Colorado AI Act for Employers: What SB 26-189 Requires From 2027

The Colorado AI Act that employers spent two years preparing for no longer exists. Senate Bill 26-189, signed May 14, 2026, repealed and re-enacted the 2024 law as a narrower set of duties for anyone who uses automated decision-making technology to materially influence a decision about hiring, promotion, pay or dismissal in Colorado. The new duties apply to decisions made on or after January 1, 2027. There is no impact assessment, no risk management program, no small-employer exemption and no NIST safe harbor. There is a notice duty, a 30-day explanation duty after an adverse outcome, a right to correct data and to meaningful human review, and a three-year record-keeping rule.

Most of the pages that rank for this topic were written for the repealed law. Several still give June 30, 2026 as the effective date, one law firm alert gives an impossible signing date, and none quotes the enacted sections or the Attorney General's draft rules released October 6, 2026. This guide is built from the enacted session law, Colorado Session Laws 2026 chapter 131, with section numbers so your counsel can check each claim.

How the law got here

Three provisions took effect on signing: the ones that direct the Attorney General to write rules. Everything that binds an employer starts on January 1, 2027.

Who and what the law covers

The law uses four defined terms, and whether it applies to you turns on all four.

Automated decision-making technology (section 6-1-1701(2)) is technology that processes personal data and uses computation to generate output, including predictions, recommendations, classifications, rankings, scores or other information that is used to make, guide or assist a decision. It is not limited to artificial intelligence. A regression model in a spreadsheet qualifies if it scores people. The definition excludes calculators and databases, spreadsheets that need manual analysis and do not use machine learning or large language models, tools used to summarize, organize or present information for human review without producing a score or recommendation that materially influences the outcome, narrow procedural tasks, and cybersecurity and fraud controls.

Covered ADMT (section 6-1-1701(5)) is automated decision-making technology "used to materially influence a consequential decision". Materially influence (section 6-1-1701(13)) means the output is a non-de minimis factor in the decision and affects its outcome, "including by constraining, ranking, scoring, recommending, classifying, or otherwise meaningfully altering how a consequential decision is made". Incidental, trivial or clerical uses do not count.

Consequential decision (section 6-1-1701(3)) is a decision about a consumer's access to, eligibility for, selection for or compensation for a covered domain, and employment or an employment opportunity that creates or may create an employer-employee relationship is a covered domain under section 6-1-1701(6)(b). Routine scheduling, administrative routing and workflow management are excluded.

Consumer (section 6-1-1701(4)(b)) "includes an employee, a job applicant who is a Colorado resident, and any individual whose access to, eligibility for, or opportunity in Colorado is evaluated in a consequential decision by a person doing business in Colorado". A deployer is a person doing business in Colorado that deploys a covered ADMT. There is no headcount threshold.

In plain terms: if your company does business in Colorado and a tool scores, ranks, recommends or filters candidates or employees for hiring, promotion, pay or termination, and a human relies on that output in a way that affects the result, you are a deployer from January 1, 2027. A tool that transcribes interviews or summarizes a CV for a recruiter to read is outside the law as long as it produces no score or recommendation. Productivity analytics that feed a performance rating or a layoff list are inside it.

The five duties on employers

1. Notice before use (section 6-1-1704(1) and (2))

Before a covered ADMT is used to materially influence a decision, the deployer gives the consumer "clear and conspicuous notice" that a covered ADMT was or will be used and instructions for getting more information. A deployer complies by maintaining "a prominent public notice that is reasonably accessible at points of consumer interaction, including through a link or posting that is reasonably proximate to the interaction". For hiring, that means a notice on the application page. For promotion or performance decisions, it means a notice where employees interact with the process.

2. Explanation within 30 days of an adverse outcome (section 6-1-1704(3))

If the decision results in an adverse outcome, the deployer must provide, within thirty days after making the decision: a plain-language description of the decision and the role the ADMT played; instructions and "a simple-to-follow process" to request more information, including the tool's name, version, developer and the types, categories and sources of personal data used; and an explanation of the consumer's rights under section 6-1-1705. "Adverse outcome" means a decision that denies, terminates, revokes or materially reduces access, eligibility, selection or compensation, so a rejection, a non-promotion, a pay cut and a dismissal all qualify. Trade secrets need not be disclosed, but the consumer must be told information was withheld. Notices must be accessible to people with disabilities and limited English proficiency.

3. Correction and meaningful human review on request (section 6-1-1705)

After an adverse outcome, a consumer who asks must be given instructions for requesting their personal data and correcting factually incorrect or materially inaccurate data, and "an opportunity for meaningful human review and reconsideration" to the extent commercially reasonable. There is no duty to correct opinions, predictions or scores. Meaningful human review (section 6-1-1701(15)) is review by an individual the deployer designates, who has authority to approve, modify or override the decision, who considers the relevant primary evidence and who does not default to the system output. A recruiter who clicks "confirm" on a ranked list does not meet that definition.

4. Records for three years (section 6-1-1703)

Deployers keep records reasonably necessary to show compliance for not less than three years after the date of each consequential decision, including tool version identifiers, change logs and documentation of material mitigation changes.

5. No indemnity for your own discrimination (section 6-1-1707(7))

A contract term under which one party indemnifies another for that party's own violations of anti-discrimination law is void. A vendor cannot sell you a clause that makes it carry your liability, and you cannot push yours onto the vendor, with a narrow carve-out where you used the tool outside its documented purpose.

What your vendor must give you

From January 1, 2027, a developer that sells a covered ADMT must make available (section 6-1-1702) documentation of its intended and known harmful uses, the categories of training data, known limitations, instructions for appropriate use, monitoring and human review, and the information the deployer needs to write its own notices. The developer must notify deployers of material updates within a reasonable time and keep its own records for three years. Ask for this package in the contract now; your 30-day explanations depend on it, and the statute only obliges you to disclose what the developer gave you.

Enforcement, penalties and lawsuits

The Attorney General enforces the law exclusively (section 6-1-1706). A violation is a deceptive trade practice under the Colorado Consumer Protection Act, whose civil penalties are set in section 6-1-112 rather than in the AI law itself; law firm summaries put the maximum at $20,000 per violation, a figure we have not verified against the current statute. Before any enforcement action the Attorney General must issue a notice of violation if a cure is deemed possible, and the deployer has sixty days to cure. No cure period is required for knowing or repeated violations. The cure provision is repealed on January 1, 2030. From January 2028 the Attorney General reports annually on actions brought and cure periods offered.

"Nothing in this part 17 creates a new private right of action" (sections 6-1-1706(4) and 6-1-1709(1)). Employees and applicants cannot sue under this law. But the same sections preserve every existing right, including claims under the Colorado Anti-Discrimination Act, and section 6-1-1707(1) says a deployer or developer may be liable in a discrimination action arising from a decision materially influenced by a covered ADMT, with fault allocated between them. Compliance with the AI law "does not constitute a defense to and does not excuse noncompliance with any applicable law" (section 6-1-1709(2)).

What the 2024 law required that is now gone

If your compliance plan was written before May 2026, strike these items. None appears in the re-enacted part 17.

• The "high-risk artificial intelligence system" concept and the developer and deployer duty of reasonable care to avoid algorithmic discrimination.
• Impact assessments before deployment and annually.
• A written risk management policy and program.
• The public statement on the deployer's website describing its high-risk systems.
• Notice to the Attorney General within 90 days of discovering algorithmic discrimination.
• The exemption for deployers with fewer than 50 employees.
• The affirmative defense for following the NIST AI Risk Management Framework or ISO/IEC 42001.
• The rebuttable presumption of reasonable care.

The only remaining exemptions (section 6-1-1708) cover HIPAA covered entities, insurers, certain federally regulated entities and FDA-regulated devices, and the HIPAA exemption does not apply to employment decisions. A hospital is exempt for patient decisions and covered for hiring ones.

Compliance checklist with dates

1. By October 26, 2026: read the Attorney General's interim draft rules and comment if the "materially influence" presumptions affect you. According to law firm summaries of the draft, an internal promotion decision where a tool produced a score is presumed materially influenced unless the manager can show independent review, and a staffing agency's tool output that feeds a client's hiring decision makes the client the deployer. We have not read the draft text and those details may change.
2. Now: inventory every tool in hiring, promotion, pay and termination. For each, answer one question: does it produce a score, rank, recommendation, classification or filter that a person relies on? If yes, it is covered. Include the AI features inside your applicant tracking and HR systems, not only standalone products.
3. Now: write the section 6-1-1702 documentation request into vendor contracts and renewals, and delete any clause that indemnifies either party for its own discrimination.
4. By December 2026: draft the pre-use notice and place it on application pages, internal job boards and performance review portals. Draft the 30-day adverse-outcome letter as a template with blanks for the decision, the tool's role and the request process.
5. By December 2026: designate and train the human reviewers. The statute requires authority to override and consideration of primary evidence. Document the training.
6. From January 1, 2027: log every covered decision with the tool version, the notice given, the outcome, any adverse-outcome letter and any review request. Retain for three years.
7. Ongoing: keep your bias testing. Colorado no longer requires it, but New York City does, California's regulations make it relevant to a defense, and Title VII disparate impact liability has not changed. Our AI use policy template has a section for employment decisions that fits this law.

How it fits with other state laws

Colorado is now the notice-and-review state rather than the audit state. New York City's Local Law 144 requires an independent bias audit within a year before use and notice 10 business days ahead. Illinois HB 3773, in force since January 1, 2026, prohibits AI use with a discriminatory effect and requires notice. California's Civil Rights Council regulations, in force since October 1, 2025, make the vendor the employer's agent and require four years of records. Texas prohibits AI developed or used with intent to discriminate. A multistate employer that already audits for New York City and keeps California's records will find Colorado's duties mostly additive: the public notice, the 30-day letter and the designated reviewer. Our AI hiring laws by state table compares all of them.

Key takeaways

• Colorado's 2024 AI Act was repealed and re-enacted as SB 26-189, signed May 14, 2026. The new law applies to consequential decisions made on or after January 1, 2027.
• It covers any 'automated decision-making technology', not only AI, that materially influences a decision about hiring, promotion, pay or termination for anyone doing business in Colorado. There is no headcount threshold.
• Employers must give clear notice before use, a plain-language explanation within 30 days of an adverse outcome, data correction and meaningful human review on request, and keep records for three years.
• Meaningful human review means a designated person with authority to override who considers primary evidence and does not default to the system output.
• Impact assessments, risk management programs, the under-50-employee exemption and the NIST and ISO affirmative defense are all gone.
• The Attorney General enforces exclusively under the Consumer Protection Act, with a 60-day cure period until 2030. There is no private right of action, but existing discrimination claims are preserved and compliance is no defense.
• Vendors must supply documentation of intended uses, training data categories, limitations and update notices from January 1, 2027; indemnity for one's own discrimination is void.
• The Attorney General's interim draft rules were released October 6, 2026 with comments due October 26, 2026; final rules are due January 1, 2027.