Colorado passed a broad law on AI used in consequential decisions, including hiring, in 2024. Two years later it rewrote that law before it took effect. If you hire in Colorado, or hire Colorado residents into remote roles, the version that matters is SB 26-189, and its obligations start on 1 January 2027.
This guide explains what changed, who the new law covers, what it asks of employers that use AI in hiring, and what to do before January. It is a plain-English explainer for talent teams, not legal advice. Confirm the detail for your own tools with counsel, and check the Attorney General's rules when they are published.
What is the Colorado AI Act?
The Colorado AI Act was SB 24-205, signed on 17 May 2024. It placed duties on developers and deployers of "high-risk" AI systems used in consequential decisions such as employment, and was due to apply from 1 February 2026. It has now been repealed and re-enacted as SB 26-189, a narrower law on automated decision-making technology (ADMT).
The 2024 Act would have required deployers, which includes employers using AI hiring tools, to:
- use reasonable care to protect people from algorithmic discrimination
- run a risk-management policy and programme for each high-risk system
- complete impact assessments and review each system every year
- publish a statement on their website about the systems they use
- tell the Attorney General within 90 days if they discovered algorithmic discrimination
Deployers with fewer than 50 full-time equivalent employees that did not train the system on their own data were exempt from some of these duties, subject to conditions. None of this will now apply.
Was the Colorado AI Act delayed?
Yes, and then replaced. In a special session in August 2025, the legislature passed SB 25B-004, which pushed the Act's requirements from 1 February 2026 to 30 June 2026. On 14 May 2026, Governor Polis signed SB 26-189, which repeals and re-enacts the AI provisions. Law firm Eckert Seamans describes the original law as replaced before either version became operative.
| Date | What happened |
|---|---|
| 17 May 2024 | SB 24-205, the Colorado AI Act, signed. Duties due from 1 February 2026 |
| 28 August 2025 | SB 25B-004 signed, delaying the duties to 30 June 2026 |
| 27 April 2026 | A federal court orders the Attorney General not to begin enforcing SB 24-205 or legislation amending it until rulemaking is complete and the court rules in X.AI LLC v. Weiser |
| 14 May 2026 | SB 26-189 signed, repealing and re-enacting the law |
| 1 January 2027 | SB 26-189 takes effect for consequential decisions made on or after this date |
| 1 January 2030 | The Attorney General's duty to offer a 60-day cure period ends |
The court order is recorded in the legislature's final fiscal note for SB 26-189, dated 8 September 2026. It could delay enforcement of the new law beyond January. Do not plan around a pause, though: the obligations still take effect on 1 January 2027, and a later ruling or rule could lift it.
Reviewing the tools in your hiring process?
Cohesyve takes a job description, finds candidates, reaches out to them and runs an AI job simulation of the real work, then returns a ranked shortlist. If you are looking at tools, it is one to consider.
What changed between SB 24-205 and SB 26-189?
SB 26-189 drops the 2024 Act's risk-management machinery and keeps a lighter set of disclosure duties and candidate rights. For most employers that means less paperwork and more candidate-facing process.
| Requirement | SB 24-205 (2024 Act, repealed) | SB 26-189 (from 1 January 2027) |
|---|---|---|
| What it regulates | "High-risk" AI systems | Automated decision-making technology that materially influences a consequential decision |
| Duty of care against algorithmic discrimination | Yes | Removed |
| Risk-management programme | Yes | Removed |
| Impact assessments | Yes, plus annual review | Removed |
| Notice before use | Yes | Yes, clear and conspicuous; a prominent public notice can satisfy it |
| Explanation after a rejection | Yes | Yes, within 30 days of the decision |
| Correct inaccurate personal data | Yes | Yes |
| Human review | Appeal with human review if technically feasible | Meaningful human review and reconsideration, to the extent commercially reasonable |
| Small-employer exemption | Partial, under 50 FTE with conditions | None in the act text |
| Enforcement | Attorney General | Attorney General only; no new private right of action |
Holland & Knight points out one way the new law reaches further: its definition of ADMT is broad enough to catch some tools that sat outside the 2024 Act. Do not assume a tool your legal team cleared in 2025 is still out of scope.
Who does SB 26-189 cover?
It covers any person doing business in Colorado that deploys a covered ADMT in a consequential decision, and employment is one of the seven covered domains. The people it protects are called consumers, a term the law extends to employees, job applicants who are Colorado residents, and anyone whose opportunity in Colorado is evaluated by a business operating there.
In practice, a hiring decision is in scope when three things are true:
- The tool is ADMT. It processes personal data and uses computation to produce an output such as a score, ranking, recommendation, classification or prediction that is used in a decision about a person.
- The decision is consequential. It relates to access to, selection for or pay for employment that creates an employer-employee relationship.
- The tool materially influences the decision. Its output is a non-trivial factor and affects the outcome, including by ranking, scoring, recommending or classifying candidates.
The law excludes tools used by a person solely to summarise, organise, translate, draft, route or present information for human review. It also excludes routine scheduling, administrative routing and the communication of decisions. A chatbot that answers candidates' questions is excluded only if it is not intended or configured for use in hiring decisions and its acceptable-use policy forbids that use.
The act contains no employee-count threshold. HIPAA-covered healthcare organisations get a broad exemption, but it does not extend to their employment decisions.
Which hiring tools are likely to be covered?
Anything that scores, ranks or filters candidates in a way that changes who moves forward is likely covered. Tools that help a recruiter read or organise information without producing a judgement are likely outside it. The Attorney General can write rules on what "materially influence" means, so treat this as a starting point.
| Tool | Likely status | Why |
|---|---|---|
| CV screening that ranks or auto-rejects applicants | Likely covered | Produces a ranking or classification that affects who advances |
| Scored assessments or job simulations used to shortlist | Likely covered | The score is a factor in selection |
| Video interview tool that scores responses | Likely covered | Produces a score used in the decision |
| Candidate matching or "fit" scores in an ATS | Likely covered if recruiters act on them | A recommendation that shapes the shortlist |
| AI that summarises CVs or interview notes, with no score | Likely excluded | Summarises information for human review |
| Interview scheduling assistant | Likely excluded | Routine scheduling |
| Careers-site chatbot answering FAQs | Likely excluded, if not used in decisions | Covered only if intended or configured for hiring decisions |
| AI writing tool for job descriptions or rejection emails | Likely excluded | Drafting, and communicating decisions |
What does SB 26-189 require employers to do?
Employers that use covered ADMT in hiring must give notice before use, explain adverse outcomes within 30 days, honour correction and review requests, and keep records. Each duty is set out below.
Notice before use. Before the tool materially influences a decision, tell the candidate that you used or will use automated decision-making technology in a decision affecting them, and how to get more information. A prominent public notice that is reasonably accessible where candidates interact with you satisfies this, for example a linked notice on the job posting or application page.
Explanation after a rejection. If the tool materially influenced a decision with an adverse outcome, such as a rejection, provide within 30 days of the decision:
- a plain-language description of the decision and the role the tool played in it
- a simple way to request more information, including the tool's name, version where relevant, its developer, and the types, categories and sources of personal data used, to the extent the vendor has given you that information
- an explanation of the candidate's rights and how to exercise them
The Attorney General must adopt rules on these disclosures by 1 January 2027. Draft your templates now and adjust them when the rules arrive.
Correction of data. After an adverse outcome, a candidate can ask for their personal data and to correct factually incorrect or materially inaccurate data the tool used. The right does not extend to opinions, predictions, scores or protected evaluations, so a candidate cannot demand that you change an assessment score.
Human review and reconsideration. On request after an adverse outcome, offer meaningful human review and reconsideration, to the extent commercially reasonable. The law sets a standard for the reviewer. They must be designated by you, trained, able to approve, change or override the decision, consider the relevant, available primary evidence, and not default to the tool's output. They need enough information to understand the output's intended use, limitations, input categories and principal factors, though not source code or trade secrets.
Records. Keep records showing compliance for at least three years after each decision.
Accessibility. Notices and disclosures must be reasonably accessible to people with disabilities and to people with limited English proficiency.
Trade secrets. You do not have to disclose trade secrets, but if you withhold information on that basis you must tell the candidate.
What do AI hiring vendors have to provide?
From 1 January 2027, developers of tools marketed or sold for consequential decisions must give each deployer documentation covering intended uses and known harmful uses, the categories of training data, known limitations and risks, instructions for appropriate use, monitoring and human review, and the information you need to make your own disclosures. They must also notify you of material updates within a reasonable time and keep their own records for three years.
Two contract points matter for procurement. Fault in a discrimination claim is split between employer and vendor according to relative fault. And a clause that indemnifies either party for its own discriminatory acts using ADMT is void. Review your AI vendor agreements before renewal. Our guide on how to choose a pre-employment assessment platform includes the compliance questions to put to vendors.
Cohesyve, which publishes this guide, is one of these vendors. A company gives Cohesyve a job description, and Cohesyve sources candidates, runs outreach, puts candidates through AI job simulations of the real work and returns a ranked shortlist. A ranked shortlist is the kind of output this law covers, so if you use it for Colorado roles, give candidates notice, keep a trained person reviewing the shortlist, and ask us for the developer documentation the law requires.
How is the Colorado AI law enforced?
Only the Colorado Attorney General can enforce it. A violation is a deceptive trade practice under the Colorado Consumer Protection Act, and the legislature's fiscal note puts the civil penalty under that Act at up to $20,000 per violation. Candidates cannot sue under SB 26-189 itself.
Until 1 January 2030, the Attorney General must send a notice of violation and allow 60 days to cure before acting, where the Attorney General considers a cure possible. The fiscal note says that a cured violation cannot attract civil penalties. Knowing or repeated violations get no cure period.
The law does not reduce any existing right. Candidates can still bring discrimination claims under the Colorado Anti-Discrimination Act and federal law, and complying with SB 26-189 is not a defence to them. Our guide to AI hiring laws in 2026 covers those and the rules in New York City, Illinois and the EU.
What should employers do before 1 January 2027?
Start with an inventory, then build the candidate-facing process. This checklist covers the duties in the act text.
| Step | What to do | Owner |
|---|---|---|
| 1. Inventory | List every tool that touches a hiring decision, including AI features inside your ATS, and what it outputs | TA ops |
| 2. Classify | Mark each as likely covered (scores, ranks, filters) or likely excluded (summarises, schedules, drafts) | TA ops with legal |
| 3. Map candidates | Identify roles based in Colorado and applicants who are Colorado residents, including for remote roles | TA ops |
| 4. Vendor documentation | Ask each covered vendor for its SB 26-189 documentation and update notices; check indemnity clauses | Procurement and legal |
| 5. Notice | Publish a clear notice and link it from Colorado job postings and application pages | Employer brand |
| 6. Rejection disclosure | Build a 30-day disclosure template and trigger it from the ATS on adverse outcomes | TA ops |
| 7. Requests | Set up a route for data access, correction and human review requests, with response owners | TA ops |
| 8. Reviewers | Designate and train reviewers with authority to override, and give them the vendor's documentation | Hiring managers |
| 9. Records | Retain notices, disclosures, tool versions and review outcomes for at least three years | HR systems |
| 10. Rules | Check the Attorney General's rules and the status of the federal case before January, then adjust | Legal |
The human review step is easier when your process already produces evidence a reviewer can check. A structured interview scored against a written scoring rubric gives a reviewer something concrete to weigh against the tool's output. Our interview scorecard is a quick way to start.
Common questions
Is the Colorado AI Act in effect? The 2024 Act (SB 24-205) never became operative and has been replaced. Its successor, SB 26-189, applies to consequential decisions made on or after 1 January 2027.
What is SB 26-189? It is the 2026 Colorado law on automated decision-making technology in consequential decisions, signed on 14 May 2026. It repeals and re-enacts the AI provisions of SB 24-205 with notice, explanation, correction, human review and record-keeping duties.
Does the Colorado AI law apply to employers outside Colorado? It applies to any person doing business in Colorado. Its protections cover employees, job applicants who are Colorado residents, and people evaluated for opportunities in Colorado. A company headquartered elsewhere that hires Colorado residents for remote roles should assume it may be covered.
Is there a small-business exemption? The text of SB 26-189 contains no employee-count exemption. The 2024 Act had a partial one for deployers with fewer than 50 full-time equivalent employees, but that law has been repealed.
Do I still need an impact assessment or bias audit for Colorado? SB 26-189 removed the impact-assessment requirement. You may still need a bias audit for other reasons, such as New York City's Local Law 144, and checking your tools for adverse impact still helps you defend against discrimination claims. Our piece on unconscious bias in recruitment covers where bias enters the hiring process.
Will enforcement be paused after January 2027? Possibly. A federal court order of 27 April 2026 bars the Attorney General from starting enforcement until rulemaking is complete and the court rules in X.AI LLC v. Weiser, according to the legislature's fiscal note. That position can change, so prepare to comply from 1 January 2027.