After a protracted legal battle over Colorado's first legislation on the use of AI in decision making, the dust has finally cleared, and businesses have some guidance on what to expect. Governor Polis recently signed SB26-189 into law, which creates sweeping new requirements for businesses that develop or deploy automated decision-making technology (ADMT). SB26-189 is best understood as something of a reset to the state's original, but never implemented, 2024 AI law, SB 24-205. That law would have imposed exceedingly broad obligations on companies that develop or utilize AI systems, with the goal of preventing algorithmic discrimination. But after sustained local and national political and legal pressure, Colorado replaced that framework with a narrower law focused on documentation, notices, disclosures, recordkeeping, correction rights, and meaningful human review for certain automated decision-making uses. That narrower framework is SB26-189.
Who Is Covered by Colorado's Automated Decision-Making Law?
The law regulates two categories of entities: "developers," those who create ADMT systems, and "deployers," those who use ADMT that materially influences "consequential" decisions, including employers.
A covered ADMT is automated technology that processes personal data and generates an output, such as a recommendation, ranking, score, classification, or prediction, that is used in the employment context, to make or assist a decision about an applicant or employee. The technology is covered only if it materially influences a consequential decision.
Employers should understand that a consequential decision includes a decision affecting an individual's compensation or access to, or eligibility or selection for, an employment opportunity. Examples of potentially covered uses include automated tools used to rank applicants, score résumés, recommend candidates for interviews, evaluate performance, influence compensation, or support promotion, discipline, or termination decisions.
SB26-189 excludes low-stakes or routine business processes that do not materially influence employment eligibility, selection, compensation, or access to an opportunity. It also excludes tools used only to summarize, organize, translate, draft, route, or present information for human review, so long as the tool does not generate a score, ranking, recommendation, classification, prediction, or similar inference that materially influences the outcome.
Notice and Disclosure Requirements
Employers using ADMT for covered uses must provide notice to employees/applicants before using the technology. The notice must be clear and conspicuous and must tell the individual that covered ADMT was or will be used in a consequential decision affecting them. The employer must also explain how the individual can obtain additional information. A prominent public notice reasonably accessible at the point of interaction may satisfy this requirement.
If the covered ADMT materially influences a decision that results in an adverse outcome (e.g., denial, termination, changed compensation, etc.), the employer must provide a disclosure within 30 days after making the decision. That disclosure must include a plain-language description of the decision and the role the ADMT played, a simple process to request additional information about the ADMT and inputs, and an explanation of the individual's rights.
Correction and Human Review Rights
After an adverse outcome involving covered ADMT, an employee or applicant may request instructions for accessing and correcting factually incorrect or materially inaccurate personal data used in the decision. The law does not require employers to correct opinions, predictions, scores, or protected evaluations.
The individual may also request "meaningful human review" and reconsideration, but only to the extent "commercially reasonable." Meaningful human review must be conducted by a person with authority to approve, modify, or override the decision; the reviewer must consider relevant available evidence, be trained to conduct the review, and not simply default to the ADMT output. The bill does not define what is or is not commercially reasonable, but the attorney general is required to adopt rules by January 1, 2027 to clarify the post-adverse-outcome disclosure and consumer-rights requirements, so further guidance on this issue and others may be forthcoming within the calendar year.
Recordkeeping, and Enforcement
Employers must retain records reasonably necessary to demonstrate compliance for at least three years after the date of the consequential decision, or longer if another law requires it. Records may include ADMT version identifiers, changelogs, and documentation of material mitigation changes.
The law is enforced by Colorado's attorney general. Before bringing an enforcement action, the attorney general must provide a notice of violation and a 60-day opportunity to cure, if curable. There is no required cure period for knowing or repeated violations. The law's cure provision sunsets on January 1, 2030.
While the law does not create a private cause of action, it does not limit existing rights or remedies under state or federal law, including employment-discrimination laws. Employers may still be found to have discriminated against job applicants and employees through the use of AI under traditional anti-discrimination law, including but not limited to claims brought under disparate impact theories.
SB26-189 Also Applies Beyond Employment Decisions
While this article focuses on employment, SB26-189 is not limited to workplace decisions. The law also applies when a deployer doing business in Colorado uses covered ADMT to materially influence consequential decisions involving education enrollment or education opportunities; the lease or purchase of residential real estate in Colorado; financial or lending services; insurance; and essential government services or public benefits. Businesses that use automated tools outside the employment context should evaluate those uses separately, because the law's requirements in other contexts may differ.
For questions about how SB26-189 may affect your organization, contact Emily Keimig, Carissa Davis, or other Venable counsel specializing in Colorado law.