Most of what you'll find about the Colorado AI Act describes a law that never took effect. Its impact assessments, risk management program and duty of care against algorithmic discrimination were repealed in May 2026, before any of it started. The law that replaced it asks for less paperwork and more explanation. If software helped you turn someone down, you'll have to tell them, and you'll have to be able to say how.
What is the new Colorado AI law?
SB 26-189, Colorado's Automated Decision-Making Technology Act, says that if software helps decide whether someone in Colorado gets a job, a home, credit, insurance, healthcare, an education or government benefits, the business using it must tell them first, explain any rejection within 30 days, and let them correct their data and ask a person to look again. It takes effect in January 2027. For most mid-sized companies it comes down to one place: hiring.
This guide is for the people who'll have to make it work, in HR, operations and IT. It's based on the signed act and the attorney general's draft rules. It isn't legal advice.
What happened to the Colorado AI Act?
Colorado passed the first broad state AI law in 2024. SB 24-205, the Colorado AI Act, was due to start on 1 February 2026 and was then pushed back to 30 June 2026. In April 2026 xAI sued in federal court to block it, and the US Justice Department joined the case. On 27 April the court approved an agreement that froze enforcement. In May the legislature repealed the act and passed SB 26-189 in its place, and Governor Polis signed it on 14 May. It applies to decisions made from January 2027.
| Colorado AI Act (SB 24-205) | New law (SB 26-189) | |
|---|---|---|
| Status | Repealed before it took effect | Takes effect January 2027 |
| What's covered | "High-risk" AI systems that make, or are a "substantial factor" in making, a consequential decision | Any technology that "materially influences" a consequential decision |
| Duty to prevent algorithmic discrimination | Yes, "reasonable care" | No new duty. Existing anti-discrimination law applies, with fault split between you and your vendor |
| Risk management program and impact assessments | Required | Not required |
| Small-business exemption | Partial, for some deployers with fewer than 50 employees | None |
| Notice before use | Required | Required |
| Explanation after a rejection | Required | Required, within 30 days |
| Correction and human review | Correction, and an appeal with human review where technically feasible | Correction, and human review "to the extent commercially reasonable" |
| Enforcement | Attorney general | Attorney general only, with a 60-day cure period until 2030 |
Does it apply to you?
Three questions decide it.
Do you do business in Colorado? The law applies to any person "doing business in Colorado" that uses a covered tool, and there's no size threshold. It protects Colorado residents, and it names your employees, job applicants who live in Colorado, and anyone whose opportunity in Colorado is being evaluated. If you employ or recruit people in Colorado, assume you're in scope.
Is the decision consequential? Seven areas count: employment, education, housing, financial and lending services, insurance, healthcare, and government services and benefits. In each one, a decision is consequential when it affects someone's access, eligibility or selection, their pay, or the price or terms they're offered. In employment that means hiring, pay, promotion and termination. It doesn't cover hiring contractors, because the law only reaches work that creates, or may create, an employer–employee relationship. Routine scheduling, workflow management, customer-service triage, advertising and marketing are carved out.
Does a tool "materially influence" it? The tool's output has to be "a non-de minimis factor" in the decision, and it has to affect the outcome, "including by constraining, ranking, scoring, recommending, classifying, or otherwise meaningfully altering how a consequential decision is made." Incidental, trivial and clerical uses don't count. It isn't only AI, either. Any technology that processes personal data to produce a score, ranking, recommendation or classification about a person can qualify, so a rules-based scoring system can be covered too.
For hiring, the line is between summarising and ranking
The law carves out "actions in which an ADMT is used to summarize, organize, or present information for human review", as long as the system doesn't produce "a score, ranking, recommendation, classification, prediction, or other inference that materially influences an outcome or a decision." That gives you a working test.
Likely covered:
- Your applicant tracking system ranks, scores or "matches" applicants, and recruiters work from that list.
- An assessment or video-interview platform scores candidates.
- A recruiter pastes CVs into a chatbot and asks it who to shortlist.
- A performance tool's scores feed decisions about promotion or pay.
Not covered:
- AI summarises each application without scoring or ranking it, and a person reads them all and decides.
- AI drafts the job ad, the interview questions or the rejection email.
- AI schedules the interviews.
General-purpose chatbots get a narrower exemption than most people assume. The law excludes them only if nobody has configured or intended them for consequential decisions and they're subject to an acceptable use policy that forbids that use. A recruiter who asks one to rank applicants fails the first test. Put the rule in writing: your AI usage policy should say that chatbot output isn't used to decide who gets hired, promoted or let go.
