Colorado AI Act hiring rules: what employers must do by 2027

SB 24-205 was delayed, then repealed and reenacted. Here is what the current Colorado law asks of employers that use AI in hiring, and when.

The short answer

The Colorado AI Act you may have read about, SB 24-205, no longer sets the rules for hiring. Colorado first delayed it from February 1, 2026 to June 30, 2026, then in May 2026 passed SB 26-189, which repealed and reenacted the law as a narrower set of duties for "automated decision-making technology" (ADMT). For employers, the current Colorado AI Act hiring rules take effect January 1, 2027 and apply to consequential decisions made on or after that date. Employment is a covered domain. If an AI tool, such as an AI interview score or a resume ranking, materially influences a hiring decision about a Colorado consumer, you owe a notice before you use it, a plain-language explanation within 30 days of an adverse outcome, a way to correct data and request human review, and three years of records.

This is not legal advice. It summarizes the bill pages, bill text and fiscal note published by the Colorado General Assembly, linked at the end. Confirm your obligations with counsel.

Colorado AI Act hiring timeline: from SB 24-205 to SB 26-189

Date	What happened	Source
May 17, 2024	Governor signed SB 24-205, Consumer Protections for Artificial Intelligence. Its main duties were set to start February 1, 2026.	SB 24-205 bill page
August 28, 2025	Governor signed SB 25B-004 in the 2025 special session, extending SB 24-205's requirements to June 30, 2026. The bill page lists its effective date as November 25, 2025.	SB 25B-004 bill page
April 27, 2026	According to the legislature's fiscal note, a U.S. District Court ordered the Attorney General not to begin enforcing SB 24-205, or legislation amending it, until rulemaking is complete and the court rules in X. AI LLC v. Weiser.	SB 26-189 final fiscal note
May 14, 2026	Governor signed SB 26-189, Automated Decision-Making Technology, which repeals and reenacts the law. Its rulemaking deadlines and appropriation took effect on passage.	SB 26-189 bill page and signed act
January 1, 2027	SB 26-189 takes effect and applies to consequential decisions made on or after this date. Developer documentation duties start. The Attorney General must adopt rules on adverse-outcome disclosures and consumer rights on or before this date.	SB 26-189, Section 5 and 6-1-1702, 6-1-1704, 6-1-1705
January 1, 2030	The Attorney General's mandatory notice-and-cure process is repealed.	SB 26-189, 6-1-1706 (3)(f)

One gap to note: SB 25B-004 pointed SB 24-205 at June 30, 2026, and SB 26-189's reenactment starts January 1, 2027. We did not find language in SB 26-189 that separately addresses the months in between, and the fiscal note reports the court order described above. If you made AI-assisted hiring decisions about Colorado candidates in that window, ask counsel how they view it.

Does your AI hiring tool count as covered ADMT?

SB 26-189 defines ADMT as technology that processes personal data and uses computation to generate output, including predictions, recommendations, classifications, rankings, scores or other information, that is used to make, guide or assist a decision about an individual. It becomes "covered ADMT" when it is used to materially influence a consequential decision. A consequential decision includes one about employment, or an employment opportunity that creates or may create an employer-employee relationship.

"Materially influence" has a two-part test. The tool's output must be a non-de minimis factor in the decision, and it must affect the outcome, including by constraining, ranking, scoring, recommending or classifying. Incidental, trivial or clerical uses are out. The law also excludes tools used only to summarize, organize, translate, draft, route or present information for human review, as long as they don't produce a score, ranking, recommendation or similar inference that materially influences the decision. Routine scheduling and workflow management are excluded too.

Applied to hiring, the line looks roughly like this:

Likely in scope: an AI interview that scores candidates and the score helps decide who advances; resume ranking that sets your shortlist; an assessment whose pass mark filters the pool.
Likely out of scope: an interview scheduler; a notetaker that transcribes and summarizes for a recruiter with no score; a chatbot that answers questions about the job, if it is not configured or intended for use in a consequential decision and a use policy bars its content from being used in one.

The Attorney General may adopt rules clarifying "materially influence," including presumptions and examples, so check for those before you settle on your answer.

What employers (deployers) must do

The law calls a business that uses covered ADMT a "deployer." For hiring, that is the employer. Here is what the reenacted text asks of you.

Notice before use. Before using covered ADMT to materially influence a consequential decision, give the consumer clear and conspicuous notice that you used or will use it, with instructions on how to get more information. A prominent public notice reasonably accessible at points of interaction, for example a link next to the application or interview invitation, satisfies this.
Disclosure after an adverse outcome. If covered ADMT materially influenced a decision with an adverse outcome, such as a rejection, provide within 30 days a plain-language description of the decision and the tool's role, instructions for requesting more information (including the tool's name, version and developer and the types, categories and sources of personal data used, to the extent the developer supplied them), and an explanation of the consumer's rights.
Correction and human review. On request after an adverse outcome, provide instructions for correcting factually incorrect or materially inaccurate personal data, and an opportunity for meaningful human review and reconsideration, to the extent commercially reasonable. The correction right does not extend to opinions, predictions or scores.
Records. Keep records reasonably necessary to show compliance for at least three years after each consequential decision, such as tool version identifiers and changelogs.
Accessibility. Provide notices and disclosures in a way that is reasonably accessible to people with disabilities and people with limited English proficiency.

