Colorado Rewrites Its Primary AI Law: What Employers Need to Know Before 2027
John Agbonika, Associate
On May 14, 2026, Colorado Governor Jared Polis signed Senate Bill 26-189 (“SB 26-189”)[1] into law, which repeals the SB 24-205 but reenacts that law’s overall objective of providing consumer protection when interacting with Artificial Intelligence (“AI”) systems. SB 26-189 narrows Colorado’s AI framework but still creates important obligations for employers that use automated decision-making technology (“ADMT”) in hiring, promotion, compensation, discipline, termination, or other employment-related decisions. SB24-205 required employers to use reasonable care to protect consumers, including employees and applicants, from algorithmic discrimination[2] by implementing risk-management policies and programs to govern their deployment of high-risk artificial intelligence systems,[3] conducting annual impact assessments,[4] and making public disclosures regarding their use of high-risk artificial intelligence systems. SB 26-189 replaces that broad framework with more targeted obligations, including disclosure requirements, data access and correction rights, meaningful human review, vendor documentation, and recordkeeping. Before January 1, 2027, employers using AI or ADMT should identify covered systems, update vendor agreements, and build internal processes for explaining and reviewing AI-influenced employment decisions.
Background
In previous blogs,[5] we discussed SB 24-205 and its increasing scrutiny from business groups, technology companies, and employers concerned about the breadth and practical application of the law. It sought to regulate “high-risk” artificial intelligence (“AI”) systems used in important decisions affecting individuals, including decisions related to employment, housing, lending, education, healthcare, insurance, and government services. SB 24-205 required developers and deployers of high-risk AI systems to use reasonable care to protect consumers from known or reasonably foreseeable risks of algorithmic discrimination. For deployers and developers,[6] including employers using AI tools, the law would have required a risk management program, annual impact assessments, annual reviews, consumer notices, opportunities to correct data, and opportunities to appeal adverse decisions through human review when technically feasible.
Although Governor Polis signed SB 24-205 into law, various stakeholders, including legislators and industry groups expressed concern that SB 24-205 created a complex compliance structure that could be difficult for businesses to implement.[7] The implementation date was later delayed from February 1, 2026 to June 30, 2026. The pressure increased in 2026 when xAI filed a federal lawsuit challenging SB 24-205.[8] The Colorado Attorney General then temporarily delayed enforcement pending the legislature’s consideration of necessary revisions to the bill. Against that background, the General Assembly passed SB26-189 and it was signed into law on May 14, 2026.
Key Provisions of SB 26-189
First, SB 26-189 seeks to regulate ADMTs,[9] only when it is used to materially influence a “consequential decision.” “Material influence” refers to an ADMT output that is a non-de minimis (non-trivial) factor in the decision making process, and a “consequential decision” includes a decision related to an individual’s access to, eligibility for, or compensation related to employment, education, housing, financial or lending services, insurance, healthcare services, or essential government services. For employers, this means the law may apply when an ADMT materially influences employment decisions such as hiring, screening, promotion, compensation, discipline, termination, or other decisions affecting employee’s or applicant’s employment opportunities. See Colo. Rev. Stat. § 6-1-1701(13).
Second, SB26-189 removes several of SB 24-205’s broader compliance obligations including its “reasonable care” framework targeting algorithmic discrimination, mandatory risk management program and annual impact assessment requirements. Lastly, SB 26-189 does not create a private right of action but permits the Colorado Attorney General to enforce the law through the Colorado Consumer Protection Act, with violations treated as deceptive trade practices.[10]
Employer Obligations Under SB26-189
1. Notice at the Point of Interaction: Before a deployer uses a covered ADMT to materially influence a consequential decision, the deployer must provide clear and conspicuous notice to the consumer that the developer used or will use a covered ADMT in a consequential decision affecting the consumer, and the notice must also tell the consumer how to obtain additional information.[11] A deployer may comply by maintaining a prominent public notice that is reasonably accessible at points of consumer interaction, including links or posts reasonable close to the interaction.[12] For example, if an employer uses an ADMT in a resume-screening system or candidate-ranking platform that excludes candidates from consideration for a job, the employer would have to provide notice to the employees since the ADMT likely would materially influence a consequential decision.
2. Adverse Outcome Disclosure: If a deployer uses covered ADMT to materially influence a consequential decision that results in an adverse outcome, the deployer must provide a plain language description of the consequential decision and the role the covered ADMT played in the decision.[13] The disclosure must also include a simple process for requesting additional information about the ADMT and the inputs used including the name of the ADMT, version number if applicable, developer, and the types, categories, and sources of personal data used.[14]
In the above example, if a candidate is rejected because of the ADMT analysis, the employer would be required to provide a description such as, “Company A used Greenhouse Applicant Tracking Software (“ATS”) to determine which candidates were most qualified for position X. You may request more information about Company A’s use of Greenhouse ATS and the personal data used in your assessment by contacting Human Resources.”
3. Data Access and Correction Rights: When an adverse outcome results from the use of covered ADMT, the consumer may request instructions for obtaining personal data and correcting factually incorrect or materially inaccurate personal data used in the decision, and the consumer may request an opportunity for meaningful human review and reconsideration of the consequential decision to the extent commercially reasonable.[15] However, SB 26-189 does not permit correction of opinions, predictions, scores, or protected evaluations.[16] The meaningful human review requirement is likely the most practical challenge for employers as it requires designating the human reviewer, train said reviewer, and create procedures for documenting the review.
4. Recordkeeping: Deployers must retain records reasonably necessary to demonstrate compliance with the law for at least three (3) years.[17] Developers must make certain technical documentation available to deployers and retain same for at least three (3) years, including information about intended uses, known harmful or inappropriate uses, categories of training data, known limitations, and instructions for appropriate use, monitoring, and meaningful human review.[18]
Other Relevant Colorado Bills on Artificial Intelligence
House Bill 26-1210 (“HB 26-1210”)
This bill titled, Concerning Limiting the Use of Intimate Personal Data to Make Inferences That Impact a Person’s Financial Position, would limit businesses’ ability to use sophisticated algorithmic tools such a price or wage setting algorithm (“PWSA”), capable of tailoring prices and compensation offers to individual users or employees based on their behavior data, such as their browsing history, purchase patterns, location data, and even biometric information.[19] Specifically, HB 26-1210 prohibits a person from engaging in “individualized wage setting” or “individualized price setting,” and defines “individualized wage setting” as using a PWSA or the output of a PWSA in determining a wage offered to a worker.
HB 26-1210 was passed and transmitted to Governor Polis for his signature. If HB 26-1210 is signed into law, employers would need to audit their use of PWSAs to ensure that said use does not constitute “individualized wage setting.” To the extent use of a PWSA materially influences a consequential decision related to employee compensation, it is likely that the employer would have to comply with SB 26-189 as well.
Employer Considerations
SB 26-189 gives Colorado employers a more focused direction as it relates to use of AI in their businesses. Employers using ADMT in hiring, compensation, promotion, discipline, termination, or other employment related decisions should begin reviewing their practices to determine where they use AI to make consequential decisions and prepare for compliance by January 1, 2027 by creating policies that provide proper notice to those affected by the ADMT usage; describe the adverse outcome decisions and how those affected may request ADMT information; set processes for meaningful human review and reconsideration of adverse decisions when commercially reasonable. Campbell litigation will continue to monitor any developments with SB 26-189 and is available to help employers audit their current AI practices to ensure compliance with Colorado law.
[1] See S.B. 26-081, 75th Gen. Assembly, 2nd Reg. Sess. (Colo. 2026), available at https://leg.colorado.gov/bill_files/116489/download
[2] “Algorithmic Discrimination” means any condition in which the use of an artificial intelligence system results in an unlawful differential treatment or impact that disfavors an individual or group of individuals on the basis of their actual or perceived age, color, disability, ethnicity, genetic information, limited proficiency in the English language, national origin, race, religion, reproductive health, sex, veteran status, or other classification protected under the laws of this state or federal law. See SB 24-205, § 6-1-1701(1)(a).
[3] SB 24-205 defined “High-Risk Artificial Intelligence System” as any artificial intelligence system that, when deployed, makes, or is a substantial factor in making, a consequential decision. See SB 24-205, § 6-1-1701(9).
[4] See generally SB 24-205, § 6-1-1703(3).
