Colorado’s Updated AI Law

As job applicants increasingly use AI tools to apply for a wider range of positions, HR teams are, in turn, turning to AI-driven resume screening, candidate ranking, and other tools to manage the resulting volume of applications.  As we head into the last quarter of 2026, companies using these tools need to prepare for Colorado's newly enacted Senate Bill 26-189, which regulates the use of automated decision-making technology (“ADMT”) and replaces the original Colorado AI Act.  This new law takes effect January 1, 2027, and applies to certain consequential decisions made using qualifying ADMT.  Although the law will apply to a range of use cases across industries, companies utilizing AI screening and hiring tools will feel the impact in ways that are not necessarily shared across other US state laws in this space.  This alert provides an overview of the law’s key requirements, with a particular focus on its application to AI resume-screening and similar hiring tools.

Key Definitions

How Does It All Come Together?

 SB 26-189 applies to both “developers” and “deployers” of ADMT. For purposes of this alert, we focus on deployers. A deployer triggers the law’s obligations when two conditions are met:

1. the organization uses ADMT to make or inform a consequential decision in a covered domain, and;
2. the ADMT’s output is a non-de-minimis factor that affects the outcome of that decision.

Importantly, the law does not require the ADMT to act autonomously or to be the sole basis for the decision. It is enough that the ADMT produces a score, ranking, recommendation, classification, prediction, or other inference that meaningfully alters how the decision is made. In practice, this framework means there is no categorical human-review exception. Unlike some other state AI laws, SB 26-189 does not exempt an organization from compliance simply because a human reviews each output before a final decision is reached. If the ADMT's output remains a non-de-minimis factor in the ultimate decision (which practically would be the case in most situations or there would be no reason to use the tool), the full suite of obligations under the law applies regardless of whether a human was involved in the process. 

The law’s narrow exclusions only cover tools used solely to summarize, organize, translate, draft, route, or present information for human review or administrative processing, and systems whose output does not produce a score, ranking, recommendation, classification, prediction, or other inference that materially influences an outcome.  In short, most AI tools that generate any form of evaluative output about an individual in a covered domain will be in scope, even where a human makes the final call.

Key Obligations for Employers Deploying AI Hiring Tools

When a deployer uses covered ADMT to make or materially influence a consequential decision, several obligations apply. Taken together, they impose substantial operational and compliance requirements:

• Pre-use notice: Before using a covered ADMT to materially influence a hiring decision, the deployer must provide the applicant or employee clear and conspicuous notice that such technology was or will be used, together with instructions for obtaining additional information.
• Post-adverse-outcome disclosures: If use of the ADMT results in an adverse outcome for a candidate or employee (for example, rejection, denial of an interview, or a materially less favorable offer), the deployer must, within 30 days, provide a plain-language description of the decision and the tool’s role in it, instructions for obtaining more information about the tool and the personal data used, and an explanation of the individual’s rights under the law.
• Consumer rights: Affected individuals have the right to request correction of factually incorrect or materially inaccurate personal data used in the decision, and an opportunity for meaningful human review and reconsideration of the decision, to the extent commercially reasonable.
  • To qualify as meaningful human review, the reviewer must be specifically designated by the deployer, have actual authority to approve, modify, or override the decision, consider relevant available primary evidence, be trained to conduct the review, not simply defer to the system’s output, and have access to sufficient information about the tool's intended use, material limitations, categories of inputs, and principal factors driving the output. For example, a reviewer who simply confirms the original AI-generated outcome without independently evaluating the candidate’s qualifications or considering primary evidence beyond the tool’s output would not satisfy the standard.
• Recordkeeping: Deployers must retain records reasonably necessary to demonstrate compliance for at least three years from the date of the consequential decision.

Additional detail regarding these obligations is expected in the implementing rules. The Colorado Attorney General released proposed ADMT rules in August 2026, with a rulemaking hearing scheduled for October 26, 2026.

How is SB 26-189 Different? 

Several other jurisdictions, including California, Connecticut, Illinois, and New York City, have enacted laws that may also reach AI screening and recruitment tools. Those frameworks differ from Colorado’s new law, however, in that they generally exclude from scope organizations that conduct meaningful human review of the tool’s results.

Under the CCPA’s finalized ADMT regulations, (effective January 1, 2026, with compliance required by April 1, 2027), for example, “automated decision-making technology” is defined as technology that “replaces or substantially replaces human decisionmaking.” The regulations clarify that a technology “substantially replaces” human decision making only when a business uses its output to make a decision without human involvement. If a human reviewer knows how to interpret the output, reviews and analyzes it alongside other relevant information, and has authority to make or change the decision, the technology would likely fall outside the definition of ADMT, and the CCPA’s ADMT obligations would, consequently, not be triggered. Colorado takes a different approach: human review of an ADMT’s output does not, by itself, remove the tool from scope. The law applies whenever the ADMT’s output is a non-de minimis factor in the decision, regardless of whether a human was involved.

Enforcement, Liability, and Cure

The Colorado Attorney General has exclusive enforcement authority under the Colorado Consumer Protection Act, and a violation is treated as a deceptive trade practice. Before bringing an enforcement action, the Attorney General generally must issue a notice of violation and allow 60 days to cure, if the Attorney General determines that cure is possible. The statute creates no private right of action but does not limit existing rights or remedies under other laws, including the Colorado Anti-Discrimination Act. Notably, contractual provisions purporting to indemnify a party against its own liability for ADMT-related discrimination are void as against public policy. Developers and deployers may each be held liable in a discrimination action arising from a consequential decision materially influenced by covered ADMT, with fault allocated based on relative responsibility.

How to Get Started

Complying with SB 26-189 may materially reduce the efficiency gains that employers expect from AI screening tools, particularly because of the requirements to provide post-adverse-outcome notices and an opportunity for meaningful human review and reconsideration. Companies generally adopt these tools to increase hiring efficiency, especially at a time when candidates are also using AI to apply for positions at scale. Even so, organizations need to evaluate whether their tools trigger the law and, if so, what steps would be required to continue using them in Colorado or for Colorado applicants or employees.

Given the January 1, 2027 effective date for SB 26-189, companies should begin preparing now. Recommended first steps include:

• Inventory all AI or algorithmic tools used in recruiting, screening, interviewing, promotion, compensation, or termination decisions that may affect Colorado-based applicants or employees and assess whether each tool’s output materially influences those decisions (i.e., plays more than a de-minimis role).
• Do not assume that existing “human in the loop” practices satisfy the law.
• Coordinate with AI hiring-tool vendors to obtain the documentation developers are required to provide, including known limitations, training-data categories, and instructions for appropriate use and human review.
• Build processes for pre-use notices to applicants and employees and for the post-adverse-outcome disclosures and consumer-rights procedures required after an adverse hiring decision.
• Establish recordkeeping practices sufficient to demonstrate compliance, including version identifiers for the tools used and documentation of human review sessions when meaningful human review is requested.
• Engage HR, talent acquisition, legal, and IT stakeholders together, since compliance will require input beyond the legal or privacy team alone, particularly in designating and training reviewers who can satisfy the meaningful human review standard.
• If compliance with SB 26-189 is not feasible or practical for a particular tool or use case, consider whether operational alternatives are available for Colorado applicants or employees, such as geo-fencing.