Florida did not pass an AI employment law in 2026. The legislature considered several bills and adjourned without enacting a comprehensive framework, with House leadership stating publicly that AI ought to be regulated federally rather than state by state.
Most Florida business owners have drawn the obvious conclusion from that: no state law, no obligation, no urgency.
The conclusion is wrong, and the reason it's wrong is the most important thing in this article. The absence of a Florida AI statute doesn't reduce your exposure. It changes its shape, from a compliance obligation you could satisfy with a checklist into a litigation risk you can only manage with documentation. And over the past eighteen months, the federal government has quietly made that second kind of risk considerably worse.
What actually happened in Washington
On December 11, 2025, an executive order titled “Ensuring a National Policy Framework for Artificial Intelligence” directed the Attorney General to create an AI Litigation Task Force whose sole job is to challenge state AI laws, directed Commerce to identify “onerous” state statutes, and threatened states that keep them with the loss of federal broadband funding.
It has largely worked. Colorado, which had passed the country's first comprehensive AI law, saw enforcement stayed by a federal court in April 2026, then repealed and replaced the statute outright in May 2026 with a narrower disclosure-and-transparency framework that doesn't take effect until January 2027. The duty of care, the risk management programs, and the impact assessments are gone.
If you run a Florida business and you've been half-following this, the reasonable takeaway is that AI regulation is collapsing and you can stop worrying.
Here's what that reading misses. The preemption fight is about state AI statutes. It does not touch Title VII, the ADEA, or the ADA, the federal civil rights laws that have applied to employment selection procedures since long before anyone called it AI. Those statutes don't care whether a decision was made by a manager, a spreadsheet, or a model. They care whether it disadvantaged someone in a protected class and whether you can justify it.
The enforcement shift almost nobody has priced in
This is the part that matters, and it runs opposite to intuition.
In April 2025, a separate executive order directed federal agencies to deprioritize disparate-impact liability, the theory that holds an employer responsible for a neutral-looking practice that disproportionately screens out a protected group. The EEOC responded by moving to close pending disparate-impact investigations and issue right-to-sue letters to the people who filed them.
Read that sequence again. The agency didn't extinguish those claims. It handed them to the claimants and told them to go to court.
Disparate-impact liability under Title VII was codified by Congress in 1991 and recognized by the Supreme Court in 1971. An executive order sets enforcement priorities; it does not repeal a statute. Private plaintiffs retain the right to bring these claims, and the practical effect of the policy change has been to convert cases that would have been handled by a federal agency into cases handled by the plaintiffs' employment bar.
For an employer, that's not relief. An EEOC investigation is slow, and it usually ends in conciliation. A private disparate-impact suit is faster, is brought by lawyers paid on contingency, and comes with attorney's fees. The regulator stepped back and the plaintiffs' bar stepped into the gap.
The case every employer using hiring software should know
Mobley v. Workday is a federal collective action in the Northern District of California alleging that Workday's AI-driven applicant screening disadvantaged applicants by race, age, and disability. It's worth understanding for three reasons, none of which require you to be a Workday customer.
First, the court allowed the theory that an AI vendor can be treated as the employer's agent. The screening tool acts on your behalf, which means “the software did it” is not a defense, and neither is “we only make the software.” Both ends of that chain are exposed.
Second, the scale. The court authorized collective notice in February 2026 to anyone forty or older who applied through the platform since September 2020. Roughly 14,000 people opted in before the March deadline. Workday's own filings referenced rejections numbering in the billions during the relevant period. This is what algorithmic employment litigation looks like when it works: one flawed screen, applied at machine scale, aggregated into a single case.
Third, and this is the practical one, a May 2026 discovery ruling held that Workday's internal bias-testing data was shielded by attorney-client privilege, because the company's lawyers had curated the testing and used the results to give legal advice.
That ruling contains the single most useful piece of guidance in this entire article, and we'll come back to it.
The trap for Florida employers who hire remotely
Florida having no AI law does not mean no AI law applies to you.
Illinois amended its Human Rights Act effective January 1, 2026 to make discriminatory AI use in employment a civil rights violation, to require notice when AI is used in covered employment decisions, and to explicitly prohibit using ZIP code as a proxy for a protected class. It applies to employers with as few as one employee in Illinois. Notably, the law makes employers liable for discriminatory effect. Intent is not the test.
California, Colorado, Texas, and New York City all have their own overlapping requirements, on different timelines and with different triggers.
