Your managers are already pasting a year of Slack messages and half-finished peer notes into ChatGPT and asking for a first draft. The reviews themselves are badly designed: hours burned gathering feedback that arrives vague, ratings that shift depending on who wrote them, and employees who find out what went wrong three months too late.
That is the setup for this post, and for a compliance question that just got real. A modern ai performance review tool can assemble year-round feedback and draft the language. What it cannot do, in California, Illinois, and Colorado, is own the call. The defensible line is simple: AI drafts, a named human decides, and a trail shows which feedback produced the draft and what the manager changed.
Here is what we will walk through: what each state actually requires and when the rules kick in, why a human editing an AI draft may not get you out of the notice-and-governance duties, the federal pushback you should not plan around, a pre-January 2027 checklist for your tooling and disclosures, the trail that makes this defensible, where WorkStory fits, and what to do in the next 90 days.
Your Managers Are Already Using AI for Reviews. The Rules Just Caught Up
The review cycle opens. The manager remembers the last six weeks, writes something safe, and the employee reads it wondering who it's about. That's a badly designed process, not a lazy manager.
Meanwhile the workaround is live: managers paste a year of Slack messages into a chatbot, and HR usually finds out later, if at all. We get questions about AI-powered reviews and how that drafting step works constantly.
That workaround now runs on three clocks: California regulations from October 1, 2025, Illinois disclosure duties from January 1, 2026, and Colorado's replacement framework from January 1, 2027.
This is the map of where AI stops and a named person owns the call. Not legal advice: check your state's text and counsel first. In a 50–300 person team, one person owns the cycle. There's no HR ops function to absorb a new disclosure duty, that's the author's read on where the squeeze lands.
The Boundary in One Sentence: AI Drafts, a Named Human Decides
Here's where that line sits. AI drafts the language and assembles the evidence; a named human makes every consequential call.
May do: gather the year's feedback, cluster themes, turn "missed two deadlines in March" into readable language, flag a peer who left none, and organize that feedback automatically.
May not do: produce the rating, set the pay number, decide the promotion, or trigger discipline with no identified person reviewing the output first.
Consequential decisions touch someone's job, pay, hours, or standing. Typing isn't regulated; the call is.
The failure mode: model output standing as the final rating, manager rubber-stamps a click. That's the pattern the duties target.
This week's test: for every last-cycle rating, name the human who made the call. Would they defend it in a room with the employee? If not, the trail is the problem, not the wording. Collect feedback continuously and the trail builds itself.
What California, Illinois and Colorado Actually Require
No single national rule. Three states, three mechanisms, three dates: your checklist changes by location.
The three states each take a different angle, here is what each one actually requires.
Shared thread: tell employees what the tool does, keep records of what it produced, explain who decided. Sources don't spell out exact notice wording or retention periods; verify those against the primary text before they go in a policy.
California: Bias Testing and Recordkeeping Since October 1, 2025
California took a different angle, and it landed first. Those same October 1, 2025 rules extend recordkeeping duties to automated-decision system data. The retention period wasn't in the sources reviewed, so pull the regulation text and get the actual number before you promise one internally.
Separately, California Privacy Protection Agency rules per law firm summaries require opt-out rights and enhanced disclosures when automated tools replace human decision-making in employment decisions. That's secondhand. If you rely on it, read the primary text.
Small-team read: if your tool ranks, screens, or scores people, know what it stores and for how long. That lands on you, not just the vendor. Can't answer "what does the tool keep" in one sentence? In California, that's your first task.
Illinois: Disclose AI Use in Employment Decisions Since January 1, 2026
California's rules are about what you keep. Illinois is about what you tell people.
Under HB 3773 (in force since January 1, 2026) that gap is a civil rights violation, and the notice details are still developing. California's bias-testing rules landed first (October 1, 2025), but Illinois is the first disclosure-specific duty, and it is already live.
The sources don't spell out the notice's required content. Get the statutory text before you draft any disclosure language, so you aren't guessing.
The cheap version of compliance is plain language: what the tool does, what it doesn't decide, and who the person is who makes the call. Disclose that managers use a drafting tool and you have most of the substance. What most teams are still missing is the record showing where the draft came from.
Colorado: SB 24-205 Is Gone, SB 26-189 Starts January 1, 2027
Colorado is the easiest state to get wrong: the law everyone cites is gone.
SB 26-189, signed May 14, 2026, replaced SB 24-205; if your policy still names the old Act, fix it.
The replacement is a disclosure-and-rights framework for automated decision-making technology (ADMT), effective January 1, 2027. It drops the old risk-management and impact-assessment model in favor of telling people what the tool does and giving them rights.
The sources reviewed don't settle ADMT's exact scope or the notice specifics. Check the SB 26-189 text and the Colorado AG's ADMT rulemaking materials directly.
So when leadership asks whether you're covered by the Colorado AI Act: that version was repealed. Say so, then read the new text.
Does a Human Drafting from an AI Draft Take You Outside These Rules?
Checking that text raises the obvious question: does a human editing an AI draft get you out? The sources we reviewed do not resolve it, in either direction. Treat it as open, not settled.
