Colorado's AI law for employers: what replaced the 2024 act

Colorado replaced its 2024 artificial intelligence act before it ever took effect. Senate Bill 26-189, signed on May 14, 2026, repealed and reenacted part 17 of article 1 of title 6 of the Colorado Revised Statutes as rules on automated decision-making technology (ADMT) in consequential decisions. From January 1, 2027, an employer or agency doing business in Colorado that uses ADMT to materially influence a hiring decision owes candidates a notice before use, a disclosure within 30 days after an adverse outcome, a route to correct inaccurate data and a chance at human reconsideration, plus three years of records. The risk management program and annual impact assessments in the old law are gone.

This guide works through the definitions that decide whether your hiring tools are covered, what each obligation means for a recruiting process, and gives notice wording you can adapt. It does not tell you whether your tool is a covered ADMT.

How Colorado got here

The Department of Law published a pre-rulemaking considerations document in June 2026 inviting informal input through July 13, 2026, and said formal notice-and-comment rulemaking, with at least one hearing, would start at the end of the summer. We could not load the department's rulemaking page when we checked in September 2026, so check coag.gov/ai for the current comment deadlines before you finalize notices.

Who is covered

• Deployer: "a person doing business in Colorado that deploys a covered ADMT." There is no headcount threshold in the text.
• Developer: a person doing business in Colorado that makes a covered ADMT commercially available, builds a component designed to be used as part of one, or intentionally and substantially modifies an ADMT so it becomes covered. Configure or retrain a vendor's tool enough and you can end up in this role.
• Consumer: the act says it "includes an employee, a job applicant who is a Colorado resident, and any individual whose access to, eligibility for, or opportunity in Colorado is evaluated in a consequential decision by a person doing business in Colorado." This is the opposite of the Colorado Privacy Act's usual exclusion of people acting in an employment context.
• Covered domain: includes "employment or an employment opportunity that creates or may create an employer-employee relationship," alongside education, housing, lending, insurance, health care and government benefits.

One open question for staffing firms: the employment domain is written around an employer-employee relationship. Whether placing independent contractors sits inside or outside that phrase is not resolved in the text, and the attorney general's rules may not address it either. If you place contractors into Colorado roles, raise it with counsel rather than assuming.

ADMT, covered ADMT, and "materially influence"

Three definitions do the work. All three have to line up before the obligations attach.

Automated decision-making technology

ADMT is "a technology that processes personal data and uses computation to generate output, including predictions, recommendations, classifications, rankings, scores, or other information that is used to make, guide, or assist a decision, judgment, or determination concerning an individual." The definition then carves out a list of ordinary software (anti-virus, calculators, databases, spell-checking, spreadsheets that require human analysis and do not use machine learning, foundation models or large language models, and others), plus "a tool used by an individual solely to summarize, organize, translate, draft, route, or present information for human review" and, subject to conditions, general conversational technology that is not marketed, configured or intended for use in a consequential decision and is covered by an acceptable use policy prohibiting that use.

Covered ADMT

A covered ADMT is ADMT "used to materially influence a consequential decision." That phrase is defined twice over: the output must be "a non-de minimis factor that is used in making a consequential decision" and must affect the outcome, "including by constraining, ranking, scoring, recommending, classifying, or otherwise meaningfully altering how a consequential decision is made." It "does not include incidental, trivial, or clerical uses."

What is not a consequential decision

The exclusions matter more to recruiters than the definition does. They include:

• low-stakes or routine decisions and business processes, expressly including "routine scheduling," administrative routing, communication of decisions and workflow management;
• actions in which an ADMT "is used to summarize, organize, or present information for human review and the system does not produce a score, ranking, recommendation, classification, prediction, or other inference that materially influences an outcome or a decision";
• narrow procedural tasks or data-processing functions that do not generate a prediction or inference about a person or materially influence a consequential decision.

Applying this to interview tools, feature by feature

Most interview software does several things at once. Ask the questions below about each feature, and write the answers down; the act's records duty assumes you can show your reasoning later.

The same questions apply to any vendor, including Interview Signal, whose scorecards attach ratings to evidence quotes from the transcript. Two things drive the answer: what the output is, and how much weight your process gives it. A rating a hiring manager glances at and a rating that decides who gets a second interview are the same feature with different legal consequences.

