This is not legal advice. This article summarizes public laws and regulations as of the date below, with links to the official texts. Laws in this area change often; check the current text and talk to your counsel before acting on anything here.
Colorado passed a law on high-risk artificial intelligence, SB 24-205, in May 2024, with duties for employers and other deployers starting February 1, 2026, a date later moved to June 30, 2026. In May 2026 the legislature passed SB 26-189, which repeals and reenacts that part of the statutes, effective January 1, 2027, as a law on automated decision-making technology used in "consequential decisions", including hiring. The replacement drops the impact-assessment and risk-management duties of the original. This page summarizes what SB 26-189 says about employment, with quotes from the enacted text. Last reviewed 11 November 2026.
Timeline
| Date | What happened |
|---|---|
| May 17, 2024 | SB 24-205, the Colorado AI Act, signed. Duties for deployers were to start February 1, 2026. |
| August 28, 2025 | SB 25B-004 signed in a special session, moving those dates to June 30, 2026. |
| April 27, 2026 | In a lawsuit challenging the law (xAI v. Weiser, federal court in Colorado), the court granted the parties' agreed stay of enforcement (see below). |
| May 14, 2026 | SB 26-189 signed. It repeals and reenacts the same part of the statutes as "Automated Decision-Making Technology in Consequential Decisions", effective January 1, 2027. |
| June 30, 2026 | The date SB 24-205's duties were set to begin. What applies between this date and January 1, 2027, given the court order below, is a question for your counsel. |
| August to October 2026 | The Attorney General proposed implementing rules (August 11) and held a public hearing (October 26). Final rules had not been posted when this page was reviewed. |
| January 1, 2027 | SB 26-189 takes effect. It "applies to consequential decisions made on or after January 1, 2027." |
Does it cover hiring?
The law names employment as a covered domain. Employment is one of the law's "covered domains", defined as "employment or an employment opportunity that creates or may create an employer-employee relationship", and "consumer" includes "an employee" and "a job applicant who is a Colorado resident".
The law applies to a "covered ADMT", which is automated decision-making technology "used to materially influence a consequential decision". Materially influence has a two-part definition: the output is "a non-de minimis factor that is used in making a consequential decision", and it "affects the outcome", "including by constraining, ranking, scoring, recommending, classifying, or otherwise meaningfully altering how a consequential decision is made". The definition excludes "incidental, trivial, or clerical uses", and the definition of automated decision-making technology excludes "a tool used by an individual solely to summarize, organize, translate, draft, route, or present information for human review of administrative processing".
Two points matter for health systems in particular. First, the law exempts HIPAA covered entities and their business associates, "except for a consequential decision related to employment or an employment opportunity", so the exemption does not reach hiring. Second, "consequential decision" excludes "advertising, marketing, differentiated product recommendations, search, or content moderation". How those exclusions apply to a specific recruiting tool, such as candidate search or job advertising, is a question for your counsel and possibly for the Attorney General's rules.
What it asks of employers
The law calls the organization using a covered tool a "deployer" and the company that builds it a "developer". For deployers it sets out four duties.
| Duty | What the law says |
|---|---|
| Notice before use | "A clear and conspicuous notice to a consumer that the deployer used or will use a covered ADMT in a consequential decision affecting the consumer", with instructions for getting more information. A deployer complies by "maintaining a prominent public notice that is reasonably accessible at points of consumer interaction". |
| Explanation after an adverse outcome | Within thirty days of a decision with an adverse outcome (which includes denying "selection for" an opportunity): "a plain language description of the consequential decision and the role the covered ADMT played", instructions for requesting more information about the tool and the data used, and an explanation of the consumer's rights. |
| Correction and human review on request | After an adverse outcome, on request: instructions for correcting inaccurate personal data, and "an opportunity for meaningful human review and reconsideration of the consequential decision, to the extent commercially reasonable". Opinions, predictions and scores do not have to be corrected. |
| Records | Keep "records reasonably necessary to demonstrate compliance" for "not less than three years" after the decision. |
Notices must be "reasonably accessible to consumers with disabilities and consumers with limited English proficiency". "Meaningful human review" is defined: a person designated by the deployer, with authority to approve, modify or override the decision, who considers the relevant evidence, is trained to do the review and "does not default to the system output".
From January 1, 2027, developers must give deployers documentation about the tool's intended and known harmful uses and the "information reasonably necessary for the deployer to comply".
