Colorado's AI Hiring Law: What SB 26-189 Actually Requires
8 min read · Last reviewed 1 Aug 2026
General information, not legal advice. Laws in this area change; verify against the official sources at the end of this guide and confirm specifics with employment counsel.
Colorado made history twice. In 2024 it passed the first comprehensive state AI law in the country (SB 24-205, the Colorado AI Act), and in May 2026 it repealed that law before it ever took effect, reenacting a much narrower statute in its place: SB 26-189, an automated-decision-making technology (ADMT) law effective January 1, 2027.
That sequence matters, because most of what has been written about "the Colorado AI Act" describes the repealed version: high-risk AI systems, risk-management programs, impact assessments, a duty of reasonable care, and an under-50-employee exemption. None of that survived. This guide covers what is actually on the books for an employer screening Colorado candidates: lighter duties, no size exemption, and a 2027 start date. General information, not legal advice, and this statute has now changed three times, so verify the current text before relying on details.
From the AI Act to the ADMT law: what happened
The original Colorado AI Act (SB 24-205, signed May 2024) built a heavyweight framework around high-risk AI systems: deployers owed reasonable care against algorithmic discrimination, larger deployers owed risk-management programs aligned with the NIST AI Risk Management Framework, annual impact assessments, and public statements, and deployers under 50 full-time equivalents got a conditional exemption from the paperwork.
It never operated a day. The effective date slipped from February 1, 2026 to June 30, 2026 in an August 2025 special session, and on May 14, 2026 the governor signed SB 26-189, which repeals and reenacts the whole thing as a consumer-protection statute about automated decision-making technology, effective January 1, 2027.
The practical consequences for an employer: nothing Colorado-specific applies to AI screening today; the duties that arrive in 2027 are narrower and candidate-facing; and the terminology shifted from "high-risk artificial intelligence system" to "automated decision-making technology" used in "consequential decisions," a list that includes employment. Anything you read about Colorado AI compliance dated before mid-2026 is describing the repealed regime.
Who the new law covers
SB 26-189 regulates deployers (anyone doing business in Colorado who uses ADMT in consequential decisions about consumers, which includes job candidates) and developers (who build or substantially modify the technology).
For employers, the coverage question is the familiar one: does a tool make, or substantially factor into, a consequential decision such as hiring? A resume screener whose ranking shapes who advances fits. A spellchecker or a scheduling tool does not.
Two structural points stand out. First, there is no small-business exemption in the new law: the old under-50-FTE carve-out disappeared with the repeal, so the duties apply to a four-person shop and a four-thousand-person company alike. The legislature could afford that breadth because the duties themselves shrank to a notice-and-recourse core. Second, developers owe deployers technical documentation: intended uses, categories of training data, known limitations, usage instructions, and notice of material updates. As the deployer, collect and keep that documentation; it is the factual basis for your own notices and explanations.
The employer duties from January 1, 2027
The new law asks employers for five concrete things. (1) Notice at the point of interaction: a clear and conspicuous disclosure that ADMT is in use, delivered where the candidate meets the process, which for hiring means the job posting and application flow. (2) An explanation after an adverse outcome: a plain-language description of the system's role in the decision, within 30 days. (3) Data access and correction: the candidate can request the personal data the system used and have factually incorrect data corrected. (4) Meaningful human review: on request after an adverse decision, a human reconsiders. (5) Records: retain compliance records for at least three years.
Notice how every duty runs toward the candidate rather than toward a regulator: no filings, no audits, no public statements. That makes compliance cheap for an employer whose screening is already transparent, and painful for one whose tool cannot say why a candidate ranked low.
This is the same design lesson every other law in this hub teaches: SiftFirst scores against human-set criteria with a quoted line of evidence behind every score and a human making the final call, so the 30-day explanation is a sentence you read off the screen, human review is the default rather than an appeal bolted on, and a saved screening is the record.
What the repeal dropped, and what still applies
Gone with SB 26-189: the risk-management program, the annual impact assessments, the public statements, the duty to notify the Attorney General of discovered algorithmic discrimination, and the under-50-FTE exemption that softened all of it. The reasonable-care-against-algorithmic-discrimination framing went too; the new statute polices process (notice, explanation, recourse, records) rather than mandating bias governance.
