AI in hiring · records and notices · updated 9 October 2026

AI in hiring: the records to keep and the notices to send

From 1 January 2027, an employer whose AI tool materially influences a hiring decision about a Colorado applicant must tell applicants before the tool is used, explain within 30 days each decision that went against someone, offer a correction and a person's review, and keep the records for three years. Colorado's SB 26-189 sets no minimum number of employees. California, Illinois and New York City already ask for some of this. These pages quote each law with its section and the date it was read, and give the notices and letters as templates to fill in.

What changes on 1 January 2027

A notice before use: that AI is or will be used in a decision about the applicant, and how to learn more. A prominent notice where people apply counts (6-1-1704(1)–(2)).
An explanation within 30 days of each adverse decision the tool materially influenced: what was decided, the role the tool played, how to ask for its name, version, developer and the personal data it used, and the applicant's rights (6-1-1704(3)).
On request: correction and a person's review. A way to correct inaccurate personal data, and meaningful human review and reconsideration where commercially reasonable (6-1-1705).
Records for three years after each decision (6-1-1703).
Gone from the 2024 law: the impact assessment, the risk-management programme and the duty of care (Epstein Becker Green).

“This act applies to consequential decisions made on or after January 1, 2027.”
SB 26-189, section 5(3)

Enforcement may start later. In xAI's suit against the law, the Attorney General agreed not to enforce it, or any law replacing it, until 14 days after a ruling on xAI's motion for a preliminary injunction, which is due within 28 days of the final rules (Proskauer, 11 May 2026). The act still applies to decisions made from 1 January 2027, and the three years of records run from each of them.

Does the law reach your tool?

It turns on what the tool does with applicants. A tool that scores, ranks, recommends, labels or rejects them is what the act's definition names. A tool that only summarizes, organizes or drafts for a person to read is excluded, if that is all it does. Whether a particular use crosses the line is for you and your counsel; the Attorney General's rules on it are due by 1 January 2027.

“An ADMT output is a non-de minimis factor that is used in making a consequential decision; and an ADMT output affects the outcome of a consequential decision, including by constraining, ranking, scoring, recommending, classifying, or otherwise meaningfully altering how a consequential decision is made.”
C.R.S. 6-1-1701(13)

“A tool used by an individual solely to summarize, organize, translate, draft, route, or present information for human review of administrative processing.”
C.R.S. 6-1-1701(2)(b)(II)

If you screen applicants in Claude or ChatGPT

Screening in a general-purpose assistant leaves no record in your applicant-tracking system. Anthropic's free Small Business plugin, for example, has a hiring-screener skill that scores applications against the job's rubric, sorts them into interview, maybe, no and cannot-assess bands, and drafts every reply. It writes no notice and no record, and its guidance for declines is "Kind and vague beats specific and untrue" (skill text, 15 Sep 2026). Colorado's proposed rules ask for the principal reasons stated with specificity.

The other laws

Law	From	What it asks of the employer
Colorado SB 26-189	1 January 2027	Notice before use; an explanation within 30 days of each adverse decision AI materially influenced; correction and a person's review on request; records for 3 years. No minimum number of employees.
California FEHA rules on automated-decision systems	1 October 2025	Automated-decision data, selection criteria and applications kept 4 years; anti-bias testing counts as evidence (Mayer Brown).
California CCPA rules on automated decisionmaking	1 January 2027	For CCPA businesses only (revenue over about $26.6 million, or large data volumes): a pre-use notice and a risk assessment (Littler).
Illinois HB 3773	1 January 2026	Notice when AI is used in employment decisions; no zip codes as a proxy. Notice rules were proposed and withdrawn in 2026 (EBG).
New York City Local Law 144	5 July 2023	An independent bias audit within a year before use, its public summary, and notice 10 business days before use (DCWP).
Connecticut SB 5	1 October 2027	Notice before an AI-informed employment decision (FordHarrison).

Templates

Colorado: the notice before use

Post it where people apply: on the careers page, next to the apply button, or linked from each job post.

How [Your business name] uses automated decision-making technology in hiring

[Your business name] uses the technology below in our hiring process, and it may be used in decisions about your application. We are telling you before it is used, so you know what it does and how to ask about it.

- [tool name], made by [who makes it], used in [where it is used, e.g. resume screening] for [which roles]: it [what it does with each application]. It uses [the personal data it uses], from [where that data comes from]. [Who reviews its output] reviews its output before a decision and can change the outcome.

To learn more about this technology, the personal data it uses and where that data comes from, contact [contact email or page].

If a decision is not in your favor and this technology played a material part in it, we will tell you within 30 days what was decided, the role the technology played, and how to ask for more. You can then ask us to correct personal data that is wrong, and ask for a person to review and reconsider the decision. To ask for a review, contact [who handles review requests].

If you need this in another format or language, or an accommodation in the application process, contact [contact email or page].

[Your business name]. Posted at [where this notice is posted]. Last updated [date].

Colorado AI Act hiring requirements: who is covered, what counts, and the four duties
AI hiring notice templates: Colorado, Illinois, New York City and California
The 30-day explanation after an adverse decision: the letter, with its template
AI impact assessment for hiring: Colorado dropped it; who still asks, and a worksheet

All of it, filled in from your own files, free

$ npx --allow-git=root github:agentwares/hiringrecord kit --ats your-ats-export.csv

An inventory of the AI tools in your hiring from your answers and your applicant-tracking export, the notices for each law that applies, the 30-day explanation and the review procedure, a risk-assessment worksheet and what to keep, as dated files with a SHA-256 manifest. Runs on your machine: no account, no upload, no AI. Also a Claude plugin and a local MCP server: github.com/agentwares/hiringrecord.

A continuous, hash-chained record of every hiring decision your AI tools touched, kept for the years the law asks, is not built

It would record each decision as it happens (the tool and its version, the outcome, the reviewer, the explanation sent and its date, review requests and what came of them) in okgate's hash-chained log, keep it three years for Colorado or four for California, track each 30-day clock, and export it for your counsel.

What exists today: the templates on these pages, which you keep yourself. okgate keeps a hash-chained log of the tool calls AI agents make through its proxy, not hiring decisions.

I want that record