Colorado lawmakers repealed the state's broad artificial intelligence law before its June 30, 2026, effective date, replacing it with a narrower framework focused on automated decision-making technology. This shift relieves employers from sweeping algorithmic governance mandates but introduces strict notice, recordkeeping, and human review obligations for tools that materially influence employment decisions.
The shift from broad regulation to targeted rules
Gov. Jared Polis signed S.B. 26-189 into law on May 14, 2026. The new statute repeals the original "high-risk artificial intelligence system" framework. Instead, it regulates automated decision-making technology, or ADMT, used in consequential decisions.
The original law required risk management programs, impact assessments, and annual reviews regarding algorithmic discrimination. S.B. 26-189 removes these mandates. It replaces them with requirements for transparency, disclosure, and recordkeeping.
The new law defines ADMT as technology that processes personal data and uses computation to generate outputs like predictions or scores to guide a decision. It explicitly excludes basic tools like calculators, databases, firewalls, and spell-checkers, as well as software used solely to summarize or route information for human review.
Legal challenges forced the legislative rewrite
The original framework faced immediate constitutional challenges. On April 9, 2026, xAI filed suit in the U.S. District Court for the District of Colorado, arguing that designing and training AI models is expressive activity protected under the First Amendment.
The U.S. Department of Justice moved to intervene on April 24. The DOJ said the law violates the equal protection clause of the 14th Amendment by requiring AI companies to prevent unintentional disparate impact.
The Colorado attorney general joined the plaintiffs on April 24, filing a joint motion to stay enforcement. The court subsequently issued an order on April 27 prohibiting enforcement of the original law pending further litigation.
Employer obligations under the new framework
S.B. 26-189 takes effect on Jan. 1, 2027. It applies to job applicants, employees who are Colorado residents, and any individual whose eligibility or opportunity in Colorado is evaluated by a person doing business in the state.
Deployers must retain records for at least three years after an employment-related decision. They must also provide "clear and conspicuous notice" that covered ADMT was used in a consequential decision affecting the individual.
Within 30 days of an adverse decision, employers must provide a plain language description of the decision and the ADMT's role. Individuals also gain the right to request correction of "factually incorrect or materially inaccurate personal data" and seek "meaningful human review and reconsideration" when commercially reasonable.
Enforcement falls to the Colorado attorney general through the Colorado Consumer Protection Act. There is no private right of action. The attorney general must provide a 60-day cure period before filing suit, unless the employer knowingly or repeatedly violated the law.
Employers must determine whether their software materially influences employment decisions, a compliance question that teams managing AI for Legal risks must address carefully. Distinguishing between basic administrative aids and systems that alter hiring or promotion outcomes will require close coordination with departments handling AI for Human Resources operations.
Why this matters for legal professionals
The repeal of the original Colorado statute removes the threat of aggressive, sweeping algorithmic governance mandates. However, the Jan. 1, 2027, deadline for S.B. 26-189 requires immediate action.
Counsel must advise clients to audit their current employment software now. The focus should be on how tools are actually used in practice, not how vendors market them. Identifying which systems trigger the notice, disclosure, and 60-day cure requirements will prevent future enforcement actions by the state.
Your membership also unlocks:
