Colorado just rewrote its AI hiring law. Here is what HR actually owes now.
The duty of care that every HR team spent a year preparing for is gone. A lighter, disclosure based rule takes its place in 2027. The smart move is not to relax. It is to build the one habit every version of this law keeps asking for.
Key Takeaways
- The core change: Colorado signed SB 26-189 on May 14, 2026, repealing the original Colorado AI Act. The duty of care, the risk assessments, and the impact assessments that HR teams were told to prepare for no longer exist.
- What replaced it: a lighter, disclosure based rule that starts January 1, 2027. If software helps decide who gets hired, promoted, disciplined, paid, or let go, the employer owes notice, an explanation when the answer is adverse, basic records, and a path for the person to ask for human review.
- Why it still matters if you are not in Colorado: New York City, Illinois, California, and the EU already require pieces of the same thing. The direction of travel has not changed even though one state softened its rule.
- The one habit to build now: keep a named human accountable for every employment decision a tool touches, write down why the decision was made, and tell candidates when a machine was part of it. That habit satisfies almost every version of this law and protects you even where no law applies yet.
The Leveraged Years Briefing. Permalink
The law you prepared for was canceled
For most of the past year, HR teams treated June 30, 2026 as a deadline. That was the date the original Colorado AI Act, known as SB 24-205, was finally supposed to take effect after two delays. It was the first broad state law in the country aimed at "high risk" AI, and it carried real weight: a duty of care to protect people from algorithmic discrimination, formal risk management programs, and impact assessments for any system that helped make a consequential decision. Hiring sat squarely inside its scope.
That law is now gone. On May 14, 2026, Governor Jared Polis signed SB 26-189, which repealed the original act and replaced it with something much narrower. The duty of care is gone. The mandatory risk management programs are gone. The impact assessments are gone. If your team built a binder to satisfy the June 30 regime, the standard that binder was written for no longer exists.
This is the first thing to get straight, because a lot of guidance published in early 2026 is now describing a law that was repealed. If you read an article telling you to complete an impact assessment before summer to stay compliant in Colorado, it is out of date. Check the date on anything you are working from.
What the new Colorado rule actually asks for
The replacement, SB 26-189, takes effect January 1, 2027, and it takes a different shape. Instead of asking employers to prove a system is safe in advance, it asks them to be transparent after the fact. Lawyers describe it as a move from a "system level" obligation to a "decision level" one. You are no longer being asked to audit the model. You are being asked to stand behind each individual decision the model touched.
In plain terms, if automated decision making technology helps make a consequential decision about a person, including hiring, promotion, discipline, compensation, or termination, the new law points at four duties:
- Advance notice that automated tools may be used.
- A disclosure after an adverse decision that explains, in human terms, what happened.
- Records that show how decisions were handled.
- A limited right for the affected person to access the information, correct bad data, and ask for meaningful human review.
None of that requires a compliance department. It requires that a person, not a black box, owns the outcome, and that you can explain and document what happened when someone asks.
Why a Colorado rule matters in a state you do not operate in
It is fair to ask why an HR leader in Texas or Florida should care about a Colorado statute that does not bind them and does not start until 2027. The honest answer is that Colorado is not the only place writing these rules, and the others did not soften.
New York City already enforces Local Law 144, which requires bias audits and candidate notice for automated employment decision tools. Illinois regulates AI use in video interviews. California has been finalizing its own rules on automated decision making technology in employment. The EU AI Act treats AI used in hiring as high risk and attaches real obligations to it. Read those together and a pattern is obvious. The specific thresholds differ by jurisdiction, but the same three ideas keep appearing: tell people when a machine is involved, keep a human accountable for the decision, and be able to explain it.
So the useful way to read the Colorado reversal is not "the rules got easier, relax." It is "even the state that blinked still kept notice, human review, and records." Those three are becoming the floor, not the ceiling. If you build to that floor once, you are close to compliant almost everywhere, and you are protected against the next law before it is written.
What HR should actually do now
Here is a practical sequence that is defensible under almost any version of these laws, and that does not require you to over build to a standard that was just repealed.
First, find where automated tools already touch employment decisions. Most teams underestimate this. Resume screeners, ranking and matching features inside your applicant tracking system, automated scheduling that effectively filters candidates, and AI assisted note taking in interviews all count. You cannot govern what you have not listed.
Second, put a named human in front of every one of those decisions. The legal weight is shifting to the individual decision, so the person who made it should be identifiable and should be able to say why. A tool can rank or draft. A person decides.
Third, write down the basis for the decision in a sentence or two. Not a report. A short, honest record of what was considered. This is the single artifact that satisfies the records duty and that saves you if a decision is ever questioned.
Fourth, tell candidates and employees when automated tools are part of the process. A short, plain notice does most of the work. It is already required in New York City and is built into both the new Colorado rule and the EU approach.
Fifth, be ready to correct and to offer a human second look. If someone says the data about them was wrong, have a way to fix it and to take another look without the tool. That is the "meaningful human review" piece, and it is good practice even where no law demands it.
What you should not do is rebuild a full risk management program to satisfy a Colorado duty of care that no longer exists. Spend the effort on the habit that survives every rewrite, not on the version that was struck.
The skill under the compliance
Most of this is not really a legal project. It is a question of whether the people on your team know how to use these tools in a way that is explainable and fair in the first place. A screener you understand is easy to disclose and easy to defend. A screener nobody on the team can explain is a problem in every jurisdiction, law or no law.
That is the part worth investing in: training your HR team to use AI in hiring so that a human stays in control, the reasoning stays visible, and the documentation falls out of the work instead of being bolted on afterward. We wrote a companion piece on the day to day version of this, how HR teams can use AI safely, and it pairs directly with this one. If you want the structured version, The Leveraged HR Professional walks an HR team through exactly that workflow.
Frequently Asked Questions
Is the Colorado AI Act still happening on June 30, 2026?
No. The original Colorado AI Act (SB 24-205) was repealed before it ever took effect. Governor Polis signed its replacement, SB 26-189, on May 14, 2026. The June 30, 2026 date and the duty of care that went with it no longer apply. The new, lighter rule takes effect January 1, 2027.
Does my company have to do anything if we do not operate in Colorado?
Not under the Colorado law itself, which only binds activity tied to Colorado. But similar rules already apply elsewhere, including New York City's Local Law 144, Illinois's video interview law, California's automated decision rules, and the EU AI Act. If you hire across states or countries, the safe baseline is to assume notice, human review, and recordkeeping will be expected somewhere in your footprint.
What is the difference between the old Colorado rule and the new one?
The old rule asked employers to prove their AI systems were safe in advance through risk and impact assessments and a duty of care. The new rule drops all of that and instead asks for transparency around individual decisions: notice that AI may be used, an explanation after an adverse decision, records, and a right to human review. Lawyers describe it as a shift from the system level to the decision level.
Is this briefing legal advice?
No. The Leveraged Years is an education company, not a law firm. This is a plain language summary of a fast moving area, and the rules have already changed twice. Treat it as background, and talk to qualified employment counsel before you set or change a policy.