Colorado AI Act: What Employers Must Do
The Colorado AI Act was the first comprehensive U.S. state law governing "high-risk" artificial intelligence, and its original text (Senate Bill 24-205) treated AI used in hiring, promotion, pay, and termination as high-risk. That original framework no longer applies. On May 14, 2026, Governor Jared Polis signed SB 26-189, which repealed and replaced SB 24-205 and rebuilt the law around automated decision-making technology (ADMT). The replacement law takes effect January 1, 2027. It drops the duty of care, the risk-management program, and the impact-assessment mandates and keeps a narrower set of duties: pre-use notice, adverse-decision disclosure, consumer rights to correct and appeal, and three-year record retention.
What is the Colorado AI Act now?
The law most people still call the Colorado AI Act exists in two versions. The 2024 version (SB 24-205) created a risk-based regime modeled loosely on the EU AI Act. Before any of its obligations went live, the General Assembly delayed it twice and then rewrote it. SB 26-189, signed May 14, 2026 and effective January 1, 2027, is the version that will actually bind employers.
SB 26-189 regulates automated decision-making technology that materially influences a consequential decision about a Colorado resident. Employment is a named category, alongside lending, housing, insurance, education, health care, and legal or government services. The statute assigns duties to two roles:
Developers: businesses that build a covered ADMT and supply it to others.
Deployers: businesses that put a covered ADMT into use. An employer using a third-party AI resume screener is a deployer.
Most employers are deployers. A company that builds its own screening model and uses it can be both. The Colorado Attorney General holds exclusive enforcement authority. There is no private right of action, so individual workers cannot sue under the Act itself, though they keep their rights under separate anti-discrimination statutes.
Why does the Act single out employment AI?
Employment decisions carry direct economic consequences, and automated screening tools have a documented record of biased outcomes. Two examples anchor the concern:
Amazon's internal recruiting tool, reported by Reuters and scrapped around 2018 after engineers found it down-ranked resumes that contained signals associated with women, such as the names of women's colleges.
The iTutorGroup EEOC settlement (2023), the EEOC's first AI-related hiring case, in which recruiting software automatically rejected older applicants in violation of the ADEA. The company paid $365,000 to settle.
These outcomes show that bias can sit inside a model without explicit intent, the harm the law targets through its disclosure and human-review rights.
What counts as a "consequential decision" in employment?
A consequential decision is one that has a material legal or similarly significant effect on a person's access to, or the cost or terms of, employment or an employment opportunity. ADMT used at these points is covered:
Screening or ranking job applicants
Recommending who to interview based on automated scoring
Recommending who to hire
Setting or recommending compensation
Recommending promotions or assignments
Recommending termination
ADMT is covered when it materially influences the decision. A system that only formats a job posting or books a meeting on a calendar is generally outside scope. A system that scores, ranks, or filters candidates is inside scope.
What about "algorithmic discrimination" under the law?
SB 24-205 carried an explicit duty of care to protect workers from algorithmic discrimination. SB 26-189 removed that duty of care along with the risk-management and impact-assessment requirements that backed it. The replacement law relies on notice, disclosure, and consumer rights rather than an affirmative anti-discrimination obligation enforced through the AG.
That does not make biased hiring tools legal. Existing anti-discrimination law still reaches them. The EEOC's prior technical guidance on AI under Title VII and the ADA described how algorithmic disparate impact and failure-to-accommodate can violate existing federal law, independent of any state statute. Protected classes under federal and Colorado law include age, race, color, disability, national origin, religion, sex, sexual orientation, and others.
What must employers do to comply with the Colorado AI Act?
Under SB 26-189, deployers using covered ADMT in employment decisions carry four core duties. The table below maps each duty to the action it requires.
Obligation: Pre-use notice
What the employer must do: Inform candidates and employees, before or at the time of the interaction, that an Automated Decision-Making Technology (ADMT) is being used in a consequential decision. A prominent and accessible public notice may satisfy this requirement.
Obligation: Adverse-decision disclosure
What the employer must do: After an adverse decision, provide a plain-language explanation of the decision, describe the role the ADMT played, and explain how the individual can request additional information.
Obligation: Consumer rights
What the employer must do: Allow individuals to inspect and correct factually inaccurate personal data and, where technically feasible, request meaningful human review of an adverse decision.
Obligation: Record retention
What the employer must do: Maintain compliance records for at least three years, including model version identifiers, change logs, and documentation of any material modifications.
Note what is no longer required. SB 26-189 eliminated the prior version's mandatory risk-management program, the annual impact assessments, and the duty to self-report algorithmic discrimination to the Attorney General. Employers that started building a SB 24-205 program should reset to the lighter SB 26-189 duties.
How do you build a compliant ADMT compliance program?
The replacement law is procedural, so a defensible program is mostly inventory, notices, and records. Build it in this order:
Inventory your AI. List every tool that scores, ranks, filters, or recommends employment decisions, including features inside applicant tracking systems and HR platforms you may not label as "AI."
Classify each system. Confirm which tools are covered ADMT under the consequential-decision test.
Get documentation from vendors. Developers must give deployers technical documentation: the system's intended uses, categories of training data, known limitations, and instructions for appropriate use and human review.
Write the notices. Prepare a pre-use notice and an adverse-decision disclosure, both in plain language.
Stand up the rights process. Create a path for candidates to inspect and correct their data and to request human review.
Set retention. Keep compliance records, version identifiers, and changelogs for three years.
What disclosures do candidates and employees get?
Affected individuals receive three things under SB 26-189:
Notice of ADMT use before or near the interaction in which a consequential decision is made.
An adverse-decision disclosure after a rejection or other adverse outcome, describing the decision, the role of the ADMT, and how to ask for more information. Sources describe a roughly 30-day window for this disclosure; confirm the exact period against the enacted text.
A right to correct and appeal, meaning the chance to fix inaccurate personal data the tool relied on and to request human review, where technically feasible.
These rights resemble the disclosure-and-review direction taken by other AI hiring statutes, though they sit below the risk-management bar the EU AI Act sets.
How does the Colorado AI Act compare to other AI hiring laws?
After the rewrite, Colorado's law looks more like the targeted disclosure statutes than like the EU AI Act it once echoed. The table below sets the differences side by side.
Law: Colorado law (SB 26-189)
Scope: Covered Automated Decision-Making Technologies (ADMTs) used in consequential decisions, including the employment lifecycle.
Core requirement: Provide pre-use notice, disclose adverse decisions, offer correction and human review rights, and maintain required records.
Enforcement: Colorado Attorney General; no private right of action.
Law: NYC Local Law 144
Scope: Automated Employment Decision Tools (AEDTs) used in hiring and promotion within New York City.
Core requirement: Conduct an independent annual bias audit, publish the audit summary, and provide advance notice to candidates.
Enforcement: New York City Department of Consumer and Worker Protection (DCWP), with per-violation civil penalties.
Law: Illinois AI Video Interview Act
Scope: AI systems that analyze recorded video interviews.
Core requirement: Provide notice, obtain candidate consent, and delete interview recordings upon request where required.
Enforcement: Illinois state law.
Law: EU AI Act
Scope: AI systems used in employment that are classified as high-risk under Annex III.
Core requirement: Complete conformity assessments, implement risk management, establish human oversight, and meet governance and documentation requirements.
Enforcement: Competent authorities in EU member states.
A few anchor points for context:
NYC Local Law 144 began enforcement on July 5, 2023 and requires an independent bias audit of any automated employment decision tool, public posting of the results, and candidate notice. Penalties run from $500 to $1,500 per violation.
The Illinois Artificial Intelligence Video Interview Act took effect on January 1, 2020 and governs AI that analyzes recorded video interviews, with notice, consent, and deletion-on-request duties.
The EU AI Act classifies hiring and worker-management AI as high-risk under Annex III, triggering conformity and oversight duties for systems touching the EU market.
For a state-by-state breakdown of where these rules apply and how they differ, see our guide to AI hiring laws by state.
Does federal law still apply on top of Colorado's law?
Yes. SB 26-189 adds disclosure duties; it does not replace federal anti-discrimination law. Title VII, the ADA, and the Age Discrimination in Employment Act all apply to AI-driven decisions. The litigation risk is concrete:
Mobley v. Workday is a federal suit alleging that AI screening tools discriminated on the basis of age, race, and disability. The court let the disparate-impact claims under the ADEA and ADA proceed on an agent theory, and in May 2025 conditionally certified a nationwide ADEA collective action. That is an early signal that AI vendors and the employers using them may both face exposure.
An employer can satisfy Colorado's notice duties and still face a federal disparate-impact claim if a tool produces biased outcomes. Compliance has two layers.
What are the penalties for violating the Colorado AI Act?
Violations are treated as unfair or deceptive trade practices under Colorado law, enforced solely by the Attorney General. There is no private right of action. SB 26-189 dropped the prior version's affirmative defense tied to NIST-style risk-management programs, since those programs are no longer mandated. The compliance value now sits in clean notices, a working correction-and-review process, and the three-year records that prove you met the disclosure duties. For exact monetary penalty amounts under the current enacted text, confirm against the statute, as figures here are [stat to verify].
What is the compliance timeline?
The dates moved more than once, so confirm the current version before you plan around them.
May 2024: Governor signs SB 24-205, the original risk-based Colorado AI Act.
August 2025: SB 25B-004 delays the effective date from February 1, 2026 to June 30, 2026.
May 14, 2026: Governor signs SB 26-189, repealing and replacing SB 24-205 and resetting the effective date to January 1, 2027.
January 1, 2027: Notice, disclosure, consumer-rights, and record-retention duties take effect.
Because the framework was rewritten once and remains subject to AG rulemaking, treat any single requirement as provisional until you check the enacted statute and the rules.
Next steps checklist for employers
Use this checklist to move from awareness to compliance under SB 26-189:
Map every AI tool touching hiring, promotion, pay, or termination, including features inside your ATS and HRIS.
Classify which tools meet the covered-ADMT, consequential-decision test.
Request vendor documentation on intended uses, training-data categories, known limitations, and instructions for human review.
Draft a pre-use notice that candidates and employees see before or near the decision.
Draft an adverse-decision disclosure that explains the decision, the tool's role, and how to ask for more information.
Stand up a rights process so people can correct inaccurate data and request human review.
Set three-year record retention with version identifiers and changelogs.
Layer federal compliance by testing tools for disparate impact under Title VII, the ADA, and the ADEA.
Verify the current effective date, penalty figures, and AG rules against the enacted statute before finalizing your plan.
Frequently asked questions
When does the Colorado AI Act take effect?
The current version, SB 26-189, takes effect January 1, 2027. It replaced the original SB 24-205, whose effective date had been delayed from February 1, 2026 to June 30, 2026 before the rewrite. Because Attorney General rulemaking is still in progress, confirm the current date against the enacted statute before building your compliance calendar.
Does the Colorado AI Act apply to small businesses?
SB 26-189 includes scaled obligations, and some duties are lighter for smaller deployers. The federal anti-discrimination laws still apply regardless of headcount. Small employers using AI hiring tools should inventory and document those tools rather than assume an exemption.
Can employees sue under the Colorado AI Act?
No. The Act gives exclusive enforcement authority to the Colorado Attorney General and creates no private right of action. Workers cannot sue under the Act itself. They can still pursue claims under federal and state anti-discrimination laws, such as Title VII, the ADA, and the ADEA, which apply to AI-driven decisions.
What is the difference between a developer and a deployer?
A developer builds a covered ADMT and supplies it to others. A deployer puts that system into use. Most employers are deployers, since they buy AI hiring tools from vendors. A company that builds its own screening model and uses it can be both, carrying the duties of each role.