[5] See https://www.rockymountainemployersblog.com/blog/2025/8/28/colorados-artificial-intelligence-ai-law-reform-could-apply-discrimination-liability-on-ai-developers; https://www.rockymountainemployersblog.com/blog/2025/12/5/new-ai-compliance-requirements-prohibit-discrimination-for-colorado-employers; https://www.rockymountainemployersblog.com/blog/2026/5/7/colorados-artificial-intelligence-law-from-imminent-compliance-to-continued-uncertainty.
[6] A developer is the entity that creates or provides the AI tool while a deployer is the entity that uses the AI tool. Employers will often be deployers when they use third-party AI or automated tools in employment decisions.
[7] Following the backlash to SB24-205, Senate Bill 25B-004 (“SB 25B-004”) was introduced to refine transparency laws under the AI framework by attempting to reduce the burdens of detailed disclosure imposed on developers and deployers of AI-systems. However, in doing so, SB 25B-004 added a proposed liability provision that reignited concern about the AI legislation by potentially extending legal exposure for discrimination claims for both developers and deployers of AI-systems. See our August 28, 2025 blog article supra
[8] In X.AI LLC v. Weiser, xAI challenged SB 24-205 seeking declaratory and injunctive relief and arguing that the law’s obligations for developers and deployers of high-risk AI systems violated several constitutional protections, including the First Amendment, Dormant Commerce Clause, Fourteenth Amendment, and the Equal Protection Clause. See generally Complaint for Declaratory and Injunctive Relief, X.AI LLC v. Weiser, No. 1:26-cv-01515 (D. Colo. filed Apr. 9, 2026),
[9] An ADMT is generally defined as technology that processes personal data and uses computation to generate outputs such as predictions, recommendations, classifications, rankings, scores, or other information used to make, guide, or assist a decision about an individual. See Colo. Rev. Stat. 6-1-1701(2)(a). An ADMT does not include anti-malware, anti-virus, calculators, data bases, data storage, firewalls, internet domain registration, internet website loading, networking, spam- and robocall-filtering, spell-checking, spreadsheets that require human analysis and not use machine learning, foundation models, or large language models, web caching or web hosting tools; tools used by individual solely to summarize, organize, translate, draft, route, or present information for human review or administrative processing; technology that communicates with consumers in natural language to provide information, make referrals or recommendations provided certain criteria is met. See Colo. Rev. Stat. 6-1-1701(2)(b).
[10] See generally id. §S 6-1-1706, 6-1-1709.
[11] Id. § 6-1-1704(1).
[12] Id. § 6-1-1704(2).
[13] Id. § 6-1-1704(3)(a). An adverse outcome is a decision that denies, terminates, revokes, or materially reduces or restricts a consumer's access to, eligibility for, selection for, compensation for, or the provision of an opportunity or service, Id. § 6-1-1701(1)(a); or a decision that results in a materially less favorable differentiated price, cost, compensation, or material term or is reasonably likely to limit or delay a consumer’s access to, eligibility for, selection for, compensation for, or the provision of an opportunity or service compared to terms offered to similarly situated consumers. Id. § 6-1-1701(1)(b).
[14] Id. § 6-1-1704(3)(b)
[15] Id. § 6-1-1705(1)(a)(I) and (II). SB 26-189 does not define what is “commercially reasonable.” "Meaningful Human Review" means review by an individual designated by the deployer who has authority to approve, modify, or override a consequential decision and who must consider relevant available primary evidence, must be trained to conduct the review, must not default to the system output, and must have access to sufficient information to understand the output’s intended use, material limitations, categories of inputs, and principal factors used to generate the output. See generally Id. § 6-1-1701(15)
[16] Id. § 6-1-1705(1)(c)
[17] Id. § 6-1-1703
[18] Id. §§ 6-1-1702(1)(a)-(e), 6-1-1702(4).
[19] H.B. 26-1210, 75th Gen. Assembly; see https://leg.colorado.gov/bill_files/115897/download. See our blog post at https://www.rockymountainemployersblog.com/blog/2026/5/14/colorado-legislators-seek-to-prohibit-the-use-of-surveillance-data-to-set-prices-and-wages-with-proposed-bill.