A composite scenario assembled from documented cases: In July 2026, an HR generalist at a 34-person Denver engineering firm bookmarked a small-business compliance page that still listed June 30, 2026 as Colorado's AI deadline and told employers under 50 full-time staff they were exempt from impact assessments (Big Ideas for Small Business). Relying on that outdated under-50 rule, she shelved candidate AI notices and signed a three-year recruiting software renewal carrying a one-sided vendor hold-harmless clause. Both steps missed Colorado's statutory reset. On May 14, 2026, Governor Jared Polis signed Senate Bill 26-189, repealing and replacing the 2024 Colorado AI Act (SB 24-205) effective January 1, 2027. The new statute drops annual impact assessments while applying pre-decision notices, 30-day adverse explanations, and voided indemnity shifts to deployers of any headcount (CO SB 26-189; Legal 500 / Reinhart, Jun 18, 2026).
Every employer hiring or managing staff in Colorado needs a current Colorado SB 26-189 employer AI checklist before January 1, 2027, when SB 26-189 replaces the repealed SB 24-205 regime. SB 26-189 drops annual impact assessments and eliminates the old under-50 FTE carve-out, requiring all covered deployers to give pre-decision ADMT notices, 30-day plain-language adverse explanations with human review, and 3-year records, all included in the ed.cafe Colorado Employer AI Readiness Checklist below.
Stale search results remain the top compliance trap for Colorado HR leads this autumn. Older pages still quote SB 24-205's original February 1, 2026 date or SB 25B-004's June 30, 2026 extension, pushing small teams either into repealed 40-page impact assessments or into false confidence that under-50 employers are exempt (McDermott via JD Supra). Part of our safe use of AI tools at work hub and paired with our late-2026 federal preemption scoreboard, this guide provides general operational information, not legal advice.
How did Colorado move from SB 24-205 and SB 25B-004 to SB 26-189 for 2027?
Colorado rewrote its AI law twice between May 2024 and May 2026, replacing heavy governance filings with a transparency, 30-day explanation, and fault-allocation framework operative January 1, 2027. Any checklist dated before May 14, 2026 tracks a repealed statute.
Keep these four milestones straight:
- May 17, 2024 (
SB 24-205): Enacted annual impact assessments, NIST-style risk programs, AG bias self-reporting, and a partial governance exemption for deployers under 50 full-time equivalent (FTE) workers, originally set for February 1, 2026 (CO SB 24-205). - August 2025 (
SB 25B-004): A special session delayedSB 24-205five months to June 30, 2026 (CO SB 25B-004). - April 2026 (Federal suit & pause): Developer xAI sued Colorado, the US Department of Justice intervened on April 24, 2026, and a stipulated pause followed on April 27, 2026 (Proskauer; McDermott).
- May 14, 2026 (
SB 26-189signed): Governor Polis signed SB 26-189 (Automated Decision-Making Technology), repealingSB 24-205completely and setting a clean January 1, 2027 effective date (CO SB 26-189).
| Feature | Repealed SB 24-205 (2024/2025) | Enacted SB 26-189 (Live Jan 1, 2027) |
|---|---|---|
| Deadline. | Superseded (Feb 1, 2026 -> Jun 30, 2026). | January 1, 2027 (signed May 14, 2026). |
| Tech label. | "High-risk artificial intelligence system". | Automated Decision-Making Technology (ADMT). |
<50 FTE carve-out. | Partial governance exemption if <50 FTE and no custom model training. | Eliminated; zero headcount floor (10-person and 500-person firms follow identical rules). |
| Impact assessments. | Mandatory yearly + within 90 days of changes. | Repealed for all employers. |
| Pre-use notice. | Required prior to high-risk AI decision. | Required at point of interaction (accessible, plain English). |
| Adverse outcomes. | Post-decision reason, correction & appeal. | Plain-language explanation within 30 days, data correction & human review. |
| Indemnity clauses. | Governed by standard contract law. | Liability-shifting indemnity clauses void as against public policy. |
| Logs & enforcer. | 3 years after deployment ends; AG exclusive. | At least 3 years per use/record; CO AG exclusive (60-day cure). |
Row three is the decisive change for small businesses. Under repealed SB 24-205, firms under 50 FTEs could skip annual impact assessments (though never candidate notices). Under SB 26-189, annual impact assessments vanished for everyone, and zero small-business exemption exists for notices, 30-day adverse explanations, or three-year logs (Legal 500; State AI Tracker).
When does an employer tool count as covered ADMT?
A workplace tool triggers SB 26-189 only when two tests pass: the software is Automated Decision-Making Technology (ADMT) processing personal data, and its output materially influences a consequential employment decision about a Colorado consumer (defined to include job applicants and current employees).