What deployers must do from January 1, 2027

1. Notice before use (§ 6-1-1704(1)). A clear and conspicuous notice that you used or will use a covered ADMT in a consequential decision affecting the person, with instructions for obtaining more information. You can meet this with a prominent public notice that is reasonably accessible at points of interaction, such as a link near the application form.
2. Post-adverse-outcome disclosure (§ 6-1-1704(3)). Within 30 days of the decision: a plain-language description of the decision and the technology's role; instructions and "a simple-to-follow process" to request more information, including the tool's name, version, developer and the types, categories and sources of personal data used, so far as the developer gave you that; and an explanation of the person's rights.
3. Correction and human review (§ 6-1-1705). On request after an adverse outcome, instructions for requesting personal data and correcting factually incorrect or materially inaccurate personal data, and "an opportunity for meaningful human review and reconsideration of the consequential decision, to the extent commercially reasonable." Correction does not extend to "opinions, predictions, scores, or protected evaluations."
4. Records (§ 6-1-1703). Keep records reasonably necessary to show compliance for at least three years after the consequential decision, including tool version identifiers, changelogs and documentation of mitigation changes.
5. Accessibility (§ 6-1-1704(8)). Notices and disclosures must be reasonably accessible to people with disabilities and people with limited English proficiency.

"Meaningful human review" has its own definition: a person the deployer designates who has authority to approve, modify or override the decision, who considers relevant available primary evidence, is trained to conduct the review, "does not default to the system output," and understands the output's intended use, material limitations, categories of inputs and principal factors. In a hiring process that means a named reviewer who is not the person who ran the tool, and a short record of what they looked at.

Notice wording to adapt

Two drafts. The first goes where candidates see it before they are assessed; the second goes out after a rejection in which a covered ADMT played a material part. Both are placeholders until the attorney general's rules land.

1. Point-of-interaction notice (careers page, application form,
   interview invitation)

How we use automated tools in hiring

For some roles we use [tool name], an automated decision-making
technology, to [what it does, e.g. score answers to screening questions]
as part of deciding who moves forward. A person reviews the output and
makes the decision.

If a decision about your application is affected by this technology, you
can ask us for more information about it, ask us to correct inaccurate
personal data we used, and ask for human review and reconsideration.
Contact [email] or [link].


2. Post-adverse-outcome disclosure (within 30 days of the decision)

Subject: Your application for [role] - how the decision was made

Hello [name],

On [date] we decided not to move your application for [role] forward.
[Tool name] (version [x]), made by [developer], was used in that
decision. It [plain-language role, e.g. scored your recorded answers
against the skills listed in the job description]. [Name/role] reviewed
that output and made the decision.

You can:
- Ask us for more information about the technology and the inputs,
  including the types, categories and sources of personal data used.
  Reply to this email or use [link].
- Ask us to correct personal data we used that is factually incorrect
  or materially inaccurate.
- Ask for human review and reconsideration of this decision.

We will respond [timeframe]. [Contact details.]

Enforcement, liability and contracts

• Attorney general only. Violations are enforced through the Colorado Consumer Protection Act, and the disclosure and rights provisions are "enforceable exclusively by the attorney general." A violation is a deceptive trade practice.
• Cure period. Before an enforcement action the attorney general must issue a notice of violation where a cure is deemed possible, with 60 days to fix it; that does not apply to knowing or repeated violations, and the cure provision itself is repealed effective January 1, 2030.
• No new private right of action, and no reduction of existing rights, including under the Colorado Anti-Discrimination Act. Using an ADMT "does not excuse, justify, or provide a defense to" obligations under other law, and compliance with part 17 is not a defense to anything else.
• Fault allocation. In discrimination actions, fault is allocated between deployers and developers by relative fault, and a developer is liable only where its tool was used as intended, documented, marketed, advertised, configured or contracted.
• Indemnities. A contract clause that indemnifies a party against liability for its own acts in violation of Colorado anti-discrimination law is void as contrary to public policy. Check your vendor agreements against that before renewal.

A plan for the months before January 2027

• Inventory every tool that touches Colorado applicants or employees, feature by feature, with what each outputs.
• For each output, write down whether it is a non-de minimis factor in a decision, who sees it and who can override it.
• Ask each vendor for the developer documentation the act requires from January 1, 2027: intended and known harmful uses, categories of training data, known limitations, instructions for monitoring and human review, and notice of material updates.
• Name the reviewers who will do meaningful human review, and train them. Record the training date.
• Draft the two notices, and decide where the pre-decision one lives: careers page, posting, application form or interview invitation.
• Set up a request channel and a 30-day clock for post-adverse-outcome disclosures, with a log.
• Extend record retention for hiring decisions involving these tools to at least three years, alongside federal recordkeeping duties.
• Re-read the attorney general's rules when they are adopted, then revise the notices.
• Keep interview notes clean while you are at it; see what not to write in interview notes.

Colorado is one part of a patchwork. New York City regulates automated employment decision tools through bias audits and notices, Illinois regulates AI analysis of recorded video interviews, and the EU takes a product safety approach. The state-by-state summary lines them up, with links to the Local Law 144, Illinois and EU AI Act guides.