Colorado AI Act hiring requirements

Colorado repealed its 2024 AI Act and replaced it with SB 26-189, signed on 14 May 2026. For hiring, it applies to decisions made on or after 1 January 2027 by anyone doing business in Colorado whose AI tool materially influences a decision about a Colorado applicant or an opportunity in Colorado. The employer must give notice before the tool is used, explain each adverse decision within 30 days, offer correction and a person's review, and keep records for three years. The impact assessment of the 2024 law is gone, and there is no minimum number of employees.

Who is covered

“"Consumer" includes an employee, a job applicant who is a Colorado resident, and any individual whose access to, eligibility for, or opportunity in Colorado is evaluated in a consequential decision by a person doing business in Colorado.”

C.R.S. 6-1-1701(4)(b)

The act defines a deployer as "a person doing business in Colorado that deploys a covered ADMT" and sets no headcount. Some guides say employers with 40 or fewer employees are exempt; the signed act has no such threshold, and neither do the Attorney General's draft rules (Available Law, 12 Aug 2026).

Which tools count

“An ADMT output is a non-de minimis factor that is used in making a consequential decision; and an ADMT output affects the outcome of a consequential decision, including by constraining, ranking, scoring, recommending, classifying, or otherwise meaningfully altering how a consequential decision is made.”

C.R.S. 6-1-1701(13)

“A tool used by an individual solely to summarize, organize, translate, draft, route, or present information for human review of administrative processing.”

C.R.S. 6-1-1701(2)(b)(II)

• Likely in: a screener that scores, ranks or bands résumés; a match or fit score in your applicant-tracking system; knockout questions that reject automatically; an assessment that scores answers.
• Likely out, if that is all it does: a tool that summarizes interview notes, drafts a job post, or schedules interviews.
• Ask counsel about anything in between. The Attorney General may add presumptions and examples for "materially influence" by rule.

The four duties

“Prior to a deployer using a covered ADMT to materially influence a consequential decision, the deployer shall provide a clear and conspicuous notice to a consumer that the deployer used or will use a covered ADMT in a consequential decision affecting the consumer and instructions regarding how the consumer may obtain the additional information described in this section.”

C.R.S. 6-1-1704(1)

“If a deployer uses a covered ADMT to materially influence a consequential decision that results in an adverse outcome for a consumer, the deployer shall provide within thirty days after making the decision: (a) a plain language description of the consequential decision and the role the covered ADMT played in the consequential decision; (b) instructions and a simple-to-follow process to request additional information about the covered ADMT and the inputs, including the name of the covered ADMT, the covered ADMT version number, if applicable, the covered ADMT developer, and the types, categories, and sources of personal data used …; and (c) an explanation of the consumer rights described in section 6-1-1705 and how to exercise them.”

C.R.S. 6-1-1704(3)

• Rights on request (6-1-1705): instructions to get and correct inaccurate personal data, and meaningful human review and reconsideration, to the extent commercially reasonable. The reviewer is designated, trained, can override, considers the primary evidence and does not default to the tool's output (6-1-1701(15)).
• Accessibility (6-1-1704(8)): notices reasonably accessible to people with disabilities and people with limited English proficiency.

“A deployer shall retain, for not less than three years after the date of a consequential decision or for a longer period if required by applicable state or federal law, records reasonably necessary to demonstrate compliance with this part 17.”

C.R.S. 6-1-1703

What is still moving

Proposed, not final: the Colorado Attorney General's draft rules (4 CCR 904-6, filed 11 August 2026, revised 23 September and 6 October; hearing 26 October 2026) ask for the principal reasons stated with specificity, the explanation delivered through at least two of the channels normally used with the person, and a request for review acknowledged within 10 days and completed within 45. The final rules are due by 1 January 2027.

Enforcement may start later. In xAI's suit against the law, the Attorney General agreed not to enforce it, or any law replacing it, until 14 days after a ruling on xAI's motion for a preliminary injunction, which is due within 28 days of the final rules (Proskauer, 11 May 2026). The act still applies to decisions made from 1 January 2027, and the three years of records run from each of them.

The notice, as a template

How [Your business name] uses automated decision-making technology in hiring

[Your business name] uses the technology below in our hiring process, and it may be used in decisions about your application. We are telling you before it is used, so you know what it does and how to ask about it.

- [tool name], made by [who makes it], used in [where it is used, e.g. resume screening] for [which roles]: it [what it does with each application]. It uses [the personal data it uses], from [where that data comes from]. [Who reviews its output] reviews its output before a decision and can change the outcome.

To learn more about this technology, the personal data it uses and where that data comes from, contact [contact email or page].

If a decision is not in your favor and this technology played a material part in it, we will tell you within 30 days what was decided, the role the technology played, and how to ask for more. You can then ask us to correct personal data that is wrong, and ask for a person to review and reconsider the decision. To ask for a review, contact [who handles review requests].

If you need this in another format or language, or an accommodation in the application process, contact [contact email or page].

[Your business name]. Posted at [where this notice is posted]. Last updated [date].

$ npx --allow-git=root github:agentwares/hiringrecord kit --ats your-ats-export.csv