A few sectors are largely carved out: insurers already covered by Colorado's insurance rules on algorithms, FDA-regulated medical devices, and HIPAA covered entities. Lenders can rely on their federal adverse action notices if those notices also carry what Colorado requires. Two of those carve-outs stop at the HR department. HIPAA covered entities are exempt except for employment decisions, and insurers' own hiring is still covered.
What the law requires
The law calls a business that uses a covered tool a deployer, and gives it four duties.
1. Tell people before you use it
Before a covered tool influences a decision, you must give "clear and conspicuous notice" that you use or will use it in a consequential decision about them, with instructions for getting more information. A prominent public notice counts, as long as it's reasonably accessible where people deal with you, for example through a link next to the application. For hiring, that means your careers page and your application form, before anyone applies.
2. Explain every adverse outcome within 30 days
If the tool materially influenced a decision that went against someone, you must give them, within 30 days:
- a plain-language description of the decision and the role the tool played in it;
- a simple way to get more information, including the tool's name, version and developer, and the types, categories and sources of personal data it used;
- an explanation of their rights and how to use them.
An adverse outcome includes not being selected. In a busy hiring funnel, that's most applicants. The attorney general's own draft rules give an example: an employer uses a tool to pick 10 of 87 applicants for interview, and owes the other 77 an explanation. (In that example the employer meets the duty through the adverse action notices it already sends under federal credit-reporting law.)
3. Let people correct their data and ask for a person to review
After an adverse outcome, a person can ask you for instructions to get and correct "factually incorrect or materially inaccurate" personal data used in the decision. They can also ask for "an opportunity for meaningful human review and reconsideration of the consequential decision, to the extent commercially reasonable." You don't have to correct opinions, predictions, scores or protected evaluations.
The law defines meaningful human review closely. The reviewer is someone you designate, with authority to approve, modify or override the decision, who:
- considers relevant, available primary evidence;
- is trained to conduct the review;
- does not default to the system output;
- has enough information to understand the output's intended use, material limitations and categories of inputs, and the principal factors used to generate it.
4. Keep records for three years
Keep "records reasonably necessary to demonstrate compliance" for at least three years after each decision. The law's examples are the tool's version identifiers, changelogs, and documentation of changes made to reduce risk.
All of these notices must be reasonably accessible to people with disabilities and people with limited English. You don't have to reveal trade secrets, but if you hold information back, you must tell the person.
What your vendor owes you
From January 2027, a developer whose tool is marketed, configured or contracted for consequential decisions must give you its intended uses and known harmful uses, the categories of data it was trained on, its known limitations and risks (including when not to use it), instructions for use, monitoring and meaningful human review, and the information you need for your own notices. It must tell you about material updates within a reasonable time, and keep its own records for three years.
Two contract points matter:
- In a discrimination claim over a decision the tool influenced, fault is split between you and the vendor according to each one's share of it. The vendor is only liable for uses it intended, documented, marketed or contracted for.
- A clause that shields either party from liability for its own discriminatory acts under Colorado law is void. You can't contract out of your own share.
If you build your own screening tool and only use it internally, you're a deployer, not a developer, and the deployer duties still apply in full.
What the attorney general's draft rules would add
The attorney general filed draft rules on 11 August 2026. They aren't final. The public hearing is on 26 October, written comments close the same day, and the law requires final rules on explanations and consumer rights by the time it starts in January. The draft asks for a good deal more than the statute does. These are the parts an employer should plan for, on the assumption that some will change:
- A presumption that the tool counted. Suppose a tool narrows the options, sets a threshold, or produces a rank, score, classification, recommendation or prediction about the person. If the decision-maker sees it (or it screens what they see), and the decision matches it, the tool is presumed to have materially influenced the decision. You can rebut that with evidence of independent judgment. One version of the draft gives examples: a decision recorded before the output was available, or a documented cut-off applied the same way every time.
- Two tests for "de minimis". The draft asks the public to choose between them. Under the stricter one, a factor is de minimis only if its impact is "trifling, trivial, or incidental", and it isn't trivial just because other factors mattered more. Under the looser one, it can be de minimis if other factors "played a significantly larger role".
- Specific reasons. Rejection notices would have to give the principal reasons "with specificity". Saying the decision followed "internal standards or policies" isn't enough. If a score was a principal reason, you'd disclose the person's score. Automatic-rejection factors would have to be named. A deployer that can't explain how the tool influenced the decision wouldn't comply.
- Two channels and a link. Notices would go out in writing through at least two channels where you have them, such as email and post. They'd include a clearly labelled link to a form for exercising rights, plus a phone number or postal address.
- Deadlines. You'd answer data and correction requests within 45 days. You'd acknowledge a human-review request within 10 days, finish it within 45, and hold the adverse outcome during the review where possible.
- Independent, protected reviewers. Where feasible, the reviewer shouldn't be the person who made the decision or report to them. Reviewers would need training in accuracy and objectivity, in what the tool considers, and in the subject matter. They'd be shielded from management steering and retaliation, and AI couldn't assist in the review. Each review would leave a record: who reviewed, their authority and training, timestamps, the evidence, the outcome and a written justification.
- Vendors and staffing agencies. The attorney general has asked whether the rules should say who carries the deployer duties when a vendor or staffing agency runs the tool. If you hire through an agency that screens with AI, watch this one.
Meaningful human review is a job description
Read the law's definition again. It describes a person, not a step in a workflow: someone with the authority to overturn the decision, the training to do it, the evidence in front of them, and an understanding of what the tool can't do. A recruiter who approves a ranked list without looking past it isn't that person. Under the draft rules, that recruiter is also exactly how a tool gets presumed to have influenced the decision.
Our framework holds every high-stakes use of AI to the same standard: the checker must have the time, the information and the authority to reject it. Shared and stakes, in module 6 of our free course, uses a recruiter ranking CVs as its example of a high-stakes use that nobody built, and shows how to name the check for each use like it. Colorado's definition leaves out the time. You'll need it anyway: under the draft rules, a review has 45 days.
What to do before January
There are six steps, in order. Each one produces what the next one needs.
01 · Find every tool that touches a decision about a person
Don't stop at the tools you bought as AI. Check your applicant tracking system's ranking and matching features, assessment and video-interview platforms, background-screening scores and performance-management tools. Then check what vendors have switched on inside software you already pay for, and ask recruiters and managers what they use chatbots for. The free Shadow AI Audit covers those built-in features. Your AI list, in module 3 of our course, turns what you find into a list with an owner on every row.
02 · Sort each use: does it summarise, or does it rank?
For each tool, ask whether it produces a score, ranking, recommendation or classification about a person that someone sees before deciding. If it does, treat it as covered until the final rules say otherwise. If it only summarises, drafts or schedules, write down why, so you can show your reasoning later.
03 · Ask your vendors for their documentation now
Ask each vendor of a covered tool for the documentation they'll owe you from January. That's their intended uses, known harmful uses, training-data categories and known limitations, instructions for monitoring and human review, and the details your notices need: the tool's name, version and data sources. If a vendor can't tell you how its tool reaches a score, you won't be able to explain a rejection either. While you're there, check your contracts for indemnities the new law makes void.
04 · Write the two notices
The notice before use goes on your careers page and application form. The adverse-outcome notice is a template covering the decision, the tool's role, the principal reasons, a link to more information and the person's rights. Write both in plain language, make them accessible, and have counsel review them once the final rules are out.
05 · Name and train your reviewers
For each covered use, name who reviews a contested decision. Give them the authority to overturn it, training in what the tool does and doesn't consider, and access to the evidence. Where you can, pick someone outside the original decision-maker's reporting line.
06 · Set up the records
Keep three years of everything: tool versions and changelogs, the notices you sent, the requests you received, and every review and its outcome. Give each covered tool an owner, a backup and a review date, and recheck it whenever the vendor ships an update. Module 7 of our course, Own what runs, sets up the owners, backups and review dates.
What's still open
- The final rules. The hearing is on 26 October, and the rules are due when the law starts in January. Expect the draft described above to change.
- Which "de minimis" test wins. It decides how many tools are in scope.
- Who answers for vendors and staffing agencies. The attorney general is still asking.
- Federal pressure. The lawsuit against the old law was expected to extend to the new one, and Congress has debated overriding state AI laws. Neither has stopped SB 26-189: as of this update, it takes effect in January.
We'll update this article when the rules are final. The date at the top of the page shows when we last checked.
Sources
- SB 26-189, Colorado General Assembly: the bill page, with the signed act and fiscal notes.
- Automated Decision-Making Technology and Chatbot Safety rulemaking, Colorado Attorney General: the draft rules filed on 11 August 2026, the notice of hearing and the comment portal.
- C.R.S. § 6-1-112: civil penalties under the Colorado Consumer Protection Act.
- Colorado AI law in flux, McDermott, May 2026: the federal lawsuit and the replacement bill.