If you're an Orlando company with a remote developer in Chicago, a salesperson in Los Angeles, or a customer service team scattered across four states, you have inherited obligations that don't exist in Florida. Most owners we talk to have not connected “we hired someone remote” with “we are now subject to another state's employment law,” and AI notice requirements are the newest and least familiar version of that problem.
The other half: what your own employees are doing right now
Everything above is about AI making decisions about people. The more common exposure at a small or mid-sized business is AI being used by people, with no policy, no approved tool list, and no idea what's leaving the building.
The pattern is always the same, and it's never malicious. Someone pastes a client contract into a public chatbot to summarize the renewal terms. Someone uploads a confidential financial model to get help with the formulas. Someone runs a recorded meeting through a free transcription tool. Nobody is trying to cause a breach. They're trying to finish before five.
The legal problem is sharper than most owners realize. Trade secret protection depends on taking reasonable steps to keep the information secret. Put proprietary material into a public AI platform with no policy governing it, and you may have handed a future opponent the argument that you never took those reasonable steps, which can eliminate the protection entirely. Not damaged. Eliminated.
Separately, work generated entirely by AI is not copyrightable under current U.S. Copyright Office guidance. If your marketing team is producing campaign assets with generative tools, you should know what you do and don't own.
What belongs in the policy
An approved tools list, and the distinction that makes it matter. Consumer-grade AI tools may train on what you submit. Enterprise agreements are typically contractually restricted from doing so. A policy that doesn't separate the two is telling employees it's fine to leak proprietary information one prompt at a time. Name the approved tools. Everything else is unapproved by default.
Data classification, meaning what may go into which tool. Public information, anywhere. Internal information, approved tools only. Confidential information, approved tools under an enterprise contract. Client PII, employee records, health information, financial data, anything privileged: prohibited unless someone specifically authorizes it in writing for a specific use. Write it as a short table, not a paragraph. People follow tables.
A human review requirement for every consequential decision. No hire, no termination, no discipline, no promotion, and no pay change gets made on a machine output alone. A named human reviews it and can articulate the reason independently of the tool. This is the single highest-value provision in the policy, and it's the one that holds up in litigation.
Notice to applicants and employees when AI is used. Required now in several states, not in Florida, and worth doing anyway. It costs you a paragraph in the application flow. It buys you a much better position if anyone ever asks what you were running and whether you hid it.
Vendor due diligence, in writing. Before you buy a screening or scheduling or performance tool: what does it measure, what has the vendor tested for bias, will they indemnify you, will they support you in litigation, and can you get the data out if you're asked for it. The Mobley agency theory means the vendor's design problem becomes your liability. Contract for it accordingly.
Bias testing, run through counsel. Testing your tools for disparate impact is the right thing to do and creates an obvious hazard: you generate a document that says your hiring process disadvantages a protected group. The Mobley privilege ruling shows the path. Have counsel commission and curate the testing, for the purpose of giving legal advice. Same testing, materially better protected. Do not run this yourself in a spreadsheet and email it around.
An incident reporting path. Something will get pasted somewhere it shouldn't. You want to hear about it in an hour, not in a deposition. Make reporting it a low-drama, non-punitive process, and say so in the policy.
Consequences, stated plainly. A policy with no stated consequence is not enforceable as a basis for discipline. If you can't point to a rule the employee was on notice of, you can't rely on it later.
What we see go wrong
Banning AI outright. Usage doesn't stop; it moves to personal devices and personal accounts, where you have no visibility and no logs. Blanket bans produce shadow usage, not compliance.
Writing the policy and never training on it. An unread policy is a document, not a control.
Assuming the vendor handled compliance. Most vendor contracts allocate that risk to you. Read the indemnification clause before you need it.
Treating hiring tools as the only exposure. Scheduling algorithms, productivity monitoring, and performance scoring all touch terms and conditions of employment.
Forgetting remote employees in other states, and inheriting notice obligations nobody has read.
Running bias testing without counsel, and creating discoverable evidence of a problem you then didn't fix.
Where to start
The first step is not writing a policy. It's an inventory.
List every tool touching an employment decision: applicant tracking, resume screening, scheduling, monitoring, performance management, and any generative tool your team has adopted on its own. Most owners are surprised by the length of that list, particularly the last category. You cannot govern what you haven't found.
Then, for each one: what does it decide or influence, who reviews the output, what data goes into it, and what has the vendor told you in writing.
That inventory is a couple of hours of work and it converts a vague anxiety into a specific, rankable list of exposures. It's also the first thing any competent opponent will ask you to produce.