Colorado's New AI Law: What Employers Need to Know About SB26-189 Before January 1, 2027

2 hours ago

4 min read

Introduction

Colorado employers who spent the past two years bracing for the sweeping obligations of SB 24-205 can breathe a partial sigh of relief — but not skip compliance planning altogether. On May 14, 2026, Governor Polis signed SB26-189, which repeals and replaces Colorado's original AI law before it ever took effect. The new law is narrower, but it still imposes real, actionable obligations on any employer using automated tools to help make decisions about applicants and employees.

Here is what employers need to know, where the pitfalls lie, and what to do now.

What the New AI Law Requires

SB26-189 applies to "covered automated decision-making technology" (ADMT) — broadly, any technology that processes personal data and generates predictions, recommendations, rankings, scores, or similar outputs used to make or materially influence a "consequential decision." For employers, that includes AI tools used in hiring, promotion, compensation, performance management, and termination decisions — whether formally adopted by the company or informally used by individual managers or recruiters.

The law splits obligations between developers (who build or sell the technology) and deployers (employers who use it). As a deployer, an employer will generally need to:

Provide clear and conspicuous notice to applicants and employees, at the point of interaction, that a covered ADMT is or will be used to influence a consequential decision about them.
Explain adverse outcomes. Within 30 days of an adverse decision materially influenced by covered ADMT, the employer must provide a plain-language explanation of the tool's role in that decision.
Offer meaningful human review of the decision when an individual requests it, and provide a way to correct materially inaccurate personal data used by the system.
Retain records sufficient to demonstrate compliance for at least three years.
Obtain documentation from AI vendors (developers) describing the tool's intended use, known limitations, training data categories, and instructions for appropriate human review, and stay alert for vendor notices of material updates to the tool.

The Attorney General is required to issue clarifying rules — including on what counts as "materially influence" — by January 1, 2027, the same day the law takes effect, so some interpretive detail will arrive late in the game.

Pitfalls to Watch For

"We don't use AI" may be a wrong answer. The law reaches informal and shadow use of AI just as much as sanctioned enterprise tools. If a hiring manager is running resumes through a chatbot to rank candidates, or performance software has a built-in scoring feature nobody flagged as "AI," that use is covered.

No private cause of action, but real exposure elsewhere. SB26-189 itself is enforced only by the Colorado Attorney General and carries no private right of action. That is not a safe harbor: employers can still face discrimination claims under Title VII, the Colorado Anti-Discrimination Act, and disparate-impact theories if an AI tool produces biased outcomes. The AG-enforcement structure also allocates fault between developers and deployers in those underlying discrimination suits, so vendor contracts matter.

Difficulty obtaining Vendor documentation. Deployers are entitled to documentation from developers, but many current AI vendors — particularly smaller HR-tech providers — are not yet set up to produce it. Employers who wait until January to ask will be negotiating from a position of urgency.

The 30-day adverse-outcome clock. Employers need a process to identify when a decision was "materially influenced" by ADMT and to generate a compliant explanation within 30 days — a tight window if HR and IT haven't coordinated in advance.

Proactive Steps to Take Now

1. Inventory your AI touchpoints. Catalog every tool used anywhere in the employee lifecycle — applicant tracking systems, resume screeners, chatbot interviewers, scheduling and scoring tools, performance-management software — including informal or trial use by individual teams.

2. Classify each tool against the statute's definitions and exclusions (routine tools like spell-check, spreadsheets, and calculators are excluded; tools that materially influence hiring, pay, promotion, or termination are not).

3. Contact your vendors now to request the technical documentation the law will require, and add compliance obligations to any AI-related vendor contracts up for renewal.

4. Draft notice and disclosure language for applicants and employees, and identify where it needs to appear (job postings, offer portals, employee handbooks, HR platforms).

5. Build an internal adverse-outcome workflow so HR can quickly identify AI-influenced decisions, generate the required explanation, and route human-review requests within the 30-day window.

6. Train recruiters, managers, and HR staff on what qualifies as covered ADMT — informal use is the easiest compliance gap to miss.

7. Consider keeping a lightweight impact assessment process even though it is no longer mandatory; it will make required explanations easier to produce and can help defend against disparate-impact claims under other laws.

The Bottom Line

SB26-189 is far less burdensome than the framework it replaced, but "less burdensome" is not "no obligation." Employers using AI anywhere in their employment decisions — even informally — should use the runway between now and January 1, 2027 to inventory their tools, engage their vendors, and build the notice and review processes the law will require. Waiting for the Attorney General's rules before acting will leave too little time to operationalize compliance.

This post is for general informational purposes only and does not constitute legal advice. Employers with questions about their specific AI tools and compliance obligations should consult counsel.

THANK YOU FOR READING!

Do you have questions regarding this topic? Please contact us today!