If any technology helps decide who gets hired, promoted or paid at your company, you have four obligations and a fixed deadline. Most of the tools that trigger this are not what people think of as AI.
Plain-language summary of SB 26-189, the Automated Decision-Making Technology in Consequential Decisions Act. Not legal advice.
Until 12:00 AM Mountain Time, January 1, 2027 — when Colorado’s ADMT Act (SB 26-189) and HB 26-1263 take effect. California’s CCPA ADMT rules carry the same date.
The law does not say “AI.” That is the part most companies get wrong.
The statute regulates automated decision-making technology, which it defines as any technology that processes personal data and uses computation to generate output. There is no requirement that the tool learn, infer, or resemble AI in any way. A scoring rule written in 2015 qualifies.
In a typical hiring process, that reaches:
The statute does carve out a range of clerical tools. Calculators, databases and spreadsheets that require human analysis, and tools used solely to summarize, organize, translate or present information for human review. Interview transcription and note-taking generally sit on the safe side of that line.
The practical consequence: the question is not whether you bought an AI product. It is whether anything in your hiring stack produces a score, a rank, a filter or a recommendation that a human then acts on. Most companies at this size have several and have never inventoried them.
ChatGPT and similar tools are excluded. The exclusion is conditional, and the condition is a document.
The statute excludes general-purpose systems that communicate in natural language from the definition of automated decision-making technology — but only where both of the following hold:
Both conditions. Not either. This means the exemption is not something you have by default because you never meant to use ChatGPT for hiring. It is something you earn by having written the policy down, distributed it, and being able to produce it. An organization with the right intent and no written policy does not qualify on the statute’s terms.
The practical consequence: if a hiring manager pastes resumes into a general AI tool to summarize or compare them, and there is no policy prohibiting that use, the exemption you were relying on is not available. This is the cheapest gap on the page to close, and the one most likely to be open.
Disclosure comes first, not at the end.
Before covered technology is used to materially influence an employment decision, you must provide clear and conspicuous notice that automated decision-making technology is in use, and explain how the person can get more information. The statute describes that as a prominent public notice, reasonably accessible at the points where the interaction happens — a link or posting reasonably close to where the decision may occur is the example it gives. It must also be accessible to people with disabilities and limited English proficiency (§6-1-1704).
The practical consequence: one careers-page footnote will not cover both hiring and internal decisions. For hiring, the notice belongs in the online application flow. For promotion, performance and compensation, a public posting alone makes little practical sense, so most employers need a second point of notice closer to the decision itself.
An adverse decision starts a clock, and the notice has to name specifics you cannot reconstruct later.
Within 30 days of an adverse decision that was materially influenced by covered technology, you must provide a notice containing (§6-1-1704):
On request, you must then provide instructions for accessing and correcting personal data that was factually incorrect or materially inaccurate, and an opportunity for meaningful human review of the decision.
The Attorney General’s draft rules would add content requirements to this notice. They are a proposal and may change, but they are readable now:
The practical consequence: look closely at the version number and developer requirement. That information exists at the moment of the decision and is frequently gone by the time a request arrives — vendors update, contracts change, tools are swapped. There is no way to answer that request after the fact. It requires an inventory maintained continuously, before any decision is made, recording which tool and which version was in service on a given date. That is the single largest operational gap this law creates, and it is invisible until the first request arrives.
A person with authority to change the outcome — and the draft rules are specific about who that can be.
Where a person contests an adverse decision, they are entitled to meaningful human review and reconsideration (§6-1-1705). The statute limits this to the extent it is commercially reasonable, and leaves “meaningful” otherwise undefined. The proposed rules published on August 11, 2026 close most of that room. A reviewer would need to be:
The practical consequence: that last requirement is the one to read twice. A review conducted by the same manager who made the original call, assisted by the same tool that produced it, would not qualify under the draft. The rules are not final — comments close October 26, 2026 — but they are the clearest signal available of what an enforcement action will look for, and they are considerably narrower than the statute alone suggests.
The retention requirement names version identifiers and changelogs specifically.
You must retain, for at least three years after each covered decision, the records reasonably necessary to demonstrate compliance — version identifiers, changelogs, and documentation of material mitigation changes among them (§6-1-1702, §6-1-1703). In practice a complete record for a single decision includes:
The practical consequence: vendors push model and scoring updates without announcing them, and often without a version number visible in the interface. If a candidate screened in March asks in September which system evaluated them, and your vendor has shipped two updates since, there is no way to establish after the fact which version ran. That state has to be captured at the time of the decision. It cannot be recovered.
Three years also means the obligation compounds. The first decision made on January 1, 2027 starts a record that must survive until January 2030.
Broader than hiring, narrower than every use of technology.
Access to, eligibility for, selection for, and compensation for employment. That reaches inside the employment relationship, not just the door: promotion, internal selection, performance evaluation and pay, wherever covered technology materially influences one of them.
Only employers doing business in Colorado are subject to the Act. There is no employee-count threshold and no phase-in — the obligations attach to decisions made on or after January 1, 2027.
The practical consequence: the exposure sits in the gap between those two lists, and most organizations misjudge it the same way — assuming this is a hiring problem and stopping there. Compensation review and internal promotion are where covered technology is most often in use and least often documented, because nobody thought of the pay-banding tool as an automated decision system.
The Attorney General enforces this, and the rules are already on the table.
Those rules are no longer hypothetical. Proposed rules were published on August 11, 2026; written comments close on October 26, 2026, with a rulemaking hearing the same day. They are a draft and may change — but they are the clearest available statement of how the Attorney General reads the statute, and they are more specific than the statute on both the adverse-decision notice and human review.
The practical consequence: the cure period is not a safety net for a records problem. Curing requires producing evidence, and if the evidence was never captured there is nothing to produce. That is why the records duty is worth starting first, even though it sounds like the least urgent of the four.
Every clause the platform writes cites one of these, each mapped to its own statutory pincite. The system retrieves controls; it never invents them — which is what makes the output defensible to the Attorney General rather than merely plausible. Colorado is included from Starter as part of the U.S. States jurisdiction.
Fifteen questions, about ten minutes, free. No account and no sales call. You get a banded score and a named list of the gaps behind it.
Colorado General Assembly — SB 26-189 · Colorado Attorney General — ADMT rulemaking
This page is a plain-language summary of Colorado SB 26-189, the Automated Decision-Making Technology in Consequential Decisions Act, effective January 1, 2027, and of the Attorney General’s proposed implementing rules, which are not final. It is not legal advice, and GOVERNBOX.ai does not promise a regulatory outcome. Check your obligations with counsel. GOVERNBOX.ai is a product of Gradient Descent LLC, an independent commercial company that is not affiliated with, endorsed by, or sponsored by the State of Colorado or any U.S. government agency.