Colorado AI Act

From SB 24-205 to SB 26-189

The original law, SB 24-205, was signed in May 2024. It regulated "high-risk AI systems" and required deployers to use reasonable care against algorithmic discrimination, run a risk management program, complete annual impact assessments, publish a website statement and report discovered discrimination to the Attorney General. It was set to start February 1, 2026, and a 2025 special-session law pushed that to June 30, 2026.

It never took effect. In April 2026 a federal court stayed enforcement in a constitutional challenge brought by xAI, with the Attorney General agreeing not to enforce while the legislature acted. In May 2026 lawmakers passed SB 26-189, signed May 14, 2026, which repeals the 2024 law and replaces it with a narrower transparency framework for automated decision-making technology (ADMT). The new duties start January 1, 2027.

Key definitions

• ADMT: technology that processes personal data and uses computation to produce output such as a score, ranking, prediction, classification or recommendation that is used to make, guide or assist a decision about a person.
• Covered ADMT: ADMT used to materially influence a consequential decision, meaning its output is more than a trivial factor and affects the outcome, for example by ranking, scoring, filtering or constraining the options a human sees.
• Consequential decision: a decision about access to, eligibility for, selection for or compensation for a covered area, which includes employment or employment opportunities, along with education, housing, lending, insurance, health care and essential government services.
• Developer and deployer: the business that builds the tool and the business that uses it. For hiring tools the deployer is usually the employer.

Routine tools are excluded, such as spell-checkers, spreadsheets without machine learning, security software, and general AI models used only to summarize, translate or draft material that a person then reviews.

What deployers (employers) must do

1. Pre-use notice: tell applicants and employees that covered ADMT is being used to materially influence a decision about them and how to get more information. A clear public notice at the point of interaction, such as the application flow, can satisfy this.
2. Adverse outcome notice: within 30 days of an adverse decision, describe the decision and the tool's role, and explain how to request more information.
3. Correction: let the person correct inaccurate personal data used in the decision.
4. Human review: offer meaningful human review and reconsideration, to the extent commercially reasonable.
5. Records: keep compliance records for at least three years, or longer where other law requires.

The 2026 law dropped the impact assessments, risk management program and Attorney General reporting that the 2024 version required. In practice, the first job is an inventory: list every tool that scores, ranks or filters candidates or employees, including AI features inside your ATS or scheduling software, and decide which ones materially influence decisions.

What developers must do

Vendors that build hiring tools must give deployers documentation on intended and prohibited uses, training data, known limitations and risks, instructions for use and how to support meaningful human review. They must tell deployers about material updates and substantial modifications within a reasonable time and keep their own compliance records for three years. The law also makes certain contract terms that shift liability onto deployers unenforceable, so review vendor agreements and ask for the documentation package before renewal.

Enforcement and timing

The Colorado Attorney General has exclusive enforcement authority, and there is no private right of action. Before suing, the Attorney General must generally give 60 days' notice and a chance to cure, except for knowing or repeated violations, and that cure right ends January 1, 2030. The Attorney General can issue rules on notice content, human review and what counts as material influence, and released draft rules in 2026.

The new duties begin January 1, 2027. The federal litigation over the original law could still affect the replacement, so check the current text and any final rules before relying on a specific requirement. Applicants and employees can still bring discrimination claims under Colorado and federal anti-discrimination law, whatever the ADMT rules say.

Worked example

A hospital system with 3,000 employees in Denver uses an AI screening tool that ranks nursing applicants and a scheduling tool that assigns shifts. The ranking tool decides which applicants recruiters see first, so it materially influences hiring and is covered. The scheduling tool may also be covered if it materially affects pay. HR and legal add a plain-language notice to the application flow, set up a process to send rejected applicants an explanation within 30 days, route reconsideration requests to a recruiter who reviews the full application, and keep the records for three years. The team keeps running annual adverse impact analysis by sex, race and age, which the law no longer requires but which remains the best defense against a discrimination claim.

How it compares with other AI laws

After the rewrite, Colorado's law is mainly about notice, explanation and human review. NYC Local Law 144 requires an independent bias audit and notice for hiring and promotion tools, and the EU AI Act sets detailed technical and conformity requirements for high-risk systems, including recruitment AI. The concept of an automated decision system runs through all of them. A governance program built on a tool inventory, documented human-in-the-loop review and regular bias audits covers most of the overlapping ground. This page is informational; requirements vary by state and change often.