If software touches your hiring, Colorado's new AI law applies to you. The clock starts January 1.

Colorado's replacement AI statute reaches any employer whose software materially influences a hiring, pay, promotion, scheduling or termination decision. Photo: Mapbox / Unsplash

For two years Colorado employers have been told that a sweeping artificial-intelligence law was coming for them. In May, the legislature took it back. Senate Bill 26-189 repealed and replaced the 2024 Colorado AI Act, which had been scheduled to take effect on June 30, 2026. Governor Polis signed the replacement on May 14, 2026. It takes effect January 1, 2027.

The short version: the expensive parts are gone, the paperwork parts remain, and nothing in the statute exempts you for being small.

What got cut

The 2024 law would have required deployers to run annual impact assessments, stand up a formal risk-management programme modelled on the NIST framework, review each tool yearly, publish a policy describing their AI use, and self-report discriminatory outcomes to the Attorney General. All of that is out. For a fifty-person company in Greeley that had been quoted five figures for an AI compliance programme, that quote is now obsolete.

What survived

Four duties, and they are the ones that touch the candidate directly.

Notice before you use it. Clear and conspicuous notice, given before the technology is used, telling the person how to get more information about it.

An explanation within 30 days of an adverse decision. Plain language: what the decision was, what role the software played, how to ask for more detail about the system and the data it ran on, and how to correct inaccurate personal data.

Meaningful human review. The person can ask a human being to look again — “to the extent commercially reasonable,” a phrase the Attorney General has until January 1, 2027 to define.

Three years of records. Documentation showing compliance, including which version of the tool made the call and when it materially changed.

There is no employee-count threshold. A statute that asks for a written notice, a thirty-day letter and a three-year file is a statute a ten-person firm can actually comply with — which is presumably why nobody bothered to write an exemption.

The part most owners will get wrong

The trigger is not “do you use AI.” It is whether automated decision-making technology materially influences a consequential decision. Epstein Becker Green reads “materially influence” as a non-de-minimis factor that constrains, ranks, scores or meaningfully alters the outcome. Incidental, trivial and clerical uses are expressly excluded.

On the employment side, consequential decisions cover hiring, termination, promotion, compensation and scheduling. Which means the question to ask is not whether you bought something called AI. It is whether anything in your stack ranks, scores or filters people. Applicant-tracking software that orders a candidate list by fit score. A background-check vendor that returns a risk rating. Scheduling software that assigns shifts by an algorithm. A resume parser that screens out anyone missing a keyword. Most owners did not buy these as AI. They bought them as features of something else, usually from a vendor, and that is exactly where this lands.

The last solid survey on adoption is old but the shape of it is instructive: SHRM found in February 2022 that 16 percent of employers with under 100 workers used automation or AI in HR, against 42 percent of employers over 5,000 — and that 92 percent of all users got the tools from a vendor rather than building them. Four years on, the small-employer number is certainly higher, and the vendor number is the one that matters. Your compliance obligation is not transferable to the company that sold you the software.

What enforcement looks like

The Attorney General has exclusive authority. There is no private right of action, so this will not arrive as a plaintiff's-side demand letter. Violations are treated as deceptive trade practices under the Colorado Consumer Protection Act, carrying penalties of up to $20,000 per violation, with a 60-day cure notice at the Attorney General's discretion — discretion that does not extend to knowing or repeated violations.

Worth noting what that structure implies. A per-violation penalty in a statute about screening applicants is a per-applicant penalty. A single badly configured filter running through one hiring season is not one violation.

What to do before January

Four things, none of which need a consultant.

Inventory. List every piece of software that touches hiring, pay, promotion, scheduling or termination, and for each one write down whether it ranks, scores or filters. If you cannot tell, ask the vendor in writing — that email is itself a record.

Read the vendor contract. Several of these agreements disclaim liability for discriminatory output. Colorado now voids that allocation for covered technology, so the contract will not protect you, and it is worth knowing that before a renewal rather than after a complaint.

Write the two notices now. A pre-use notice for your job postings and application flow, and a template for the 30-day adverse-decision letter. Both are short. Both are much harder to write under pressure.

Decide who the human is. “Meaningful human review” needs a named person with the authority to overturn the software, and a note in the file when they do. If the only answer to “who reviewed this” is the software, you do not have a review process.

One last thing worth watching: the Attorney General's rules are due the same day the law takes effect. Expect the practical definitions — especially “commercially reasonable” — to arrive late. Build the file now and adjust in the spring rather than waiting for certainty that will not show up on time.