What it no longer requires
SB 24-205, which SB 26-189 repeals effective January 1, 2027, required deployers to run a risk management program and to complete impact assessments, and it exempted deployers with fewer than fifty full-time employees under certain conditions. The enacted text of SB 26-189 contains neither the impact assessment and risk management duties nor that small-business exemption.
Enforcement
- The Attorney General only. The disclosure and consumer-rights provisions are "enforceable exclusively by the attorney general", and a violation is a deceptive trade practice under the Colorado Consumer Protection Act.
- A chance to cure. Before an enforcement action, the Attorney General "shall issue a notice of violation" when a cure is possible, and the deployer has sixty days to cure. If the Attorney General "finds and can demonstrate" a knowing or repeated violation, the Attorney General "is not required to provide a cure period". The cure provision is repealed on January 1, 2030.
- No new private lawsuits. "Nothing in this part 17 creates a new private right of action." Existing rights, including under the Colorado Anti-Discrimination Act, are preserved.
- No defense by tool. "The use of an ADMT in a consequential decision does not excuse, justify, or provide a defense to any obligation or liability under state or federal law, including obligations and liability related to discrimination."
The court case and the rules
In April 2026 xAI sued the Colorado Attorney General to block SB 24-205, and the United States joined as a plaintiff. The parties agreed to a stay, which the court granted on April 27, 2026. Under it, the Attorney General "shall not initiate enforcement, including but not limited to the initiation of an investigation, for alleged violations of SB24-205 (or any legislation replacing or amending SB24-205 enacted during this legislative session) that occurred or may occur on or before 14 days after the date the Court issues a ruling on xAI's forthcoming motion for a preliminary injunction", and xAI's motion is due within 28 days after final rules are adopted. We have not confirmed what has happened in the case since that order. What the stay means for other employers is a legal question; ask your counsel.
The law also tells the Attorney General to adopt rules on the adverse-outcome disclosures and the consumer rights on or before January 1, 2027. The proposed rules, an interim draft and a regulatory analysis are on the Attorney General's rulemaking page; check there for the final version.
Questions to raise with your counsel
- Do any of our recruiting tools "materially influence" a hiring decision, or do they fall under an exclusion?
- Where would a notice before use appear for Colorado applicants, and does it meet the accessibility requirement?
- Who sends the explanation after an adverse outcome, within thirty days, and who performs a human review if one is requested?
- What documentation do our vendors provide under the law's developer duties, and what records do we keep for three years?
- What do the Attorney General's final rules change, and what is the status of the court case?
For the other states and cities with laws on AI in hiring, see AI hiring laws for healthcare employers.
Sources
- Colorado General Assembly, SB 26-189, 2026 Session Laws chapter 131, approved May 14, 2026, read 11 November 2026.
- Colorado General Assembly, SB 26-189 bill history, read 11 November 2026.
- Colorado General Assembly, SB 24-205, 2024 Session Laws chapter 198, read 11 November 2026.
- Colorado General Assembly, SB 25B-004, 2025 Extraordinary Session chapter 3, read 11 November 2026.
- Colorado Attorney General, Automated decision-making technology rulemaking, read 11 November 2026.
- U.S. District Court for the District of Colorado, xAI v. Weiser, No. 1:26-cv-01515, revised joint motion and stipulation to temporarily stay enforcement, granted April 27, 2026, read 11 November 2026.
Frequently asked questions
When does Colorado's AI hiring law take effect?
SB 26-189 takes effect on January 1, 2027, and applies to consequential decisions, including hiring decisions, made on or after that date. It repeals and reenacts the part of the statutes created by the Colorado AI Act (SB 24-205), whose duties were dated June 30, 2026.
Are hospitals exempt from Colorado's automated decision-making law?
The law's exemption for HIPAA covered entities and their business associates does not extend to consequential decisions related to employment or an employment opportunity.
Does SB 26-189 require an impact assessment?
No. SB 24-205, which SB 26-189 repeals effective January 1, 2027, required impact assessments and a risk management program; the enacted text of SB 26-189 contains neither. It requires a notice before use, an explanation after an adverse outcome, correction and human review on request, and three years of records.
Can a job applicant sue under SB 26-189?
The law states that it creates no new private right of action; the Attorney General enforces it. Existing rights under other laws, including the Colorado Anti-Discrimination Act, are not reduced.