It matters. If your tool meets the ADMT definition, disclosure and rights duties can attach. If it just assembles feedback and drafts language, with no recommendation or score, they may not. A drafting aid works from what you feed it: AI only sees what you already see.
Before deciding, read SB 26-189's ADMT definition, then its exemptions, then your vendor's contract. Add the Colorado AG's rulemaking materials.
Behave as if disclosure applies. An email explaining the tool costs you little. Silence, if a duty exists, costs you the argument. If a vendor claims exemption, ask for the statutory language. "Trust us, it's a writing assistant" is not a legal position.
Federal Pushback Is Real, but Do Not Plan Around It
The federal picture is loud, and it does not change your calendar. A December 11, 2025 executive order tells federal agencies to challenge state AI laws that conflict with federal policy, and the AI Litigation Task Force stood up on January 9, 2026. The Department of Justice intervened in the xAI case against Colorado's original AI Act, the one the state has since repealed.
None of that voids a state law on its own. Illinois disclosure duties are live now, and Colorado's replacement framework starts January 1, 2027.
So build to the rules as written. A duty you skipped while a challenge plays out is still an argument you have to win later, and a 50 to 300 person team has the least room to win it. If a law does get struck down, you have lost an email and a line in a policy, not a lawsuit.
Your Pre-January 2027 Checklist for Tooling and Disclosures
Six steps:
Ask your vendor one question, in writing: does the tool make or recommend consequential decisions, or does it assemble feedback and draft language? Save the answer with a date on it.
Map your own use first. Who pastes feedback into a chatbot, which steps of your cycle touch AI, and which outputs land in a rating with no human edit?
Confirm what the tool stores, for how long, and whether you can export it. Retention is your problem, not just the vendor's.
Draft the employee notice in plain language: what AI does, what it doesn't decide, who makes the call, and how someone raises a question or objects.
Name the human. One identified person per consequential decision, recorded in the tool, before the decision reaches the employee.
Put a date on it that beats your next cycle. Illinois is live; Colorado's replacement framework lands January 1, 2027. Do this after the cycle and it's retroactive cleanup.
The Trail That Makes This Defensible, and What It Has to Show
Quick caveat: nothing in the sources reviewed says what an audit trail has to contain. Treat the four items below as the operating model that holds up under questioning, not a regulatory requirement.
The source. Which feedback items fed the draft, with names and dates. A trail that shows only a conclusion, with no path back to the feedback behind it, is the gap that gets questioned.
The raw draft. What the model produced, unedited. That's how you show AI assembled and phrased instead of setting the number.
The edit. What the manager changed and why, in one or two lines. The most useful sentence in the whole record.
The decision. Who decided, when, and against which evidence. A trail that ends at a rating with no name attached is the pattern that gets questioned.
Where WorkStory Fits, and What It Deliberately Does Not Do
That trail is the whole point, and it is why we built WorkStory the way we did. Feedback and review cycles run where managers already work, so a year of material exists before a draft is ever generated. AI turns that feedback into review drafts; the manager edits and owns the rating. Because feedback and draft live in the same place, the record of which feedback produced the draft exists by default instead of being rebuilt from memory.
Built for teams with no HR ops function: no new app, and no cycle starting from a blank field. What it does not do is decide pay, promotion, or discipline. That stays with the named human, which is the boundary's point, not a gap in the tool.
Ready to transform your review process?
FAQ: AI Performance Review Questions
Here are the questions we get most, answered fast.
Can I use AI for a performance review? Yes, for assembling evidence and drafting language from feedback you already collected. The decision is the regulated part, not the writing.
Can AI write a performance review? The draft, yes. The rating, no. If a model picks the number and nobody overrides it, you handed a consequential decision to software.
What does an AI performance review writer save you? The research and the blank field. It groups the year's feedback so a manager corrects instead of creating from scratch.
Do I have to tell employees? Illinois requires disclosure for employment decisions as of January 1, 2026; Colorado's ADMT duties start January 1, 2027. California rules described secondhand require disclosures and opt-out rights when automated tools replace human decision-making. Send a plain-language notice anyway.
Is this legal advice? No, it maps where the boundary sits. Check your state's text and counsel first. More at our blog.
What to Do in the Next 90 Days
Enough theory. Here's your 90-day punch list.
Put it in writing. Describe what your tool actually does in one paragraph and send it to your vendor for a yes or no. If they won't answer in writing, that is your answer.
Send the employee notice this quarter. Illinois already makes it a live duty. A plain email explaining what AI does and who decides costs nothing and covers the deadlines ahead.
Name a human. One person per consequential decision, recorded in the tool. If your process can't produce that name, fix the process before you fix the wording.
Read the primary texts. SB 26-189, the Illinois amendment, California's regulations. Sources disagree on specifics, and details are where exposure lives. Verify before January 2027, not after a contested rating.
Conclusion
The boundary isn't complicated: AI drafts, a named human decides. Everything else is detail around that line. Three things carry the weight. Put in writing what your tool actually does. Send the employee notice this quarter. Record a name on every consequential call, so the trail shows a person weighed the draft instead of rubber-stamping it, all three clocks are already running.
The trail is the argument; build it before the next cycle, and January 2027 is already handled.
