Colorado Rewrites Law That Regulates Use of Artificial Intelligence in Hiring and Other Employment-Related Decision-Making

Colorado’s New AI Law Targets Employment Decisions

On May 14, 2026, Colorado Governor Jared Polis signed into law Senate Bill 26-189, an act titled “Automated Decision-Making Technology in Consequential Decisions.”  The statute substantially revises the state’s 2024 attempt to regulate the use of AI in employment-related decisions, like hiring, firing, pay, and promotions. Employers in Colorado – including those with a remote presence there – should take note of the law and prepare for similar legal requirements regulating the use of AI in hiring and employment practices that are likely on the horizon.

What the Law Covers

The new law covers various aspects of using AI, referred to in the bill as “automated decision-making technology” (or “ADMT”), whenever it is involved in “consequential decisions”—decisions that relate to an individual’s access to, eligibility for, or compensation related to employment, education, housing, financial or lending services, insurance, health-care services, or essential government services. ADMT is defined to include any technology that processes personal data and uses computation to generate output, including ranking, classifications, predictions, recommendations, scores, or other information used to make, guide, or assist a decision, judgment, or determination concerning an individual.  In other words, any AI technology that processes personal data and aids in decisions like whom to hire, promote, lay off, or fire may be covered.

New Obligations for Developers and Deployers

Under the statute, effective January 1, 2027, any company that develops ADMT must provide the entity that uses it (for example, an employer) with technical documentation describing the ADMT’s intended uses, categories of training data, known limitations, and instructions for appropriate use and human review. Developers must also notify the user—referred to in the statute as a “deployer”—of material updates or modifications to the covered ADMT. Both developers and deployers must retain records necessary to demonstrate compliance with these requirements for at least three years.

Notice and Human Review Requirements

Deployers must also provide clear and conspicuous notice to employees or applicants in Colorado that the deployer is using ADMT, along with instructions for how they may obtain information about the ADMT and its data sources. If using the ADMT results in an adverse decision, the deployer must provide the affected individual with a separate notice explaining the decision, the role of the ADMT, and how to request human review.

Enforcement and Potential Liability

The Colorado Attorney General will enforce the law through the state’s existing Consumer Protection Act, violations of which can result in fines of up to $20,000.  Before initiating an action, however, the Attorney General must provide the developer or deployer 60 days’ notice and an opportunity to cure a first alleged violation, if a cure is possible. The law does not create a private right of action, but it expressly provides that AI use can give rise to claims under the state’s Anti-Discrimination Act.  Both developers and deployers may face liability in such claims based on their relative fault.

Broader Implications Beyond Employment

The statute also governs other uses of ADMT, including in credit checks and educational assessments. Therefore, any entity doing business in Colorado should review it carefully as AI use becomes increasingly common across industries.

What Employers Should Do Now

For employers, this is particularly important.  While Colorado is one of the first jurisdictions to regulate AI in hiring and other employment decisions, it is not alone.  California and New York City have already established AI-specific requirements that employers there must follow.  And, while the federal government has been relatively passive on AI regulation, more states will surely follow.  Therefore, employers should act now to ensure compliance with the Colorado law and similar measures in other jurisdictions.

Compliance steps should include:

• Identify what AI tools human resources, hiring managers, and other decision-makers may use in making any HR-related decisions, and determine whether those tools can be used in compliance with the statute.
• Coordinate with ADMT developers to understand the information the law will require them to collect beginning January 1, 2027, including the ADMT’s intended uses, categories of training data, known limitations, and instructions for appropriate use and human review.
• Work with legal counsel to draft required notices and determine how to provide them to employees, applicants, and any others entitled to notice under the law.
• Prioritize human review and guard against bias. AI tools are new, and while states will adopt rules at varying intervals, human oversight and bias prevention in employment decisions remain essential in all jurisdictions.
• Document all compliance efforts.

For questions about how these developments may affect your organization, please contact the authors or a member of RCCB’s Employment Group.