Think of a diner replacing a 50-page kitchen blueprint audit with two front-counter rules: post an allergen sign before ordering, and hand over the recipe card within 30 days if a guest reacts. SB 26-189 made that exact regulatory trade. Instead of demanding annual risk treatises, Colorado regulates moments where software ranks, scores, or filters people. Where that kitchen analogy breaks is silent SaaS defaults: a cook sees every peanut in the pan, whereas an ATS vendor can switch on an "AI fit score" quietly unless HR checks its settings; see inventorying embedded AI features inside SaaS apps.
Run this three-step check on every HR tool:
- Step 1 (ADMT vs excluded utility): Covers software processing personal data to generate predictions, classifications, recommendations, rankings, or scores guiding individual determinations. Expressly excludes anti-malware, firewalls, spam filters, calculators, fixed spreadsheets, and spell-checkers (CO SB 26-189).
- Step 2 (Consequential domain): Employment sits alongside education, housing, lending, insurance, healthcare, and essential government services, covering hiring, filtering, pay, promotion, scheduling, reviews, discipline, and firing.
- Step 3 (Material influence): Grammar-checking a job ad processes zero applicant data. Ranking 120 Colorado resumes so recruiters read only the top 20% of the applicant sample, or flagging bottom-decile call agents for PIP review, materially influences the outcome.
What must go into pre-decision notices, 30-day adverse letters, and human review?
Starting January 1, 2027, covered employers owe four operational steps (Legal 500):
- Point-of-interaction pre-use notice: Before ADMT processes personal data for a consequential decision, show a clear, conspicuous, plain-English, disability-accessible notice stating ADMT is in use and how to access full deployment details. Place it directly on the application screen and in your handbook.
- 30-day adverse-outcome explanation: When an ADMT-influenced decision produces an adverse outcome (rejected application, denied promotion, pay cut, or termination), send a plain-language disclosure within 30 calendar days stating: (a) the decision made, (b) the specific role ADMT played, (c) how to request deeper system details (tool name/version, developer, and personal data categories), and (d) how to request data correction and human review.
- Data correction and meaningful human review: Let individuals fix inaccurate personal inputs (such as a misparsed license date) and obtain meaningful human review and reconsideration where commercially reasonable. See candidate rights when an application is screened by AI.
- Three-year recordkeeping: Retain notices, 30-day letters, correction/review logs, and developer docs for at least 3 years (CO SB 26-189) (use 4 years if you also hire in Illinois or California).
How do voided vendor indemnity clauses and Colorado AG enforcement change risk?
SB 26-189 allocates discrimination fault between developers and deployers and voids blanket liability-shifting indemnity clauses as against public policy (Legal 500). Exclusive enforcement rests with the Colorado Attorney General.
- Fault allocation & voided indemnity: Developers must supply technical documentation on intended uses, training data, limits, and human review. If an employer uses the tool strictly as documented and it still discriminates, the developer is liable, and any SaaS clause forcing the employer to hold the vendor harmless for the vendor's defective model is void. Conversely, using a general chatbot outside documented scope shifts liability onto the employer; see 12 hiring-AI vendor contract questions and manager rules on ChatGPT in layoffs and reviews.
- AG enforcement & CCPA penalties:
SB 26-189creates no private right of action. Violations are deceptive trade practices enforced by the Colorado Attorney General under the Colorado Consumer Protection Act (C.R.S. s. 6-1-101 et seq.), with a 60-day cure period for curable breaches (CO AG). WhileSB 26-189relies on CCPA remedies rather than a standalone fine schedule, general CCPA civil penalties (C.R.S. s. 6-1-112) reach up to $20,000 per uncured violation (up to $50,000 involving older consumers). Watchcoag.govfor AG rules due January 1, 2027.
Worked math (labelled assumptions): A 28-person Fort Collins distributor screens 150 Colorado applicants across three Q1 2027 openings and rejects 138 candidates (a 92% rejection rate in the 150-applicant sample). Hand-writing 138 explanation emails at 10 minutes each burns 23 hours ($1,380 at $60/hour) and risks blown 30-day deadlines. Automating Part C of the ed.cafe Colorado Employer AI Readiness Checklist on the ATS rejection trigger takes 3 hours once ($180) and hits 100% of rejected candidates within 48 hours.
Ready-to-use checklist and letters: the ed.cafe Colorado SB 26-189 Template Pack
The ed.cafe Colorado Employer AI Readiness Checklist, Pre-Use Notice & Adverse-Decision Explanation Template gives HR generalists an eight-point audit, pre-use notice, 30-day explanation letter, and three-year log schema. Pair it with our one-page small-business AI use policy. Copy the ed.cafe Colorado Employer AI Readiness Checklist, Pre-Use Notice & Adverse-Decision Explanation Template below.
