Colorado's automated decision-making law and work: what SB 26-189 means for employers and job seekers

Colorado's 2024 AI law, SB 24-205, never took effect. In May 2026 the state repealed and reenacted it as Senate Bill 26-189, which regulates automated decision-making technology (ADMT) used in consequential decisions, including decisions about employment (SB 26-189). This page explains how the signed act applies at work, for job seekers, employees, employers and the vendors who build the tools.

The short answer: the act takes effect on 1 January 2027 and applies to consequential decisions made on or after that date (SB 26-189, section 5). An employer that uses covered ADMT to materially influence an employment decision must give notice beforehand. After an adverse outcome, it must explain the decision and the tool's role within 30 days, and it must offer a way to correct inaccurate personal data and a meaningful human review (C.R.S. 6-1-1704, 6-1-1705). The Attorney General enforces it, and it creates no new private right of action (6-1-1706, 6-1-1709).

When the act applies at work

• ADMT: a technology that processes personal data and uses computation to generate output, including predictions, recommendations, classifications, rankings or scores, used to make, guide or assist a decision about an individual (6-1-1701(2)(a)). Excluded are tools such as anti-virus, calculators, databases, spell-checking, and spreadsheets that need human analysis and do not use machine learning or language models, as well as a tool an individual uses only to summarize, organize, translate, draft, route or present information for human review (6-1-1701(2)(b)).
• Employment is a covered domain: "employment or an employment opportunity that creates or may create an employer-employee relationship" (6-1-1701(6)(b)).
• Consequential decision: a decision about a person's access to, eligibility for, selection for or compensation in a covered domain, or about pay or other material terms in a way reasonably likely to materially limit or alter that access (6-1-1701(3)(a)). Low-stakes or routine processes are excluded, with examples including routine scheduling, administrative routing and workflow management, as is advertising and marketing (6-1-1701(3)(b)).
• Materially influence: the tool's output is a non-de minimis factor used in the decision and affects the outcome, including by constraining, ranking, scoring, recommending or classifying. Incidental, trivial or clerical uses do not count (6-1-1701(13)).
• Who is protected: a "consumer" includes an employee and a job applicant who is a Colorado resident (6-1-1701(4)(b)).

What employers (deployers) must do

• Notice before use: a clear and conspicuous notice that covered ADMT is or will be used in a consequential decision, with instructions on how to get more information. A prominent public notice reasonably close to the point of interaction, such as a link on the application page, can satisfy this (6-1-1704(1)-(2)).
• After an adverse outcome: within 30 days, a plain language description of the decision and the tool's role, a simple process to request more information (including the tool's name, version, developer and the types, categories and sources of personal data used), and an explanation of the person's rights (6-1-1704(3)). An adverse outcome includes a decision that denies, terminates or materially reduces access to, selection for or compensation for an opportunity (6-1-1701(1)).
• Accessibility: notices must be reasonably accessible to people with disabilities and people with limited English proficiency (6-1-1704(8)).
• Records: keep records reasonably necessary to show compliance for at least three years after each decision (6-1-1703).
• Trade secrets: not required to be disclosed, but the person must be told if information is withheld (6-1-1704(5)).

Rights for job seekers and employees

After an adverse outcome where covered ADMT materially influenced the decision, a person can request, and the employer must provide:

• instructions for requesting their personal data and correcting factually incorrect or materially inaccurate personal data used in the decision; this does not extend to opinions, predictions, scores or protected evaluations (6-1-1705(1)(a)(I), (1)(c));
• an opportunity for meaningful human review and reconsideration, to the extent commercially reasonable (6-1-1705(1)(a)(II)).

"Meaningful human review" means review by a trained person with authority to approve, modify or override the decision, who considers relevant primary evidence, does not default to the system output and has enough information to understand the output's intended use, limitations, input categories and principal factors (6-1-1701(15)).

What vendors (developers) must do

From 1 January 2027, a developer must give deployers documentation on intended and known harmful uses, categories of training data, known limitations, instructions for use, monitoring and human review, and information the deployer needs for its own disclosures. It must notify deployers of material updates and keep records for three years (6-1-1702).

Enforcement and discrimination claims

• Attorney General only: violations are deceptive trade practices under the Colorado Consumer Protection Act, and the disclosure and rights provisions are enforceable exclusively by the Attorney General (6-1-1706(1)-(2)).
• Right to cure: until 1 January 2030, the Attorney General must first issue a notice of violation where a cure is deemed possible and allow 60 days, except for knowing or repeated violations (6-1-1706(3)).
• Existing rights stay: the act creates no new private right of action, but does not limit existing rights, including under the Colorado Anti-Discrimination Act (6-1-1706(4)).
• Sharing fault: in a discrimination action arising from a decision materially influenced by covered ADMT, fault is allocated between employer and vendor by relative fault, and contract terms that would generally hold a vendor or employer harmless for its own acts in breach of Colorado anti-discrimination law are void (6-1-1707(1)-(2), (7)).
• No defense: using ADMT does not excuse or justify any obligation or liability under state or federal law, including on discrimination (6-1-1707(9)).

The Attorney General must adopt rules on the post-adverse outcome disclosures and the consumer rights by 1 January 2027 (6-1-1704(4), 6-1-1705(3)). Check those rules before setting up notices.

Practical steps

• Employers: list tools that score, rank or filter candidates and staff, decide which materially influence decisions, add notice to application and HR pages, set up a 30-day adverse outcome process with trained reviewers, and ask vendors for the developer documentation.
• Job seekers and employees: look for the notice, keep any adverse outcome explanation, and ask for correction of wrong data and for human review.

For other US rules, see NYC Local Law 144, Illinois AI hiring laws, California AI employment rules and AI in hiring. For Colorado's rules on fingerprint and face data at work, see Colorado biometric data at work.

This page covers Colorado and is general information based on the signed text of SB 26-189 as published by the Colorado General Assembly when checked on 3 November 2026, not legal advice.