Three rules land on January 1, 2027, and each touches a part of hiring you already run: when you can ask about a criminal record, how an automated tool may shape a decision, and what you owe a candidate afterward. If you hire in Washington, Colorado, or California, your fourth quarter just got more specific.
If you want a second pair of eyes on your process before then, book a screening workflow review.
| Change | Where | Who is covered | What it changes |
|---|---|---|---|
| EHB 1747, Fair Chance Act amendments phase-in | Washington | Employers with fewer than 15 employees | When you may ask about criminal history, and how you run adverse action |
| SB 26-189, automated decision-making technology | Colorado | Deployers, with no employer size threshold | Notice before use, a plain language explanation after an adverse outcome, and human review |
| CCPA automated decision-making regulations | California | CCPA-covered businesses using such tools | Pre-use notice, an opt-out (with some exceptions), access rights, and risk assessments |
Washington: the Fair Chance Act Amendments Reach Small Employers
Washington's Fair Chance Act has covered employers of every size since 2018. Its 2025 amendments took effect on July 1, 2026 for employers with 15 or more employees, and on January 1, 2027 the amended rules reach employers with fewer than 15, so if you run sites of different sizes in the state, both dates apply to you.
The core rule is sequencing. You cannot obtain or consider criminal record information until after a conditional offer. If your process bundles a criminal check with education and employment verifications in one pre-offer order, that has to be unbundled.
Arrest records and juvenile convictions are off limits for adverse action, with a narrow exception for an adult out on bail pending trial. Adult convictions can be considered, but only where you can identify a legitimate business reason after weighing the seriousness of the conduct, the time that has passed, the duties of the job, and evidence of rehabilitation. Blanket disqualification does not survive that test, which is why the practical fix is a documented individualized assessment rather than a rule sheet.
Before finalizing an adverse decision you must notify the person, identify the specific record you relied on, and hold the position open for at least two business days so they can respond. Washington also requires a documented individualized assessment, and our state-by-state compliance guide sets out how that step fits with other states' rules. Penalties run to $1,500 for a first violation, $3,000 for a second, and up to $15,000 after that, per aggrieved individual. Existing exemptions still apply, and the July 2026 rules for larger Washington employers cover the ground your smaller sites are about to inherit.
Colorado: Adverse Automated Decisions Now Owe the Candidate an Explanation
Colorado repealed and replaced its 2024 AI Act. The replacement, SB 26-189 on automated decision-making technology, was signed on May 14, 2026 and applies to consequential decisions made on or after January 1, 2027, with no employer size threshold.
If you deploy a tool that processes personal data to help decide a consequential matter such as hiring or promotion, you owe clear and conspicuous notice before you use it, usually on the job posting or careers page. Where the tool materially influences a consequential decision that has an adverse outcome for the person, you have up to 30 days to give a plain language description of the part the tool played and explain the person's rights. They can ask you to correct materially inaccurate personal data and request meaningful human review where that is commercially reasonable. Keep the documentation for three years.
California: Notice and an Opt-Out (With Some Exceptions) Before the Tool Runs
California's privacy regulations on automated decisionmaking took effect on January 1, 2026, and the agency's own line on timing is plain: businesses that use this technology to make significant decisions must comply with the ADMT requirements beginning January 1, 2027.
Employment sits squarely inside the definition of a significant decision. The regulations reach hiring, the allocation or assignment of work, and compensation. Before you use the tool you owe a pre-use notice, and the person has an opt-out (with some exceptions) and can ask how it was used on them. Risk assessment duties started on January 1, 2026, with the first attestations due to the agency by April 1, 2028.
Your Q4 2026 Action Plan
- October, map what you have. Pull your criminal background check policy, adverse action procedure, and handbook hiring sections, then list every tool that scores, ranks, or filters candidates, including anything inside your applicant tracking system.
- October, ask your screening provider the hard question. Can the ordering platform stop a criminal check being raised before a conditional offer is recorded for a small Washington employer? Can your adverse action workflow carry a state hold period on top of the federal timeline? If the answer is no, you need the rest of the quarter to fix it.
- November, rewrite the documents. Replace blanket disqualification language in Washington with criteria that record the business reason, draft the Colorado adverse outcome explanation and the California pre-use notice, and update handbooks and adverse action letters to match.
- November, name a reviewer. Colorado's human review right needs a named person and a route for requests to reach them.
- December, train and tell people. Brief Washington hiring teams on the conditional offer sequence, the two business day window, and the documented individualized assessment Washington also requires (see our state-by-state compliance guide), brief everyone touching automated tools on the notice duties, and communicate the changes to applicants before the effective date.
- January, audit early. Sample the first two weeks and check the sequence held, while a gap is still one file and not a pattern.
The Federal Floor Still Applies
FCRA pre-adverse notice, a reasonable waiting period, and a final notice still run alongside Washington's process, so you are managing two timelines at once and the order matters. Getting that sequence wrong is one of the FCRA adverse action mistakes that most often lands an employer in trouble. EEOC guidance on assessing criminal records also remains independently enforceable under Title VII. For multi-state employers the workable approach is a national baseline set to the strictest common standard, with the jurisdiction overlays in our state by state compliance guide layered on top.
Frequently Asked Questions
Do Washington's Fair Chance Act amendments apply to every employer from January 1, 2027?
The Act itself has covered employers of every size since 2018. Employers with 15 or more employees have been subject to the 2025 amendments since July 1, 2026, and January 1, 2027 extends the amendments to those with fewer than 15. Existing exemptions continue to apply, including positions under federal contracts that specifically prohibit people with criminal records.
Does Colorado's SB 26-189 only apply to large employers?
No. The statute carries no employer size threshold and applies to consequential decisions made on or after January 1, 2027. Some entity-level exemptions apply, so check rather than assume.
We do not use AI in hiring. Do the Colorado and California rules reach us?
Possibly. Both definitions are built around technology that processes personal data to produce an output used in a decision, which is broader than what most people mean by AI. Resume ranking, knockout questions, and scoring inside an applicant tracking system can all qualify, so inventory first.
January 1, 2027 is fixed, and the window to prepare is this quarter. If you are not certain your screening sequence, adverse action timing, or hiring tool inventory will hold up on day one, KRESS can tell you where the gaps are while there is still time to close them. Book a screening workflow review of your current setup and we will walk through what needs to change before the new year.