What are the Colorado AI law requirements for employers?
By the InTheory team · Updated November 2026
Under SB 26-189, from January 1, 2027, Colorado employers that use automated decision-making technology to materially influence hiring, employment or pay decisions must notify people at the point of interaction, explain the tool's role within 30 days of an adverse outcome, allow data correction and human review, and keep records for three years. Not legal advice.
Does it apply to you
The law covers technology that processes personal data and produces predictions, scores, rankings or recommendations used to make or guide a decision about an individual. In employment, think of applicant screening that ranks candidates, tools that score interviews, or software that recommends pay or termination. A chatbot that answers staff questions about the holiday schedule is unlikely to be the target. Certain entities are exempt to the extent they comply with other legal obligations.
What employers would need to do
Give clear notice when a covered tool is used. After an adverse outcome, such as a rejected application, provide a plain-language description of the tool's role within 30 days. Honor requests for the personal data used and correction of factual errors. Offer meaningful human review and reconsideration. Keep compliance records for at least three years. Ask your software vendors for the technical documentation the law requires them to provide.
A sensible first step
List every hiring and HR tool you use and ask each vendor whether it uses automated scoring or ranking. Enforcement sits with the Colorado Attorney General under the Consumer Protection Act, and rules are still being written. This is general information, not legal advice. Confirm your obligations with an employment attorney.