Colorado did not drop AI regulation; it rewrote it. SB 24-205, the original Colorado AI Act, never took effect. Governor Polis signed SB 26-189 on 14 May 2026, repealing and replacing it with a narrower, disclosure-focused framework. The statutory effective date is January 1, 2027.
This is a Colorado law, but the question behind it is national. New York City already requires bias audits for automated hiring tools, Illinois regulates AI in video interviews, and more states are drafting their own rules. If you hire in Colorado, SB 26-189 applies to you directly. If you do not, treat it as a clear preview of where employment screening regulation is heading.
What changed
The new law drops the original "high-risk AI systems" framing along with the duty of care, mandatory impact assessments, and risk management programs. In their place, three core duties for employers using "automated decision-making technology" (ADMT) on Colorado residents: pre-use notice, post-adverse outcome notice with meaningful human review, and three-year recordkeeping.
The trigger also shifted. SB 24-205 used "substantial factor", a three-part conjunctive test. SB 26-189 uses "materially influences", defined as a non-de minimis factor that affects the outcome. Legal commentators describe the new standard as more targeted, excluding incidental, trivial, and clerical uses. How courts will actually apply "non-de minimis" remains an open interpretive question, so do not assume "more targeted" automatically means "easier to escape".
What counts as ADMT, and what doesn't
ADMT means any technology that processes personal data and uses computation to generate predictions, recommendations, classifications, rankings, scores, or other outputs used to guide decisions about individuals. It is not limited to machine-learning models.
The statute carves out a broad exclusions list: cybersecurity tools, calculators, databases, firewalls, spell-check, non-ML spreadsheets, and tools used solely to summarize, translate, draft, route, or present information for human review (where no score, ranking, recommendation, classification, or inference is produced).
Importantly, general-purpose large language models (ChatGPT-style tools) are also excluded, provided they are not configured or marketed for consequential decisions and are subject to an acceptable use policy prohibiting that use. Wire the same LLM into a candidate scoring pipeline and it is back in scope.
"Consequential decisions" cover hiring, rejection, promotion, demotion, termination, compensation, and comparable material employment matters. Independent contractors and non-Colorado residents are out of scope.
The three core duties
Pre-use notice. Tell applicants up front, in plain language, that automated tools will play a role. Application disclosures, online notices, or prominent links work, provided a typical applicant can understand them.
Post-adverse outcome notice with meaningful human review. Within 30 days of an adverse outcome materially influenced by ADMT, provide a plain-language description of the decision, the ADMT's role, and instructions for the individual to request additional information, access their data, request corrections, and request meaningful human review.
The statutory qualifier matters here: human review is required only to the extent commercially reasonable, which gives flexibility where reconsideration would disrupt operations. It is not an opt-out. The reviewer must have authority to change the decision, must genuinely reconsider, must be trained for the function, must not default to the system output, and must have access to the relevant information. Clicking "confirm" does not satisfy the standard.
Three-year recordkeeping. Pre-use notices, adverse-decision logs, human review records, and vendor documentation. Both employers (deployers) and vendors (developers) carry the duty.
Enforcement is currently on hold
In late April 2026, x.AI filed a federal lawsuit (x.AI v. Weiser) in the U.S. District Court for the District of Colorado, seeking to enjoin the Colorado AI Act. On 27 April 2026, the court granted a joint motion staying enforcement of SB 24-205 while the case proceeds.
Separately, and more directly, the Colorado Attorney General has stated he will not enforce SB 26-189, or any legislation replacing or amending SB 24-205, until after the required rulemaking concludes. That rulemaking has not formally begun, and the post-adverse-notice rules are due by 1 January 2027, so enforcement realistically cannot start before then. The statute remains on the books, the 1 January 2027 effective date stands, and the smart move is still to prepare.
Enforcement, when it resumes, sits exclusively with the Colorado Attorney General under the Consumer Protection Act. No private right of action. The AG must give 60 days' notice and an opportunity to cure before taking action. That cure-period provision sunsets on 1 January 2030. The law also voids indemnification clauses that conflict with its fault-based liability approach, so review vendor contracts now.
How SB 189 fits with FCRA, EEOC, and the CPA
SB 189 adds to FCRA, it does not replace it. Creditors and others already issuing ECOA / FCRA adverse action notices may modify those notices to satisfy SB 189's overlapping requirements rather than issuing duplicates. EEOC disparate-impact obligations still apply to any AI tool used in selection, even if the vendor built it.
One employer-specific point. SB 189 expressly extends coverage to employees, where the Colorado Privacy Act has largely excluded them. That means automated decisions about your existing Colorado workforce (promotions, compensation changes, performance-driven terminations) sit inside SB 189 even when the same decisions sit outside CPA. Audit your HR systems for automated scoring on current employees, not just applicants.
Compliance checklist before January 2027
- Inventory your ADMT. Every tool from sourcing through background review. Check each against the statutory exclusions, including the LLM carve-out.
- Confirm what's covered. Does it materially influence employment access, eligibility, or compensation for Colorado residents (applicants and employees)?
- Update applicant disclosures with plain-language pre-use notice.
- Design the adverse decision and human review process. Integrate with FCRA; train reviewers; document where "commercially reasonable" applies.
- Build a data access and correction channel.
- Implement three-year recordkeeping alongside FCRA dispute files.
- Track the litigation and the AG rulemaking. Mandatory rulemaking on post-adverse disclosure content is due by 1 January 2027; the AG also has discretionary authority on other aspects.
Frequently Asked Questions
Is Colorado SB 189 being enforced right now?
No. Two things hold it back. The federal court stayed enforcement of SB 24-205 in the x.AI case on 27 April 2026, and the Colorado Attorney General has separately stated he will not enforce SB 26-189 until the required rulemaking concludes. That rulemaking has not started and the rules are due by 1 January 2027, so enforcement cannot begin before then. The statute is still on the books and the January 2027 effective date stands.
Are general-purpose LLMs like ChatGPT covered?
Generally no, as long as they are not configured for consequential decisions and are subject to an acceptable use policy prohibiting that use. Wire one into a candidate scoring pipeline and it is back in scope.
Does SB 189 apply to existing employees, or only applicants?
Both. SB 189 covers consequential decisions about current Colorado employees (promotions, compensation changes, performance-driven terminations), where CPA has largely excluded the employee context.
Are background checks ADMT?
A traditional report aggregating factual records is generally not. A system that automatically scores, ranks, or issues pass/fail recommendations from background data, and materially influences a hiring decision, likely is. Audit how your provider classifies its output. KRESS reports deliver verified factual records for human review, not automated scores or rankings, which keeps them outside the ADMT definition.
Not sure whether your current screening workflow is ready for SB 189? KRESS can help you review your screening. Get in touch.