Colorado’s SB26-189 sets new rules for AI in employment decisions

After a protracted legal battle over Colorado‘s first legislation on the use of AI in decision making, the dust has finally cleared, and businesses have some guidance on what to expect. Governor Polis recently signed SB26-189 into law, which creates sweeping new requirements for businesses that develop or deploy automated decision-making technology (ADMT).

SB26-189 is best understood as something of a reset to the state’s original, but never implemented, 2024 AI law, SB 24-205. That law would have imposed exceedingly broad obligations on companies that develop or utilize AI systems, with the goal of preventing algorithmic discrimination.

But after sustained local and national political and legal pressure, Colorado replaced that framework with a narrower law focused on documentation, notices, disclosures, recordkeeping, correction rights, and meaningful human review for certain automated decision-making uses. That narrower framework is SB26-189.

Who Is Covered by Colorado’s Automated Decision-Making Law?

 The law regulates two categories of entities: “developers,” those who create ADMT systems, and “deployers,” those who use ADMT that materially influences “consequential” decisions, including employers.

A covered ADMT is automated technology that processes personal data and generates an output, such as a recommendation, ranking, score, classification, or prediction, used in the employment context to make or assist in a decision about an applicant or employee. The technology is covered only if it materially influences a consequential decision.

Employers should understand that a consequential decision includes a decision affecting an individual’s compensation or access to, or eligibility or selection for, an employment opportunity. Examples of potentially covered uses include automated tools used to rank applicants, score résumés, recommend candidates for interviews, evaluate performance, influence compensation, or support promotion, discipline, or termination decisions.

SB26-189 excludes low-stakes or routine business processes that do not materially influence employment eligibility, selection, compensation, or access to an opportunity. It also excludes tools used only to summarize, organize, translate, draft, route, or present information for human review, so long as the tool does not generate a score, ranking, recommendation, classification, prediction, or similar inference that materially influences the outcome.

Notice and Disclosure Requirements

 Employers using ADMT for covered uses must provide notice to employees/applicants before using the technology. The notice must be clear and conspicuous and must tell the individual that covered ADMT was or will be used in a consequential decision affecting them. The employer must also explain how the individual can obtain additional information. A prominent public notice reasonably accessible at the point of interaction may satisfy this requirement.

If the covered ADMT materially influences a decision that results in an adverse outcome (e.g., denial, termination, or a change in compensation), the employer must provide a disclosure within 30 days of making the decision. That disclosure must include a plain-language description of the decision and the ADMT’s role, a simple process for requesting additional information about the ADMT and its inputs, and an explanation of the individual’s rights.

Correction and Human Review Rights

After an adverse outcome involving covered ADMT, an employee or applicant may request instructions for accessing and correcting factually incorrect or materially inaccurate personal data used in the decision. The law does not require employers to correct opinions, predictions, scores, or protected evaluations.

The individual may also request “meaningful human review” and reconsideration, but only to the extent “commercially reasonable.” Meaningful human review must be conducted by a person with authority to approve, modify, or override the decision; the reviewer must consider relevant available evidence, be trained to conduct the review, and not simply default to the ADMT output.

The bill does not define what is or is not commercially reasonable, but the attorney general is required to adopt rules by January 1, 2027, to clarify the post-adverse-outcome disclosure and consumer-rights requirements, so further guidance on this issue and others may be forthcoming within the calendar year.

Recordkeeping and Enforcement

Employers must retain records reasonably necessary to demonstrate compliance for at least three years after the date of the consequential decision, or longer if another law requires it. Records may include ADMT version identifiers, changelogs, and documentation of material mitigation changes.

The law is enforced by Colorado’s attorney general. Before bringing an enforcement action, the attorney general must provide a notice of violation and a 60-day opportunity to cure, if curable. There is no required cure period for knowing or repeated violations. The law’s cure provision sunsets on January 1, 2030.

While the law does not create a private cause of action, it does not limit existing rights or remedies under state or federal law, including employment-discrimination laws. Employers may still be found to have discriminated against job applicants and employees through the use of AI under traditional anti-discrimination law, including but not limited to claims brought under disparate impact theories.

SB26-189 Also Applies Beyond Employment Decisions

 While this article focuses on employment, SB26-189 is not limited to workplace decisions. The law also applies when a deployer doing business in Colorado uses covered ADMT to materially influence consequential decisions involving education enrollment or education opportunities; the lease or purchase of residential real estate in Colorado; financial or lending services; insurance; and essential government services or public benefits. Businesses that use automated tools outside the employment context should evaluate those uses separately, because the law’s requirements in other contexts may differ.

A labor and employment partner in the Denver office of Venable LLP, Emily Keimig has more than three decades of experience in the areas of litigation, employment law, and privacy and data security. Her practice involves matters related to information/electronic data governance, social media, data privacy and protection, artificial intelligence, and the impact of technology and e-communication in the workplace and beyond. She also routinely advises employment and commercial law on restrictive covenants, trade secret protection, due diligence, executive compensation agreements, and board advice on governance, growth, and transition matters. Her clients range from startups to Fortune 100 companies in industries that include technology, healthcare, aerospace, mining, agriculture, and retail.

Carissa J. Davis is an attorney in the Labor and Employment Practice Group in the Denver office of Venable LLP. She offers clients counsel and provides litigation defense regarding wage-and-hour laws, including class and collective actions, restrictive covenants, discrimination, harassment, and retaliation, as well as other employment matters.