Colorado Replaced Its AI Hiring Law: What SB 26-189 Requires Before 2027

A lot of compliance calendars still list 30 June 2026 as the day Colorado's AI Act starts. That date is a leftover. Senate Bill 24-205 never became operative. On 14 May 2026 Governor Jared Polis signed Senate Bill 26-189, which repeals the 2024 act and replaces it with a narrower automated-decision-making law. The new duties start on 1 January 2027.

If you screen Colorado applicants with a ranking or scoring tool, the practical change is smaller than the headlines from 2024, and it is still real. Impact assessments, a mandated risk-management program, a public summary of deployed systems, and a duty to tell the Attorney General about algorithmic discrimination are gone. Notice, a 30-day adverse-outcome disclosure, a path to correct bad inputs, human review where it is commercially reasonable, and three years of records are in.

This is a working note for hiring teams, not a substitute for counsel. The Attorney General filed proposed rules on 11 August 2026, with a formal rulemaking hearing set for 26 October 2026. Final rules are due before the law takes effect, so some of the "how" below can still move.

What the replacement actually regulates

SB 24-205 talked about high-risk artificial intelligence systems and a duty of reasonable care to avoid algorithmic discrimination. SB 26-189 drops that frame. It regulates covered automated decision-making technology: technology that processes personal data and uses computation to produce an output (a prediction, recommendation, classification, ranking, score, or similar) used to make, guide, or assist a decision about a person, when that output materially influences a consequential decision.

In employment, a consequential decision is one about access to, eligibility for, selection for, or compensation for a job or an employment opportunity. "Consumer" expressly includes Colorado employees and job applicants.

A spreadsheet that does not use machine learning, a spellchecker, a calculator, or a plain database is outside the definition. A resume ranker that produces a score the recruiter uses to decide who gets a screen is the kind of tool the statute is aimed at, if that score is more than a trivial factor in the outcome. The Attorney General is writing the rule for "materially influence." Until that rule is final, treat any ranking you actually rely on as in scope and document why you think a given tool is only assistive.

Two scope limits matter for multi-state teams:

• The employment rules do not cover independent contractors, and they do not cover candidates who are not Colorado residents.
• They also do not cover Colorado candidates if the employer does no business in Colorado.

The small-deployer exemption is the other way around. SB 24-205 spared deployers with fewer than 50 full-time employees. That carve-out is gone, so a five-person company hiring in Denver is in the same notice regime as a national employer.

What you no longer have to build

Teams that spent early 2026 drafting Colorado impact assessments can stop that project. Compared with the repealed act, SB 26-189 removes:

Dropping those duties does not drop Title VII, the Age Discrimination in Employment Act, the Americans with Disabilities Act, or the Colorado Anti-Discrimination Act. Disparate-impact claims still exist. A tool can be fully "SB 26-189 compliant" on notices and still be an unlawful selection procedure. The four-fifths rule is still the usual first check, and the mechanisms in bias in AI hiring did not get repealed with the statute.

The four deployer duties that remain

Notice before the tool is used

Before covered ADMT materially influences a decision, the employer has to give clear and conspicuous notice that the tool was or will be used, plus instructions for getting more information. One permitted route is a link or posting reasonably close to the interaction where the decision can occur: the application form, not a policy page three clicks away. The notice has to be accessible to people with disabilities and to people with limited English proficiency.

For a careers site, that usually means a short block on the apply page naming the screening step, saying a scoring or ranking tool may be used, and linking to a page that explains how to ask for more detail. Pair it with the candidate-facing language in when to tell candidates you use AI. NYC Local Law 144 still wants its own notice and audit for automated employment decision tools used in the city; Colorado's notice does not satisfy that audit. See the NYC Local Law 144 guide if you hire in both places.

Adverse-outcome disclosure within 30 days

If covered ADMT materially influenced a decision with an adverse outcome, the employer has 30 days to send a plain-language description of the decision and the role the tool played, instructions for requesting more information, and an explanation of the person's rights.

Adverse outcome is broader than a form rejection. The statute's examples include being denied, terminated, paid less, made ineligible or less likely to be selected, or given materially worse terms than similarly situated people. A ranking that keeps someone out of the interview pile is the case most screening teams will hit.

The follow-up information, when requested, covers the tool's name, version, developer, and the types, categories, and sources of personal data used. Build this as a template, not as a one-off email from whoever is on inbox duty. Thirty days is short if the only record of "why this person was screened out" is a score that nobody exported.

Correction and human review, on request

After an adverse outcome the person can ask for the personal data used in the decision and can correct data that is factually wrong or materially inaccurate. Opinions, predictions, scores, and protected evaluations are not correctable. A wrong employment date is. A model score of 62 is not.

