Colorado Just Rewrote Its AI Hiring Law — Most Small Employers Are Now Exempt

For more than a year, Colorado small business owners who use AI to screen resumes, rank applicants, or flag employees for promotion were bracing for one of the strictest AI compliance regimes in the country. Then, one day before the 2026 legislative session ended, lawmakers tore it up and started over.

Governor Jared Polis signed S.B. 26-189 on May 14, 2026, replacing Colorado's original AI Act just weeks before it was set to take effect on June 30. The rewrite strips out most of the paperwork-heavy requirements that had employment lawyers and HR consultants fielding panicked calls from small business owners all spring. The new law takes effect January 1, 2027, and it applies to far fewer businesses in far simpler ways than the version it replaces.

If you run a business in Colorado and use any kind of software to help with hiring, promotions, or pay decisions, here's what actually changed and what you still need to do.

What the old law would have required

The original 2024 law treated almost any AI tool used in employment decisions as high-risk. Employers would have had to conduct formal impact assessments, adopt a written risk management policy, complete annual reviews of every AI tool in use, update public privacy policies to disclose AI use, and report discriminatory outcomes directly to the Colorado attorney general. For a five-person shop using an applicant tracking system with a built-in resume ranker, that was a lot to take on without a compliance department.

The new law throws out every one of those requirements.

What Colorado employers actually have to do now

S.B. 26-189 boils compliance down to three things, and only for tools that "materially influence" what the law calls a "consequential decision" — hiring, promotion, compensation, or eligibility for employment.

• Give notice before you use it. You need to post a clear, conspicuous notice that automated tools help inform employment decisions. For hiring, that likely means a line in the online job application. For internal decisions like promotions, it should sit close to where the decision actually happens, such as a performance review portal.
• Follow an adverse action process. If someone doesn't get the job, promotion, or raise and an automated tool materially influenced that outcome, you have 30 days to notify them, explain the tool's role in plain language, and tell them how to request more information and a human review. Critically, the human review requirement only applies "to the extent commercially reasonable" — a small employer without the resources to run a parallel manual review process has a real argument that full compliance isn't feasible.
• Keep records for three years. That includes the notice you gave, how you gave it, any adverse action notices, and documentation of the decision-making process.

The exemptions that matter most for small businesses

The new law carves out a lot of what small businesses already use day to day. It doesn't apply to:

• Calculators, spreadsheets, and databases that still require a human to actually analyze the output
• Tools used solely to summarize, organize, translate, or transcribe information for a person to review — think AI note-takers used during interviews
• General-purpose chatbots like ChatGPT, as long as you don't use them to make consequential decisions and you have an acceptable use policy saying so
• Routine scheduling, administrative processing, and customer service tools
• Decisions involving independent contractors rather than employees, and applicants or employees who don't live in Colorado
• Identity verification and cybersecurity tools

If your business relies on independent contractors, it's worth revisiting how those workers are classified in the first place — misclassification carries its own set of penalties separate from anything in the AI law. Our guide to independent contractor vs. employee classification walks through the distinction the Department of Labor and the IRS actually use.

Enforcement is narrower too

Unlike some state privacy and AI laws, S.B. 26-189 doesn't let individuals sue employers directly. Only the Colorado attorney general can bring an enforcement action, and the law requires a 60-day notice and opportunity to fix the problem before any penalty is assessed, when a cure is possible. Violations are treated as unfair and deceptive trade practices, which can carry civil penalties up to $20,000 per violation — so the exposure is real, but the process gives employers a chance to correct course before it gets expensive.

The law also changes how liability is split between the companies that build AI tools and the businesses that use them. If you use a hiring tool exactly as the vendor intended and it produces a discriminatory result, the developer is more likely to bear responsibility. If you use it in a way the vendor didn't intend or document, that liability can shift back to you. Read the terms of service and documentation for any AI hiring or HR software you adopt, and keep a copy on file.

What to do between now and January 1, 2027

Employers have a little more breathing room than the original law gave them, but not unlimited time. A few practical steps:

• Inventory every tool your business uses in hiring, promotion, and compensation decisions, and note which ones involve any automated scoring, ranking, or filtering.
• Draft the pre-use notice language now so it's ready to post to job applications and internal HR systems before January 1, 2027.
• Build a simple adverse action letter template that explains the tool's role and how to request a human review.
• Set up a records folder — physical or digital — where you can store notices and decision documentation for at least three years.
• If you're evaluating new HR or applicant tracking software, ask the vendor directly whether their tool would count as "automated decision-making technology" under the new law.

Colorado's attorney general is also required to write implementing regulations by January 1, 2027, so some of the finer details — especially what counts as "commercially reasonable" for the human review requirement — may still get sharper before the deadline. Businesses that are already tracking basic recordkeeping for other compliance purposes, like maintaining a clean profit and loss statement or proper business insurance documentation, will find the AI law's record retention piece a familiar lift rather than a new burden.

Colorado is now the third state, after California and New York City, to pass a comprehensive law combining notice, individual rights, and anti-discrimination provisions for AI in employment. More states have similar bills moving through legislatures this year, so even businesses outside Colorado should expect to see versions of these same three requirements — notice, adverse action rights, and recordkeeping — become standard practice nationwide.

Photo by Israel Andrade on Unsplash