How the Colorado AI Act Will Impact Employers in 2026

UPDATE: On May 14, 2026, Governor Polis signed Senate Bill 26-189, repealing and replacing the original Colorado AI Act. Meanwhile, enforcement is currently on hold due to an ongoing federal lawsuit. This article has been updated to reflect both developments.  

Colorado employers navigating AI compliance just got a significant update and a temporary reprieve. On May 14, 2026, Governor Polis signed Senate Bill 26-189 into law, replacing the original 2024 Colorado Artificial Intelligence Act. At the same time, enforcement of both the old and new law is currently on hold due to an active legal challenge.  

Here’s what you need to know right now.  

What was the Colorado AI Act?  

Enacted in May of 2024, the Colorado Artificial Intelligence Act was the most comprehensive state law regulating the use of artificial intelligence in the United States. It sought to regulate the use of “high-risk artificial intelligence systems.” This included AI tools used in employment decisions such as hiring, promotion, and termination. f it had taken effect as written, the AI Act would have  imposed significant obligations on Colorado employers, including:  

• Implementation of risk management policies and programs 
• Impact assessments evaluating the potential for algorithmic discrimination 
• Annual reviews of AI systems 
• Disclosures to employees and applicants about the use of AI in employment decisions 
• Reporting obligations related to algorithmic discrimination 

What Changed: SB 26-189 Is Now Law

On May 14, 2026, Governor Polis signed SB 26-189, which repeals and replaces SB 24-205. The new law takes effect January 1, 2027, and significantly scales back the original act’s requirements.  

What SB 26-189 Eliminates  

Employers who were building compliance programs for the original AI Act should note what is no longer required:  

1. No mandatory risk management program  
2. No annual impact assessments within 90 days of deployment  
3. No duty to self-report harms to the AG for algorithmic discrimination  
4. No freestanding duty of reasonable care to protect consumers from algorithmic discrimination  
5. No public statement summarizing deployed AI systems and risk management practices  

From “High-Risk AI” to “Covered ADMT”  

SB 26-189 shifts regulation to “Covered ADMT” — Automated Decision-Making Technology — defined as any technology that processes personal data and uses computation to generate outputs (predictions, recommendations, classifications, rankings, scores) used to make, guide, or assist a decision about an individual.  

The law applies when ADMT “materially influences” a consequential decision. For employers, covered decisions include:  

1. Hiring and termination  
2. Promotion and compensation  
3. Scheduling 

Notably, the law’s inclusion of differentiated pricing and compensation as consequential decisions is significant for employers using performance scoring, merit pay models, or dynamic compensation tools. Tools used purely for administrative support, as well as general-purpose AI chatbots (e.g., ChatGPT or Claude), subject to acceptable-use policies, generally fall outside the law’s scope.  

What SB 26-189 Still Requires  

Employers who use or deploy AI tools in hiring, performance management, or compensation (“deployers”) face four key obligations:  

1. Recordkeeping

Retain records demonstrating compliance for three years, including ADMT version identifiers, changelogs, and documentation of material changes to risk mitigation.  

2. Point-of-Interaction Notice

Provide a clear and understandable notice before using a covered ADMT to materially influence a consequential decision.  

3. Post-Adverse-Outcome Disclosure

Within 30 days of an adverse outcome (e.g., a rejected job application), provide a plain-language description of the decision, the ADMT’s role, and instructions for requesting additional information. 

4. Consumer Rights

Applicants have the right to inspect and correct factually inaccurate personal data and to request meaningful human review of adverse decisions where technically feasible.  

Important: The statute’s definition of “meaningful human review” is demanding. A reviewer must have the authority to override the decision, consider relevant evidence, be trained for the role, and not simply default to the system’s output. A recruiter who ratifies an AI-generated ranking without genuine deliberation does not meet this standard.  

Developer Responsibilities  

Under SB 26-189, developers are obligated to provide deployers with accurate and clear documentation concerning: 

1. Intended uses and harmful or inappropriate uses of covered ADMT 
2. The data used to train the covered ADMT 
3. Known limitations and risks of the covered ADMIT 
4. Instructions for the deployer’s appropriate use, monitoring, and meaningful review of the covered ADMT
5. A notice of material updates, modifications, and changes of intended use or risks for the covered ADMT 

Liability:  

SB 26-189 ensures that liability will be determined based on the developers’ and the deployers’ relative fault.  

1. Employers cannot escape liability for off-label use of AI tools  
2. Any contractual provision shielding a developer or deployer from liability for its own discriminatory acts is void  

No Private Right of Action: 

SB 26-189 does not allow individuals to sue businesses directly. Violations are enforceable only by the Attorney General.  

Cure period: The AG must provide developers and deployers 60 days to ‘cure’ a violation before taking formal action. 

Enforcement is currently on hold:   

As of May 2026, the Colorado AG has stated he does not intend to enforce SB 24-205 or any legislation replacing or amending it — including SB 26-189 — until after the rulemaking process has concluded. 

The xAI Lawsuit and Federal Intervention 

On April 24, 2026, the U.S. Department of Justice intervened in a lawsuit filed by xAI, a company owned by Elon Musk, seeking to block the Colorado AI Act entirely.  

The xAI lawsuit, filed on April 9, 2026, seeks a preliminary injunction arguing that the AI Act violates the U.S. Constitution. The DOJ’s intervention marks the first time the federal government has sought to invalidate a state AI law, citing Executive Order 14365, which sets out a federal policy to discourage and challenge state AI regulation.  

The DOJ’s central legal argument invokes the Equal Protection Clause of the Fourteenth Amendment, arguing that in requiring developers and deployers to prevent the “risk” of disparate outcomes based on demographic characteristics, the AI Act counterproductively requires the use of race, sex, religion, and other protected characteristics in building and using AI models.  

What Colorado Employers Should Do Now

The enforcement stay creates a window of opportunity, not a reason for delay, Here is what we recommend for Colorado employers:  

• Audit all AI and automated tools currently used in hiring, performance management, promotion, compensation, and termination decisions. 
• Assess whether those tools qualify as “Covered ADMT” under SB 26-189 — i.e., whether they materially influence consequential employment decisions.
• Review vendor contracts to understand where liability lies and flag any indemnification provisions that SB 26-189 now voids. 
• Begin developing notice and disclosure processes for employees and applicants affected by covered ADMT. 
• Design and document a meaningful human review process for adverse AI-assisted employment decisions. 
• Monitor AG rulemaking, which must be completed before enforcement can resume. 
• Remember: even without the enforcement of SB 26-189, discrimination claims arising from AI-assisted employment decisions remain actionable under existing state and federal law.

Not Sure How the AI Act Affects Your Business?  

The intersection of employment law and emerging technology is complex, and the rules are changing fast. If your organization uses AI or automated tools in any part of your HR or employment decision-making processes, The AR Group can help you assess your exposure and build a compliance framework that works. Contact us today. 

FAQs

Q: What happened to the original Colorado AI Act? 

A: Governor Polis signed SB 26-189 on May 14, 2026, which repeals and replaces SB 24-205 (the original 2024 Colorado AI Act). The new law takes effect January 1, 2027. 

Q: Is the Colorado AI Act currently being enforced? 

A: No. Enforcement is on hold. A federal court granted a stay on April 27, 2026, and the Colorado Attorney General has stated he will not enforce SB 24-205 or SB 26-189 until after the rulemaking process concludes. There is currently no firm enforcement date. 

Q: What types of AI tools are covered under SB 26-189? 

A: The law applies to “Covered ADMT” — automated decision-making tools that use personal data to generate outputs (scores, rankings, recommendations) that materially influence consequential employment decisions such as hiring, promotion, compensation, or termination. Administrative tools, spellcheckers, and general-purpose AI chatbots subject to acceptable-use policies are generally excluded. 

Q: What are employers’ primary obligations under SB 26-189? 

A: Employers who deploy covered ADMT must: (1) maintain records for three years, (2) provide point-of-interaction notice before using covered ADMT, (3) issue post-adverse-outcome disclosures within 30 days, and (4) provide meaningful human review rights to affected individuals. 

Q: What should Colorado employers be doing right now? 

A: Employers should audit their use of AI tools in employment decisions, review vendor contracts, begin drafting required notices, establish meaningful human review processes, and monitor AG rulemaking and legal developments closely.