They can also ask for meaningful human review and reconsideration, to the extent commercially reasonable. The reviewer has to be trained, has to have authority to approve, modify, or override the decision, has to look at available evidence, and must not simply defer to the output. Proposed rules are expected to spell out what that training and that review look like. A recruiter who opens the ranked list, nods, and sends the rejection is the pattern the statute is written against.

Commercially reasonable is a limit, not a waiver. A company that screens 2,000 retail applications a week should still have a request path and a person who can pull the parsed resume, compare it to the source file, and advance someone the ranker buried. Volume is a reason to design the path, not a reason to skip it.

Records for three years

Deployers keep records reasonably necessary to show compliance for at least three years after the consequential decision. The statute points at covered ADMT version identifiers, changelogs, and documentation of material mitigation changes. In practice, also keep the notice text that was live on the day of application, the adverse-outcome disclosure if you sent one, and the human-review notes if someone asked.

Three years is longer than many ATS default purge settings. If your candidate data retention policy deletes applications at 12 months, Colorado hiring needs an exception, or a separate compliance store, for the records this statute names. GDPR and similar rules can push the other direction on applicant data you no longer need. The two clocks have to be reconciled in the policy, not discovered during a deletion request.

Developers, vendors, and the contract clause that will not save you

If you buy screening software rather than build it, the vendor is the developer. Developers have to give deployers technical documentation on intended uses, categories of training data, known limitations, and guidance on appropriate use and human review, and they have to notify deployers of material updates.

Ask for that pack before January. A ranker with no version id and no changelog makes the three-year record duty hard to meet.

Liability for discrimination is split by fault, not joint and several. A developer can be liable if the tool was used as intended, documented, marketed, configured, or contracted. A deployer can be liable if the use was outside what the developer intended or contracted. A contract clause that tries to indemnify either side for its own ADMT-related discrimination violation is void. Indemnity for a deployer that used the tool off-label can still stand. Have someone read the vendor paper against that rule before you assume the MSA moved the risk.

A setup you can finish before the rules land

Rulemaking will fill in notice wording and the human-review standard. The inventory and the plumbing do not need the final rule.

1. List every tool that emits a score, rank, match, or recommendation in hiring, pay, or selection. Mark which ones a human can ignore and which ones quietly become the cutoff. Assistive tools that never change who gets seen can stay off the covered list, with a note saying why.
2. For each covered tool, record the developer, version, what personal data goes in, and what the output is used for. Store the vendor's limitation notes next to it.
3. Add the point-of-interaction notice to every Colorado application path, including agency-fed roles if you are the deployer.
4. Write the 30-day disclosure and the intake form for correction and review requests. Name the person who has override authority.
5. Change retention so version ids, notices, disclosures, and review notes survive three years after the decision.
6. Keep a selection-rate check on the tool anyway. The statute no longer orders a bias audit. The discrimination statutes still care whether the procedure is job-related. Our AI hiring audit checklist is the working version of that check.

Resume World sits on the deployer side of this if you use it to rank or score Colorado applicants: the notice, the explanation of which requirements a candidate met, and an export you can keep are the parts that make the 30-day letter and the human review possible. The product does not file anything with the Attorney General, and it does not replace the decision.

How this sits next to other 2026–27 rules

Colorado is no longer the strictest US template. NYC Local Law 144 still wants an independent bias audit and candidate notice for automated employment decision tools. The EU AI Act still treats recruitment systems as high risk, with its own transparency and oversight duties, covered in AI hiring compliance in 2026. California is on a different track: Civil Rights Council automated-decision-system rules under FEHA took effect on 1 October 2025 for employers with five or more employees, CCPA automated-decisionmaking rules arrive for in-scope businesses on 1 January 2027, and Senate Bill 947 (the "No Robo Bosses Act"), signed on 30 September 2026, limits sole reliance on automated systems for discipline and termination from 1 July 2027.

A single global "AI hiring policy" that quotes the repealed Colorado act will be wrong in both directions: too heavy on impact assessments, too light on the 30-day adverse letter. Write the Colorado annex against SB 26-189, and date it.

What to do this quarter

The operative date is 1 January 2027. The hearing on the proposed rules is 26 October 2026, with written comments open through that date. Final text may land close to the deadline.

Between now and then, the useful work is the inventory, the apply-page notice, the rejection template, the named reviewer, and the retention exception. Those survive a tighter or looser definition of "materially influence." An impact-assessment binder written for SB 24-205 does not.

More on hiring rules

• AI Hiring Compliance in 2026: EU AI Act, NYC LL144, and What to Do Now
• NYC Local Law 144: Bias Audits and Candidate Notice
• Bias in AI Hiring: The Three Mechanisms, and How to Test for Them
• The Four-Fifths Rule in Hiring: How to Calculate It and What It Does Not Prove
• AI Hiring Audit Checklist: What to Test Before You Trust a Score
• When to Tell Candidates You Use AI in Screening
• How Long to Keep Candidate Data
• GDPR and Recruitment Data: What Hiring Teams Actually Have to Do