Do not read that as permission to run a biased tool in Colorado. Ordinary anti-discrimination law never went anywhere: Title VII disparate-impact claims, the Colorado Anti-Discrimination Act, and the EEOC framework all still apply to hiring outcomes however they are produced. A screening tool that systematically disadvantages a protected group is a lawsuit under those statutes regardless of what the ADMT law says.
So the practical posture for a Colorado employer is: the four-fifths self-check and job-related criteria remain your substantive protection, and SB 26-189 adds a procedural layer (tell candidates, explain adverse outcomes, keep records) on top.
Enforcement
Enforcement is exclusive to the Colorado Attorney General, and a violation counts as a deceptive trade practice under the Colorado Consumer Protection Act. There is no private right of action under the ADMT law itself, and a 60-day cure period applies where available, so an employer who fixes a notice gap promptly has room to avoid an enforcement action.
The realistic exposure profile: AG enforcement will chase patterns and complaints, and rejected candidates are the complainants. A missing notice is visible to every applicant; a refused explanation creates a paper trail in the candidate's favor. Conversely, an employer who can produce the notice, the explanation, and three years of records has answered the statute.
Remember the layering: the consumer-protection route caps ADMT-law exposure, but a discrimination claim under Title VII or state civil-rights law rides separately, with private plaintiffs and real damages. The records SB 26-189 makes you keep are the same records that defend those claims, which is the best argument for treating the 2027 duties as useful discipline rather than box-ticking.
A practical Colorado checklist
Before January 1, 2027: (1) Add the ADMT notice to postings and the application flow for roles that draw Colorado candidates; the free candidate notice generator builds it from your screening criteria, which doubles as the plain-language description of the system's role. (2) Wire the adverse-outcome packet into your rejection process: be able to produce the explanation within 30 days, offer data correction, and route review requests to a human. (3) Set retention to at least three years for criteria, scores, evidence, outcomes, and decisions. (4) Collect your vendor's technical documentation and keep it current. (5) Keep running the four-fifths self-check; the ADMT law dropped bias governance, but discrimination law did not.
If you operate in several states, notice that this list is a subset of the multi-state baseline this hub already recommends (notice everywhere, records everywhere, human decisions everywhere), so Colorado should cost you nothing extra if the baseline is in place.
And given this statute's history (delayed once, repealed and reenacted once, politically contested throughout), check the current text and your counsel before making 2027 commitments; the last-reviewed date on this page tells you when these facts were verified.
Key takeaways
- ✓The 2024 Colorado AI Act never took effect: SB 26-189 (signed May 14, 2026) repealed and reenacted it as a narrower ADMT law, effective January 1, 2027.
- ✓Employer duties from 2027: point-of-interaction notice, a plain-language explanation within 30 days of an adverse decision, data access and correction, meaningful human review on request, and 3-year records.
- ✓Risk-management programs, impact assessments, and public statements are gone, and so is the under-50-employee exemption: the lighter duties apply to deployers of every size.
- ✓Enforcement is by the Attorney General under consumer-protection law with a 60-day cure period and no private right of action; ordinary discrimination law still applies in full.
- ✓A black-box tool cannot produce the required explanation; evidence-backed, human-decided screening turns every 2027 duty into an export or a copy-paste.
Screening built for these rules
SiftFirst scores candidates against criteria you set, quotes the resume line behind every score, never auto-rejects, and exports the records these laws expect. The candidate notice generator and bias audit self-check are free.
FAQ
Did the original Colorado AI Act (SB 24-205) ever apply to my hiring?
No. Its effective date was delayed from February to June 30, 2026, and on May 14, 2026 SB 26-189 repealed and reenacted it before that date arrived. No Colorado-specific AI duty has applied to hiring yet; the new ADMT law's duties start January 1, 2027. Guidance that talks about risk-management programs, impact assessments, or a reasonable-care duty is describing the repealed law.
Is there still an under-50-employee exemption?
No. The old act's conditional carve-out for deployers under 50 full-time equivalents was repealed along with everything else. The new law has no size threshold: the notice, adverse-decision, and records duties apply to every deployer. The trade is that those duties are far lighter than what the old act demanded of larger companies.
What does a rejected Colorado candidate actually get from 2027?
Notice that ADMT was in use (given at the point of interaction), and after an adverse decision: a plain-language description of the system's role within 30 days, access to the personal data used with correction of factual errors, and meaningful human review and reconsideration on request. Your rejection workflow needs to be able to produce all of that.