Colorado Replaces AI Bias Law With Transparency Framework
Colorado lawmakers are repealing the state's first-in-the-nation AI antidiscrimination law and replacing it with a narrower transparency requirement. The new bill, SB 26-189, focuses on automated decision-making technology (ADMT) used in high-stakes decisions like hiring, lending, and housing. If passed, the law takes effect January 1, 2027.
The original 2024 law imposed broad obligations on AI developers and deployers, including mandatory bias audits and risk assessments. Businesses and tech companies pushed back hard, calling the requirements unworkable. After failed revision attempts and a federal court temporary restraining order blocking enforcement, lawmakers drafted a replacement with fewer mandates.
Who Must Comply
The bill applies to any entity doing business in Colorado that either develops an ADMT or deploys a "covered ADMT" - meaning the tool materially influences a consequential decision.
Consequential decisions include those affecting employment, education access, housing, lending, insurance, healthcare, and government services. The law explicitly excludes routine scheduling, customer service triage, advertising, marketing, and content moderation.
What Deployers Must Do
Employers and other organizations using covered ADMTs face several obligations:
- Provide clear notice when a covered ADMT is used in a decision affecting someone
- Explain in plain language within 30 days why an ADMT made an adverse decision
- Allow employees and applicants to request personal data used in the decision and correct inaccurate information
- Grant the right to meaningful human review and reconsideration of adverse outcomes
- Keep compliance records for at least three years
What Developers Must Provide
AI developers must give deployers technical documentation covering intended uses, training data categories, known limitations, and guidance on appropriate use and human review. They must also notify deployers of material product updates.
Enforcement and Liability
The Colorado Attorney General enforces the law through the state's Consumer Protection Act, treating violations as deceptive trade practices. The AG must provide 60 days' notice and opportunity to cure before enforcement, unless violations are knowing or repeated.
The bill creates no private right of action. It also clarifies that contract clauses attempting to shift discrimination liability between developers and deployers are void.
Five Steps for Legal Teams Now
1. Inventory AI tools. Identify every AI-assisted tool involved in Colorado employment decisions - hiring, screening, performance evaluation, compensation, benefits. Assess whether each qualifies as a covered ADMT.
2. Contact vendors. Request documentation from AI vendors on intended use cases, training data categories, known limitations, and human review processes.
3. Design disclosure processes. Plan how your organization will provide notice at the point of decision and explain adverse outcomes within 30 days. This timeline is operationally significant.
4. Build documentation systems. The three-year recordkeeping requirement applies to both developers and deployers. Establish compliance documentation practices now, before January 1, 2027.
5. Monitor legislative and court developments. The bill still needs final passage and faces likely legal challenges. The federal litigation over the original law continues, which could affect the new framework.
The legislature wraps up May 13, but the bill is moving quickly and appears positioned for final passage. It then goes to Governor Polis for signature.
For legal professionals managing AI compliance, understanding this shift from mandatory audits to transparency requirements is essential. The new framework reduces upfront obligations but increases operational demands around disclosure and human review processes. AI for Legal professionals should familiarize themselves with these specific requirements now to help their organizations prepare.
Your membership also unlocks:
