Colorado Repeals Prior AI Guardrails, Replaces with AI Transparency Rules

Colorado has enacted legislation to repeal and replace a law intended to establish guardrails against discrimination arising from the use of artificial intelligence (AI). The state’s new rules on AI are scheduled to take effect on January 1, 2027.

The Details

Background

In 2024, Colorado enacted Senate Bill 24-205, which would have classified certain uses of AI in the workplace as high-risk and imposed obligations on how employers use and monitor AI systems, along with specific disclosure and reporting requirements.

As enacted, the law would have expressly required a deployer of a "high-risk AI system" to use reasonable care (as defined by the law) to protect individuals from any known or reasonably foreseeable risks of "algorithmic discrimination."

Senate Bill 24-205 was scheduled to take effect on June 30, 2026, but enforcement had already been temporarily suspended due to pending litigation.

Repeal and Replacement

On May 14, 2026, Colorado’s governor signed legislation (Senate Bill 26-189) that repeals and effectively replaces Senate Bill 24-205. The new law generally replaces many of the rules regarding duty of care and risk management with rules requiring transparency.

Beginning January 1, 2027, Senate Bill 26-189 will require developers and deployers of artificial intelligence systems with “automated decision-making technology” (ADMT) to take specified actions.

What is ADMT?

Under the new law, ADMT generally includes tools that use personal data to generate rankings, scores, recommendations, or other outputs that help make decisions about an individual.

ADMT excludes many routine tools used solely to summarize, draft, organize, or route information for human review or administrative processing.

Key Employer Requirements

The core obligations of the new law for deployers of AI apply to employers and other entities that use ADMT that materially influences consequential decisions (for example, hiring, promotions, and compensation).

Under Senate Bill 26-189, employers that use covered ADMT must:

• Notify individuals before using the ADMT, by posting a prominent public notice that is reasonably accessible at points of interaction with the applicant/employee, including through a link or posting that is reasonably proximate to the interaction in which a consequential decision may occur.
  
  
• Provide an adverse-outcome notice to the individual within 30 days if the use of the covered ADMT results in an adverse outcome. The notice must provide a plain‑language description of the covered ADMT’s role, include instructions for requesting more information about the ADMT and its inputs, and list applicant and employee rights. The Colorado Attorney General must adopt rules clarifying this requirement by January 1, 2027.
  
  
• Respond to requests for corrections of inaccurate data by conducting a meaningful human review and reconsidering the decision to the extent reasonable.

• Retain records documenting compliance with the law for at least three years from the date of the decision, unless a longer retention period is required by another state or federal law.

ADP will continue to monitor the status of the new Colorado AI law and report on any updates.

Next Steps

Covered employers should:

• Review the new law in full.

• Identify all tools that may qualify as covered ADMT.
• Determine which processes involve consequential decisions.
• Implement pre-use AI disclosures.
• Build adverse-outcome notification workflows.
• Establish human review processes.
• Create a process for data correction requests.
• Update policies and employee/applicant notices.
• Maintain required records for at least three years.
• Coordinate with vendors for AI system disclosures/documentation and update notices as tools change.
• Monitor the state’s website for attorney general rulemaking updates.