The law defines meaningful human review with some care. The reviewer must be designated by you, have authority to approve, change or override the decision, be trained, consider the relevant evidence, not default to the system's output, and understand the output's intended use, limitations, input categories and principal factors. A recruiter who glances at a score and clicks "reject" would not meet that bar.

What your AI vendor (the developer) must give you

From January 1, 2027, developers of covered ADMT must give deployers documentation that is reasonably understandable and covers:

intended uses and known harmful or inappropriate uses;
categories of training data, including personal data, to the extent known;
known limitations, risks and situations where the tool should not be used;
instructions for appropriate use, monitoring and meaningful human review; and
information reasonably needed for you to meet your own disclosure duties.

Developers must also tell you about material updates within a reasonable time and keep their own records for three years. When you renew or sign a contract, ask for this package in writing. You'll need it to answer a rejected candidate's request for information.

Note one contract point. The act makes void any contract clause that indemnifies a developer or deployer against liability for its own acts under Colorado anti-discrimination law, with some exceptions. Fault in such cases is allocated between developer and deployer by relative fault. Have counsel review indemnity language with this in mind.

Enforcement and penalties

The Colorado Attorney General enforces the law exclusively, and a violation is a deceptive trade practice under the Colorado Consumer Protection Act. Before January 1, 2030, the Attorney General must send a notice of violation and allow 60 days to cure when a cure is possible, unless the violation was knowing or repeated. The act creates no new private right of action. The legislature's fiscal note says a deceptive trade practice can carry a civil penalty of up to $20,000 per violation.

What changed from SB 24-205

SB 24-205, as summarized on its bill page, asked deployers of "high-risk" AI systems to use reasonable care against algorithmic discrimination, with a presumption of reasonable care if they ran a risk management program, completed impact assessments, reviewed each system every year and reported discovered discrimination to the Attorney General. The reenacted text in SB 26-189 does not include those program, impact assessment or annual review duties. It shifts to documentation, notice, explanation, correction and human review.

That is a lighter paperwork load, not a free pass. SB 26-189 says a developer or deployer can be held liable under state anti-discrimination law for a consequential decision materially influenced by covered ADMT. Testing your tools for adverse impact remains the best defense. Our AI bias audit guide walks through the method, and our NYC Local Law 144 guide shows how a published audit works in practice. For one example, NTRVSTA's independent NYC Local Law 144 bias audit by Asenion, finalized October 20, 2026, is on our compliance page. It addresses New York City's law, not Colorado's.

A short checklist for January 1, 2027

Inventory every AI tool in your hiring flow and mark which ones score, rank or filter Colorado candidates.
Request each vendor's developer documentation and update notices in writing.
Publish an ADMT notice near your application and interview invitations.
Draft the 30-day adverse-outcome disclosure, and update it when the Attorney General's rules land.
Name and train human reviewers who can actually change a decision.
Set a three-year retention rule for decision records and tool versions.
Check that notices work with screen readers and in the languages your candidates use.

Hiring in other states too? Compare the Illinois AI Video Interview Act, California's AI hiring rules and the EU AI Act.

Questions

When does the Colorado AI Act apply to hiring?

Under SB 26-189, the reenacted law takes effect January 1, 2027 and applies to consequential decisions made on or after that date. Employment is one of the covered domains. Earlier dates you may have read, February 1, 2026 and June 30, 2026, came from versions of SB 24-205 that SB 26-189 replaced.

Do we still need an impact assessment under the Colorado AI Act?

The reenacted text we read does not include SB 24-205's impact assessment or risk management program duties. It focuses on developer documentation, deployer notices, disclosures after adverse outcomes, consumer rights and record keeping. Bias testing is still wise because anti-discrimination law applies regardless.

Can a candidate sue us under the Colorado AI Act?

The act says it does not create a new private right of action. The Colorado Attorney General enforces it as a deceptive trade practice. It also says existing rights under laws like the Colorado Anti-Discrimination Act are not reduced.

Does the law cover candidates who live outside Colorado?

The definition of consumer includes a job applicant who is a Colorado resident, plus any individual whose access to or opportunity in Colorado is evaluated in a consequential decision by a business operating in Colorado. Map your applicant pool against both parts with counsel.

Planning your 2027 hiring stack? Book a 20-minute demo to see how an adaptive AI interview reports its scores, or take a sample interview as a candidate would.