THE ED.CAFE COLORADO SB 26-189 EMPLOYER AI CHECKLIST & TEMPLATES (2027)
Statute: Colorado SB 26-189 (Automated Decision-Making Technology, live Jan 1, 2027)
Publisher: ed.cafe by No Worker Left Behind (501(c)(3), EIN 88-3268312)
DISCLAIMER: General operational template, NOT legal advice. Monitor coag.gov for
Colorado Attorney General rules due Jan 1, 2027 and review with Colorado counsel.
PART A: PRE-JANUARY 1, 2027 EMPLOYER READINESS CHECKLIST (ALL HEADCOUNTS)
[ ] 1. Retire SB 24-205 Checklists: Drop superseded Jun 30, 2026 dates and "<50 FTE"
exemption notes; SB 26-189 has NO small-business headcount exemption.
[ ] 2. Material-Influence Inventory: List every ATS, HR, pay, review, or scheduling
tool scoring CO applicants/staff (exclude spell-checkers, calculators, firewalls).
[ ] 3. Archive Developer Docs: Save each vendor's SB 26-189 packet (intended use,
data categories, limits, human-review steps) and stay strictly inside scope.
[ ] 4. Audit Vendor Indemnity: Flag hold-harmless clauses shifting vendor bias fault
onto your firm (void as against public policy under SB 26-189).
[ ] 5. Post Accessible Pre-Use Notice (Part B): Show on ATS submit pages and in the
CO handbook (WCAG-accessible, plain English) BEFORE ADMT runs.
[ ] 6. Automate 30-Day Adverse Letter (Part C): Fire automatically on ATS rejection,
denied promo, pay cut, or ADMT-assisted firing (<30 calendar days).
[ ] 7. Name Human Reviewer: Route data-correction and review requests to [Title/Email].
[ ] 8. Set 3-Year Log (4 Years if Multistate): Keep notices, developer docs, 30-day
letters, corrections, and review outcomes for >=3 YEARS.
PART B: POINT-OF-INTERACTION PRE-DECISION NOTICE (APPLICANTS & STAFF)
NOTICE OF AUTOMATED DECISION-MAKING TECHNOLOGY (COLORADO SB 26-189)
Before evaluating your application or employment record for [Role / CO Positions],
[Employer Name] uses [Tool Name & Version, by Developer Name], an Automated Decision-
Making Technology (ADMT), to assist with [e.g., matching resume credentials and
licenses against posted minimum job qualifications].
- Role in decision: [e.g., "Generates a qualification summary reviewed by a human
recruiter before interview selection."]
- More info & accessibility: View processed data categories, developer info, or
request an accessible format / accommodation at [URL | [email protected]].
PART C: 30-DAY ADVERSE-OUTCOME EXPLANATION & HUMAN-REVIEW LETTER
Date Sent: [YYYY-MM-DD] (MUST be <=30 calendar days from Decision Date [YYYY-MM-DD])
To: [Name] | Position / HR Action: [Job Title or Employment Decision]
1. PLAIN-LANGUAGE EXPLANATION: On [Decision Date], [Employer Name] decided not to
[advance your application for Role X / approve Action Y] based on [plain-English
criteria, e.g., required 3+ years of commercial estimating experience].
2. ROLE OF ADMT: We used [Tool Name & Version] to [exact role, e.g., parse work dates
and score alignment with required credentials, reviewed by our hiring manager].
3. YOUR COLORADO RIGHTS (AT ZERO COST):
- Request System Details: Ask for the ADMT name/version, developer identity, and
categories of personal data processed about you.
- Correct Personal Data: Tell us if the tool processed inaccurate personal data
(such as a misread license, degree, or employment date).
- Request Meaningful Human Review: Ask a human reviewer to reconsider your record
after correcting any inaccurate data.
TO REQUEST: Email [[email protected]] or call [(XXX) XXX-XXXX] with subject
"CO ADMT Review - [Your Name]". Receipt confirmed in [2] business days; human
review completed within [10] business days by [Reviewer Title].
PART D: 3-YEAR COMPLIANCE LOG SCHEMA (SPREADSHEET COLUMNS)
Record_ID | Person_ID | Role_Action | ADMT_Name_Ver | PreNotice_Date | Decision_Date |
Outcome | 30Day_Letter_Date | Info_or_Fix_Req_Date | Data_Fixed_YN | Reviewer_Name |
Reconsideration_Outcome | Retain_Until(+3Yr)Massachusetts residents building verification habits can access the free Google AI Professional Certificate through the Massachusetts AI Hub (Mass AI Hub; see our scoreable AI literacy rubric). At ed.cafe, operated by Boston 501(c)(3) No Worker Left Behind (EIN 88-3268312), Circle #1 is forming at ed.cafe/start/ as a free 30-chair cohort closing December 1, 2026 (pre-launch as of October 2026; zero cohorts have completed yet), alongside open guides on our Council page and Staff Room.
