BLOG OVERVIEW: Colorado repealed the Colorado Artificial Intelligence Act (SB 24-205) before it took effect and replaced it with SB 26-189, a narrower Automated-Decision-Making Technology law that becomes operative January 1, 2027. The new framework drops the duty of reasonable care, impact assessments, the mandated risk management program, and Attorney General notification, substituting advance notice, adverse-outcome disclosure, meaningful human review, three-year recordkeeping, and developer documentation obligations. Enforcement sits exclusively with the Attorney General under the Colorado Consumer Protection Act, with a 60-day cure period and no private right of action, while Title VII, ADEA, ADA, and Colorado Anti-Discrimination Act exposure, disparate impact included, remains fully intact.
On May 14, 2026, Colorado’s Governor signed SB 26-189 into law, repealing a previously signed artificial intelligence (AI) law, the Colorado Artificial Intelligence Act (SB 24-205), before it ever took effect. The new law becomes operative January 1, 2027.
SB 26-189, often referred to as Colorado’s Automated-Decision-Making Technology (ADMT) law, is substantially narrower than SB 24-205, the framework it replaces. It removes several of the original law’s broader risk-management and impact-assessment requirements and instead focuses on a smaller set of obligations tied to covered automated decision-making technology, including notice, disclosures, human review, recordkeeping, and developer documentation. The result is a more targeted compliance framework, but it does not eliminate employers’ existing obligations under federal and state anti-discrimination laws.
The new law regulates covered automated decision-making technology that processes personal data and uses computation to produce output such as scores, rankings, recommendations, classifications, or predictions that materially influences a consequential decision. It excludes certain low-stakes or routine and assistive business technologies, such as calculators, databases, spell-checking, and spreadsheets that do not use machine learning.
In the employment context, a consequential decision is a decision, determination, or action that relates to a consumer’s access to, eligibility for, or compensation related to employment or an employment opportunity. Notably, “consumer” is defined to expressly include Colorado employees and job applicants.
The statute establishes the requirements, while the Attorney General’s rulemaking fills in important implementation details. Because the final rules are not yet in place, some of the requirements described below remain subject to change.
Deployer (Employer) and Developer Obligations
Under the proposed framework, businesses that deploy covered ADMTs have several obligations:
Advance notice: Before a covered ADMT is used, employers must give clear and conspicuous notice that it will factor into a decision affecting the individual, along with instructions for obtaining more information. The notice must be accessible to individuals with disabilities and limited English proficiency.
Adverse-outcome disclosure: When a covered ADMT materially influences a decision with an adverse outcome (e.g., denials, terminations, reduced compensation or benefits, being made ineligible or less likely to be selected, or receiving materially worse terms than similarly situated individuals), the employer has 30 days to provide to the consumer a plain-language description of the ADMT’s role, a simple process for requesting additional information, and an explanation of the individual’s rights.
Meaningful human review: After an adverse outcome, an individual may request instructions for accessing and correcting factually incorrect or materially inaccurate personal data (i.e., information that is linked or reasonably linked to an identified or identifiable individual) used in the decision. The obligation does not extend to opinions, scores, or predictions. Individuals may also request human review, where commercially reasonable, meaning a review by someone with authority to approve, modify, or override the decision, who is trained, considers available evidence, and does not simply defer to the machine.
Recordkeeping: Deployers must retain records reasonably necessary to demonstrate compliance for at least three years from the date of the decision.
Developers, on the other hand are required to provide deployers with:
Technical documentation covering the ADMT’s intended uses
Categories of training data
Known limitations
Guidance on appropriate use and human review
They must also notify deployers of any material updates to the product.
Eliminated Requirements
The deletions are just as significant as the additions and include removal of the following requirements from the original law:
The duty of reasonable care to protect against algorithmic discrimination
Annual impact assessments and assessments within 90 days of a substantial modification
The mandated risk management program aligned to the NIST AI RMF or ISO 42001
The obligation to notify the Attorney General of discovered algorithmic discrimination within 90 days
The public summary of high-risk systems deployed
The small-employer exemption for deployers with fewer than 50 full-time employees (which expands the scope of this law in comparison to the previous)
The bill does not create a private right of action, and the Attorney General has exclusive enforcement authority, treating violations as deceptive trade practices under the Colorado Consumer Protection Act. A notice of violation and 60-day cure period are required for curable violations, with no cure available for known or repeated violations.
It is important to note that SB 26-189 does not limit existing rights or remedies under other state or federal law. Title VII of the Civil Rights Act, the Age Discrimination in Employment Act (ADEA), the Americans with Disabilities Act (ADA), and the Colorado Anti-Discrimination Act all still apply, disparate impact theories included, and both developers and deployers can face liability for consequential decisions materially influenced by covered ADMT.
The bill also clarifies how fault should be allocated between developers and deployers in civil actions alleging unlawful discrimination under existing law, such that a developer can be held liable if their covered ADMT is used by a deployer as intended or contracted for by the developer. A deployer, on the other hand, can be held liable if their use of the covered ADMT was not intended or contracted for by the developer. It also says that any contract clause that tries to indemnify a developer or deployer from liability for its own ADMT-related discrimination violations is automatically void.
Next Steps for Employers
As mentioned above, rulemaking is already underway. The Attorney General’s office filed proposed ADMT rules with the Secretary of State on August 11, 2026, providing two competing standards for when a tool “materially influences” a decision, and spelling out what post-adverse-outcome disclosures must contain and what “meaningful human review” requires. A revised draft is due by September 23, with a formal rulemaking hearing set for October 26 and written comments open through that date. Final rules are still due before the law takes effect, but that may leave employers only weeks between the final text and the compliance deadline to prepare. Some reasonable steps to take now may include:
Inventory your tools to determine which technologies generate scores, rankings, or recommendations that are likely to qualify as materially influencing employment decisions, and which are likely to fall into the assistive carve-out.
Confirm vendor documentation and contract terms. Developers will need to provide deployers with documentation on intended uses, training data categories, known limitations, and guidance for monitoring and human review. Employers should confirm that relevant vendors can provide this information and revisit indemnification provisions in light of the new allocation of liability.
Build the notice and adverse-action workflows, which may include job posting and careers-page language, a 30-day disclosure template, and an intake path for information, correction, and human review requests.
Update retention policies to hold compliance records, ADMT version identifiers, and change logs for three years.
Validate your tools. The statute no longer requires bias testing, but employers still need to consider whether their selection procedures are job-related and valid for their intended use. Adverse impact analysis is an important part of that assessment: when a tool produces adverse impact, employers should be prepared to demonstrate the procedure’s validity and job relatedness under the discrimination laws that SB 26-189 left intact.
DCI will continue to monitor developments regarding the use and regulation of AI tools in employment. For more resources, access our complimentary AI Toolkit.