportunity Commission

• The EEOC’s fiscal year just closed, and the direction of its enforcement trends is remarkable. After filing just 93 merit lawsuits in FY 2025, many expected the EEOC to rebound in FY 2026. The Commission had regained its quorum in October 2025, and President Trump also designated Republican Commissioner Andrea Lucas as his pick for EEOC Chair in November 2025. This newly secured leadership gave the Republican Commissioners effective control of the EEOC’s enforcement agenda and also removed a significant obstacle to litigation activity. The EEOC had all of the ingredients for a blockbuster year, but the anticipated EEOC filing surge never materialized. (source: Seyfarth Shaw LLP)
  Read More

Fair Credit Reporting Act

• FCRA lawsuits had the largest decline of the three major consumer protection statutes in August 2026, falling 14.7% to 968 filings from 1,134 in July 2026. Despite the monthly decline, FCRA lawsuits have increased 42.4% year-to-date, continuing to show the strongest annual growth among the three statutes. Putative class actions accounted for 11 filings, or 1.1% of the month’s FCRA lawsuits. (source: acainternational.org)
  Read More

Insider Threat from Employees

• Insider threats are a growing concern. The annual cost of insider risk has risen to an average of $17.4M, driven by increased spending and containment response¹. Over 77% of organizations have experienced insider-driven data loss over the past 18 months², highlighting the importance of implementing robust insider risk management strategies. Vulnerabilities don’t just come from systems, but from people. Most insider incidents are unintentional², caused by negligent or compromised users, instead of malicious actors. By addressing insider risk before it can escalate into a security incident, organizations can help build workforce trust and protect their assets, their people, and their reputation. (source: fadv.com)
  Read More

Staffing Industry

• Total staffing employment increased by 0.6% year-over-year in the second quarter of 2026, adding approximately 12,000 jobs, according to data released by the American Staffing Association. On a quarter-to-quarter basis, total weekly staffing employment grew by 5.0%, or approximately 94,000 jobs, compared to the first quarter of 2026. “Employers are facing significant uncertainty in the economy, and therefore are turning to the staffing, recruiting, and workforce solutions industry to help their businesses grow,” said Stephen Dwyer, president and chief executive officer of ASA. (source: americanstaffing.net)
  Read More

Identity Fraud in Hiring

• Synthetic identity fraud creates a false identity or persona by combining authentic identifying data, often stolen, with fabricated information. In hiring, that might mean pairing a legitimate Social Security number with a false name, invented work history, manufactured credentials, or an AI-generated profile. As stolen data, generative AI, and deepfake technology become more accessible, these schemes are becoming easier to build, scale, and use against employers and digital labor platforms. The gig economy is particularly vulnerable. (source: fadv.com)
  Read More
• Deepfakes have shifted from novelty to real risk for employers. Some identity fraud research indicates that overall deepfake and synthetic identity fraud attempts targeting organizations have surged globally. According to a report by GetReal Security, 41% of IT, cybersecurity, risk, and fraud leaders say their company has hired and onboarded a fraudulent candidate. (source: jdsupra.com)
  Read More

Week in Weed

• Discover what’s happening in the world of legalized marijuana for September. (source: seyfarth.com)
  Read More

State legislative updates

California

• SB 947, beginning July 1, 2027, prohibits employers from relying solely on an ADS when making employment-related decisions, and requires a human reviewer to conduct an independent investigation and compile corroborating information for disciplinary and termination decisions. An “ADS” includes any computational process derived from machine learning, statistical modeling, data analytics, or AI that issues simplified output, including scores, classifications, or recommendations, that is used to assist or replace human discretionary decision-making. (source: Seyfarth Shaw LLP)
  Read More
• The bills include Assembly Bill (AB) 1883, which bans AI-driven workplace monitoring tools that make predictions about employees’ emotional states or collect employees’ “neural” data; AB 1331, which prohibits workplace surveillance in bathrooms; Senate Bill (SB) 947, the “No Robo Bosses Act,” which prohibits employers from relying solely on automated decision systems for discipline or termination. Together, these laws increase employers’ potential liability for using AI-powered tools in the workplace. (source: ogletree.com)
  Read More

Massachusetts

• Massachusetts has enacted H.B. 5620, or the PROTECT Act, a new law designed to limit local participation in federal civil immigration enforcement, which creates immediate requirements for employers in the event they receive an ICE Notice of Inspection (“NOI”) for Forms I-9 or other employment records by subpoena, warrant or record request. As part of the recently enacted PROTECT Act, employers must provide written notices to all employees within 48 hours of receiving an NOI. The requirement became effective immediately when Governor Healey signed the legislation into law on August 5, 2026. (source: Seyfarth Shaw LLP)
  Read More

Washington

• Washington’s Immigrant Worker Protection Act (Second Substitute House Bill (2SHB) 2105) requires employers to provide notice before a federal Form I-9 inspection, provide notice of the inspection results afterward, and post a workplace notice of immigration-related rights. Employers will be subject to the new requirements on October 1, 2026. (source: ogletree.com)
  Read More

Looking ahead

The pace of legislative and regulatory change shows no signs of slowing. By staying informed and evaluating how emerging developments may affect existing practices, employers can be better positioned to navigate an increasingly complex compliance landscape. We will continue to monitor noteworthy developments and provide updates relevant to employers and employment screening programs.

Frequently Asked Questions

Recommended Resources

---

Legal Eagles Update on Mitigating Hiring Risks

Compliance | Article

New Hiring Laws Reshaping Background Screening

Compliance | Article

GDPR Information Series #4: Lawful Basis for Processing

Compliance | Article