Where this stops being true
- AG rulemaking & federal litigation: Final Colorado Attorney General rules are due by January 1, 2027 (
coag.gov), and D. Colo. litigation (xAI / DOJ intervention) could alter specific provisions. - Off-label tool use: Using a general chatbot or ranker outside vendor documentation forfeits
SB 26-189's developer fault allocation. - Edge-case thresholds: Exact contours of
"commercially reasonable"human review and"material influence"await AG rules. - Stricter sister-state laws:
SB 26-189does not satisfy NYCLocal Law 144annual bias audits, IllinoisHB 3773(live now), or CaliforniaSB 947(July 1, 2027). - Not legal advice: This checklist and template pack provide general operational information, not legal advice. Have Colorado-licensed counsel review your notices, contracts, and workflows before January 1, 2027.
Questions people ask
Did Colorado repeal SB 24-205 and move its AI law deadline to January 1, 2027?
Yes. After SB 25B-004 pushed the deadline to June 30, 2026, Governor Jared Polis signed Senate Bill 26-189 on May 14, 2026, repealing and replacing SB 24-205 before it took effect. Under SB 26-189, Colorado's Automated Decision-Making Technology rules take effect January 1, 2027.
Are small businesses with fewer than 50 employees exempt from Colorado SB 26-189?
No. Repealed SB 24-205 excused deployers under 50 FTEs from annual impact assessments, whereas SB 26-189 eliminated annual impact assessments for all firms and has zero headcount exemption. Every employer using ADMT to materially influence Colorado employment decisions must give notices, 30-day explanations, and keep three-year logs.
What must Colorado employers send within 30 days of an AI-assisted rejection or firing?
Within 30 calendar days of an adverse outcome materially influenced by ADMT, the employer must send a plain-language explanation of the decision, state the ADMT's specific role, explain how to request system details (name/version, developer, and data categories), and describe data-correction and human-review rights.
Does Colorado SB 26-189 still require annual AI impact assessments for employers?
No. SB 26-189 repealed SB 24-205's annual algorithmic impact assessments, NIST risk-program mandates, and mandatory AG bias self-reporting. Employers instead archive developer technical docs, post pre-decision notices, send 30-day adverse explanations with human review, and keep records for three years.
Can an AI hiring vendor force a Colorado employer to sign a blanket hold-harmless indemnity clause?
Not for the vendor's own violations. SB 26-189 allocates liability by fault (holding developers liable when a tool used as documented still discriminates) and declares contractual indemnity clauses shifting a party's liability for its own discriminatory acts or statutory breaches void as against public policy.
Can rejected job applicants sue a Colorado employer directly under SB 26-189?
No, SB 26-189 creates no private right of action. Exclusive enforcement rests with the Colorado Attorney General under the Colorado Consumer Protection Act (C.R.S. s. 6-1-101 et seq.), featuring a 60-day cure period for curable breaches and CCPA civil penalties up to $20,000 per uncured violation.
Key terms
- Adverse outcome (
SB 26-189): Any denial, firing, demotion, pay cut, or material restriction of an employment opportunity materially influenced by ADMT, triggering a 30-day explanation. - Automated Decision-Making Technology (ADMT): Software processing personal data to generate predictions, scores, rankings, or recommendations guiding individual decisions, excluding calculators, firewalls, and spell-checkers.
- Materially influence: Threshold where an ADMT output meaningfully shapes a consequential employment decision rather than performing formatting.
- Point-of-interaction notice: Clear, accessible disclosure shown to a Colorado applicant or employee before ADMT processes personal data.
- Statutory cure period (60 days): Window under
SB 26-189to fix curable violations after Colorado Attorney General notice before CCPA penalties apply. - Void indemnity shift:
SB 26-189rule invalidating contract clauses that shift liability for a party's own unlawful discrimination or statutory breach.
Sources
- Colorado General Assembly, "Senate Bill 26-189: Automated Decision-Making Technology" (Signed May 14, 2026; live Jan 1, 2027): CO SB 26-189
- Colorado General Assembly, "Prior Bills: SB 24-205 & SB 25B-004": SB 24-205 and SB 25B-004
- Reinhart via Legal 500, "Colorado Overhauls Its AI Law Before 2027" (Jun 18, 2026): Legal 500
- McDermott Will & Emery via JD Supra, "Colorado AI Law in Flux" (2026): JD Supra
- Proskauer Rose, "DOJ Intervenes in Colorado AI Case" (Apr 28, 2026): Proskauer
- Colorado Attorney General, "CCPA Enforcement & Rulemaking Portal" (2026): Colorado AG
- StartBusinessByState & Big Ideas for Small Business, "2027 Tracker vs Stale Jun 2026 Guidance": State Tracker and Stale Jun 2026 Example
