Colorado has overhauled its artificial intelligence law with Senate Bill 26-189, which takes effect January 1, 2027. The law regulates automated decision-making technology in hiring and replaces the state's original AI Act. For employers using AI resume-screening and candidate-ranking tools, the most immediate shift is that human review of a tool's output does not exempt the system from the law's requirements.
When the law applies
SB 26-189 covers deployers of ADMT when two conditions are met. The organization uses the technology to make or inform a consequential decision, and the tool's output is a non-de-minimis factor that affects the outcome. A score, ranking, recommendation, classification, or prediction that meaningfully alters how a hiring decision is made is enough to trigger the law's obligations.
The statute's exclusions are narrow. Tools used solely to summarize, organize, translate, draft, route, or present information for human review may fall outside scope. Systems whose output does not produce evaluative inferences that materially influence an outcome are also excluded. Most AI tools that generate any form of evaluative output about an individual will be covered, even when a human makes the final call.
How SB 26-189 differs from other state laws
California's finalized ADMT regulations under the CCPA define automated decision-making technology as technology that "replaces or substantially replaces human decisionmaking." The regulations clarify that a tool substantially replaces human decisionmaking only when a business uses its output without human involvement. If a reviewer knows how to interpret the output, analyzes it alongside other relevant information, and has authority to change the decision, the technology likely falls outside the CCPA's ADMT obligations.
Colorado takes a different approach. Human review of an ADMT's output does not, by itself, remove the tool from scope. The law applies whenever the output is a non-de-minimis factor in the decision, regardless of whether a human was involved. Similar laws in Connecticut, Illinois, and New York City also generally exclude organizations that conduct meaningful human review. Colorado's framework closes that door.
Key obligations for employers
Organizations deploying covered ADMT in hiring face several requirements. Before using the tool, the deployer must provide clear and conspicuous notice to the applicant or employee, along with instructions for obtaining additional information. If the tool's use results in an adverse outcome-rejection, denial of an interview, or a materially less favorable offer-the deployer must, within 30 days, provide a plain-language description of the decision and the tool's role in it, instructions for obtaining more information about the tool and personal data used, and an explanation of the individual's rights under the law.
Affected individuals have the right to request correction of factually incorrect or materially inaccurate personal data used in the decision. They also have a right to meaningful human review and reconsideration, to the extent commercially reasonable. To qualify as meaningful, the reviewer must be specifically designated by the deployer, have actual authority to approve, modify, or override the decision, consider relevant available primary evidence, be trained to conduct the review, not simply defer to the system's output, and have access to sufficient information about the tool's intended use, material limitations, categories of inputs, and principal factors driving the output. A reviewer who simply confirms the original AI-generated outcome without independently evaluating the candidate's qualifications would not satisfy the standard.
Deployers must retain records reasonably necessary to demonstrate compliance for at least three years from the date of the consequential decision. The Colorado Attorney General released proposed ADMT rules in August 2026, with a rulemaking hearing scheduled for October 26, 2026.
Enforcement and liability
The Colorado Attorney General has exclusive enforcement authority under the Colorado Consumer Protection Act. A violation is treated as a deceptive trade practice. Before bringing an enforcement action, the Attorney General generally must issue a notice of violation and allow 60 days to cure, if cure is determined to be possible. The statute creates no private right of action but does not limit existing rights or remedies under other laws, including the Colorado Anti-Discrimination Act.
Contractual provisions that purport to indemnify a party against its own liability for ADMT-related discrimination are void as against public policy. Developers and deployers may each be held liable in a discrimination action arising from a consequential decision materially influenced by covered ADMT, with fault allocated based on relative responsibility.
Getting started before January 2027
Companies should begin preparing now. Recommended first steps include inventorying all AI or algorithmic tools used in recruiting, screening, interviewing, promotion, compensation, or termination decisions that may affect Colorado-based applicants or employees. Assess whether each tool's output materially influences those decisions-meaning it plays more than a de-minimis role.
Do not assume existing human-in-the-loop practices satisfy the law. Coordinate with AI hiring-tool vendors to obtain the documentation developers are required to provide, including known limitations, training-data categories, and instructions for appropriate use and human review. Build processes for pre-use notices and for the post-adverse-outcome disclosures and consumer-rights procedures. Establish recordkeeping practices sufficient to demonstrate compliance, including version identifiers for the tools used and documentation of human review sessions when meaningful human review is requested.
Engage HR, talent acquisition, legal, and IT stakeholders together. Compliance will require input beyond the legal or privacy team alone, particularly in designating and training reviewers who can satisfy the meaningful human review standard. If compliance with SB 26-189 is not feasible for a particular tool or use case, consider whether operational alternatives are available for Colorado applicants or employees, such as geo-fencing. For legal teams navigating the intersection of employment law and emerging technology, understanding the contours of AI for Legal compliance is becoming essential, while AI for Human Resources training can help talent acquisition teams evaluate whether their current tools and workflows will meet the new standard.
Why this matters for legal professionals
SB 26-189 eliminates the human-review safe harbor that exists in other state AI laws. In-house counsel advising on hiring practices cannot rely on the fact that a recruiter or hiring manager reviews each AI-generated ranking as a defense against the law's requirements. The compliance burden-pre-use notices, post-adverse-outcome disclosures, meaningful human review procedures, and three-year recordkeeping-will apply to most AI screening tools that produce evaluative outputs, regardless of how much human oversight sits atop them. Legal teams need to audit their organization's hiring technology stack now and determine whether existing vendor contracts, internal processes, and reviewer training protocols can support the law's specific definition of meaningful human review before the January 1, 2027 effective date.
Your membership also unlocks:
