If you hire anyone in Colorado, or use screening software that scores Colorado applicants, a new state law applies to your process starting January 1, 2027. It is not the law many employers heard about in 2024. That law, known as the Colorado Artificial Intelligence Act, was repealed and replaced before it ever took effect.

The replacement is Senate Bill 26-189, titled Automated Decision-Making Technology on the legislature's bill page. Governor Jared Polis signed it on May 14, 2026. The Colorado Attorney General's office has proposed rules to carry it out, with public comments due October 26, 2026.

A Narrower Law Than the One It Replaced

The 2024 law told companies using high-risk artificial intelligence to take reasonable care to prevent algorithmic discrimination, run risk-management programs, and complete impact assessments. The law firm Paul Hastings, in its May 20, 2026 summary of the new act, lists those duties among the items dropped. What remains is a transparency and individual rights law.

A law built on notices, explanations, and records is easier to meet than one built on formal risk programs, but the duties arrive at specific moments, such as the day you send a rejection.

Which Hiring Tools Count

The law applies to automated decision-making technology that materially influences a consequential decision, and employment is one of the listed decision areas. Paul Hastings summarizes the core definition as a technology that processes personal data and uses computation to generate output used to make, guide, or assist a decision about an individual.

The law firm Mayer Brown, in its May 2026 analysis, adds that incidental, trivial, or clerical uses fall outside the law. In plain terms, a resume scorer that sorts applicants into a top tier and a bottom tier is in the zone, and a spell checker is not. The middle ground is where the draft rules matter most, and we return to that below.

Paul Hastings says the act does not cover independent contractors or candidates outside Colorado. None of the summaries we reviewed describe an exemption for small employers, so a small company should not assume one exists. Confirm your status with employment counsel.

What the Law Asks of an Employer

An employer that uses a covered tool in a hiring decision is called a deployer. The duties, as the legislature's bill summary and the law firm summaries describe them, fall at five points in the process.

Before the tool is used. The employer gives clear and conspicuous notice that a covered tool is in use, with instructions for getting more information. Mayer Brown notes that a reasonably accessible public notice can meet this duty, so a plain statement on the careers page is a sensible start.

After a bad outcome. If the tool contributes to an adverse decision, such as a rejection, the employer has 30 days to describe the decision and the role the tool played, and to explain how the person can ask for more information. The legislature's bill summary calls this a plain language description.

On request, about the data. A person can ask for the personal data the tool used and can ask to correct data that is factually wrong. Paul Hastings says the correction right does not extend to opinions, predictions, scores, or protected evaluations. A wrong employment date is correctable. A model score is not.

On request, for a person to look again. Paul Hastings reports that employers must offer "meaningful human review and reconsideration" where commercially reasonable. As the draft rules below suggest, a reviewer who cannot change the result is unlikely to meet that standard.

For three years. Developers and deployers must keep the records needed to show compliance for at least three years, according to the legislature's bill summary. Mayer Brown adds that other law may require longer. If you also hire in California, see our post on the four-year California record rule before setting one retention period for everyone.

Who Enforces It, and How

Only the Colorado Attorney General can enforce the law. It operates through the state's Consumer Protection Act and creates no new private right to sue. Before 2030, the Attorney General must give an employer 60 days to cure a violation, unless the violation is knowing or repeated, according to Paul Hastings and Mayer Brown. The cure window helps only an employer that can find and fix a problem within 60 days.

What the Draft Rules Would Add

The Attorney General filed proposed rules on August 11, 2026, and released an interim revision on October 6. Orrick's October 9 summary of the revision covers the revised draft, and Morrison Foerster's October 14 note says public comments on the draft rules are due October 26 and the laws and the final rules are scheduled to take effect January 1, 2027.

A test for material influence. The revision adds a rule on when a tool output is presumed to materially influence a decision. As Orrick describes it, the presumption applies when a decision-maker reviews an output about a person, such as a score, ranking, recommendation, or threshold, or uses it to screen data, and the output matches the final outcome. The employer can rebut the presumption by showing the output was only a minor factor. Tools that only summarize, organize, or present information for human review fall outside the definition.

If a recruiter opens a ranked list and almost always advances the people at the top, the ranking probably influences the result, even though a person clicks the button.

Disclosures with specificity. Orrick reports that the revision drops a requirement to state the principal reasons for an adverse outcome and instead asks the employer to describe the tool's role with specificity.

Human reviewers. The revision clarifies that a reviewer can be internal or external as long as that person has real authority to override the decision. It also removes a requirement to pause an adverse outcome while a review is pending.

Vendor-run tools. Orrick also reports that a deployer stays responsible when a third party runs the technology and the deployer uses the output to make the decision. Buying a tool does not move the duty to the vendor.

These are proposals. The final text may differ from the October revision, so treat the details above as a preview and not as settled requirements.

A Lawsuit Could Restart the Clock

The legal picture has a second moving part. In April 2026, the artificial intelligence company xAI sued Colorado over the 2024 law on constitutional grounds. HR Dive reported that a magistrate judge in the U.S. District Court for the District of Colorado paused enforcement on a joint request. xAI must file for a preliminary injunction, or amend its complaint, within 28 days after Colorado adopts rules under the 2024 law or passes a replacement.

Eckert Seamans, in a June 12, 2026 update, reports that the stay also extends to the successor law and that practical enforcement is unlikely before late 2027. That is one firm's reading and it may change. The cautious path is to prepare as though January 1, 2027 holds.

A Checklist for Hiring Teams

List every tool that scores, ranks, or recommends. Include resume scoring, knockout questions that auto-reject, video interview scoring, and any vendor feature switched on by default. Our applicant tracking system filter audit checklist walks through the inventory step.

Draft the notice. Write one plain statement of where automated tools are used in hiring and how a person can ask questions.

Prepare a 30-day rejection explanation. For each tool, write down in everyday words what it measures and how a recruiter uses it. Prepare the answer before day 28.

Name a human reviewer with authority. Identify who can reverse a tool-assisted rejection and how a request reaches that person.

Ask vendors for documentation. The developer duties are meant to give deployers technical information about intended uses, training data categories, and known limits. Request it now, and ask each vendor in writing which features influence rankings.

Set retention and watch the rules. Keep screening records for at least three years, and ask counsel to compare the final rules with your notice and explanation templates.

If you also hire in California, the overlap is large. The California privacy regulator's rules reach hiring tools on the same date, covered in our post on the California automated decision rules, and candidates there can ask a parallel set of questions. Our free California AI Hiring Compliance Checklist is a useful companion for a team building one process for several states.

Where TrueScan HR Fits

TrueScan HR scores a resume against the job and shows the matched and missing skills behind every score. That detail is the raw material for the explanation Colorado asks employers to give: what the tool measured, and how that related to the role. A score with no reasons attached is hard to explain in 30 days.

The Bottom Line

Colorado chose a lighter law, not no law. Employers that use scoring or ranking tools in hiring will need a notice, an explanation they can produce quickly, a person with authority to reconsider, and records. The rules are still open and a lawsuit may change the timing, but the work is the same either way: inventory, plain-language explanations, and vendor questions.

This post is general information, not legal advice. Confirm how the law applies to your organization with employment counsel.

Sources: