Quick Hit
Colorado’s landmark artificial intelligence law, previously covered here, has been replaced before it ever took effect. After years of concern over the implications of Colorado’s Anti-Discrimination in AI Law (the “CO AI Law”), which was set to take effect on June 30, the Governor of Colorado on May 14, 2026 signed into law SB 26-189, repealing the CO AI Law and replacing its broad “high-risk artificial intelligence system” framework with a narrower regime focused on automated decision-making technology used in consequential decisions. SB 26-189, described in more detail here, will apply to job applicants and employees who are residents of Colorado, in addition to any individual whose “access to, eligibility for, or opportunity in Colorado is evaluated in a consequential decision by a person doing business in Colorado.”
Key Takeaways
The CO AI Law has been a source of concern for employers since it was enacted in 2024. Had the law gone into effect, it would have imposed a host of onerous requirements, including implementation of risk management programs, impact assessments, annual reviews, and disclosures regarding algorithmic discrimination. SB 26-189 will eliminate many of these requirements and impose a far narrower framework focused on transparency, notice, disclosure, recordkeeping, and human review/reconsideration.
Employers that were preparing for the original law’s June 30, 2026 effective date should now shift their compliance planning toward SB 26-189’s obligations, which will become effective January 1, 2027. While the new law is significantly narrower, it does impose some requirements on employers regarding the use of AI tools. The new law will regulate the use of automated tools in employment decisions, and employers that use such tools in decisions related to hiring, promotion, compensation, or performance management should begin identifying which tools may be covered and what notices, records, and review processes may be required. We provide some thoughts on what employers should be thinking about as they prepare for SB 26-189’s effective date.
What Does SB 26-189 Require?
The law regulates “automated decision-making technology,” or ADMT. The law defines ADMT as technology that “processes personal data and uses computation to generate output,” including “predictions, recommendations, classifications, rankings, scores, or other information” used to “make, guide, or assist” a decision about an individual. Not every automated tool would be covered. The law excludes, among other things, calculators, databases, firewalls, spell-checking, certain spreadsheets, and tools used solely to “summarize, organize, translate, draft, route, or present information for human review of administrative processing.”
The law applies where ADMT is used to materially influence “consequential decisions,” including decisions relating to an individual’s access to, eligibility for, selection for, or compensation related to employment. The law defines “materially influence” to mean the ADMT output is a “non-de minimis factor” in the decision and affects the outcome, including by “constraining, ranking, scoring, recommending, classifying, or otherwise meaningfully altering” how the decision is made.
The law provides that, beginning January 1, 2027, employers using covered ADMT to materially influence consequential employment decisions would have notice, disclosure, recordkeeping, and review obligations. Specifically, deployers of ADMT will have to:
- retain records “for not less than three years after the date of a consequential decision,”
- provide “clear and conspicuous notice” that they “used or will use” covered ADMT in a consequential decision affecting the individual,
- following an adverse decision involving ADMT, provide within 30 days “a plain language description of the consequential decision and the role the covered ADMT played” and
- provide individuals the ability to request correction of “factually incorrect or materially inaccurate personal data” and seek “meaningful human review and reconsideration,” to the extent commercially reasonable.
Practice Pointers for Employers
Employers should consider taking the following steps to prepare for SB 26-189, ideally with the assistance of counsel:
- Determine whether the law applies to your business and, if so, whether to apply the law’s requirements uniformly. SB 26-189 applies only to Colorado resident applicants and employees and individuals who are evaluated in a consequential decision by a person doing business in Colorado. Even for employers without operations in Colorado, given the nature of web-based application systems, it would appear no employer can assume the law will not apply to them at all. Employers should consider whether it is feasible to limit application of the law’s requirements or to apply them uniformly across the United States.
- Know your AI tools. In order to ensure compliance, employers will need to have a concrete grasp of which AI tools they use, what data they use AI to process, what outputs AI is generating, how AI outputs are used by human decision-makers, and whether AI outputs “materially influence” employment decisions. Distinguishing between AI tools which merely assist with administrative tasks and AI agents that actually “materially influence” consequential employment decisions will likely become one of the most important compliance questions under the new law. If AI tools do not “materially influence” “consequential decisions,” the law’s requirements will not apply. Employers should expect that the analysis will be fact-specific, and an AI tool’s label will matter less than how it is actually used.
Employers should begin by identifying automated tools that relate to hiring, promotion, compensation, performance management, workforce planning, or other employment decisions, focusing not on whether a product is marketed as AI but instead on what the tools actually do. To determine how these tools function in practice, employers should investigate how the tools are being used by their employees.
Once employers understand their AI tools and how they are being used, they should carefully consider whether changes should be made to avoid application of the new Colorado law – i.e., ensure the AI tools do not “materially influence” “consequential decisions.”
- Prepare for implementation. The law has a host of requirements, such as notice, adverse-decision explanations, receiving and addressing correction requests, and meaningful human review. Employers have time – but not that much time – to figure out how to implement these requirements before the January 1, 2027 deadline. Given some of the nuances in the law and technical components, employers should not wait too long to begin planning to implement the law’s requirements.