Colorado Legislature Passes New Law Governing Consumer Protections for Artificial Intelligence: What Employers Need to Know About SB26-189

During the 2026 legislative session, Colorado lawmakers significantly amended the Consumer Protections for Artificial Intelligence Act (SB24-205) and, among other things, decreased the burden on employers who use artificial intelligence (“AI”) to make important decisions about hiring, job performance, compensation, and termination. This article discusses the steps that led to the amendment, provides employers with a summary of their obligations under the new law, and identifies steps employers should consider taking before the new law takes effect on January 1, 2027.[1]

Background

In 2024, the Colorado legislature enacted SB24-205 governing Consumer Protections for Artificial Intelligence, making Colorado the first state in the country to establish a regulatory framework aimed at lowering the risk of algorithmic discrimination in artificial intelligence-based decision-making technology. The law applied broadly to “developers” and “deployers” of “high-risk artificial intelligence systems,” including employers, and was originally to be implemented by February 1, 2026. During a Special Legislative Session in August of 2025, however, the General Assembly amended SB24-205 by extending the compliance deadline to June 30, 2026 to allow industry leaders and legislators additional time to address concerns about the law before employers were required to comply with it.

In the Fall of 2025, the Governor created the Colorado AI Policy Work Group (the “Work Group”) comprised of stakeholders, including consumers, hospitals, school districts, and other users of technology, as well as large and small technology companies, for the purpose of developing a better framework for protecting consumers while still allowing AI innovation to thrive.[2] The Work Group spent significant time investigating national policy trends, identifying policy goals and risks, and negotiating a new policy.

In March of 2026, the Trump Administration issued A National Policy Framework for Artificial Intelligence, urging Congress to preempt unduly burdensome state AI laws.[3] In April of 2026, the Department of Justice also intervened in a lawsuit filed by xAI, a company owned by Elon Musk, challenging SB24-205 and alleging that SB24-205 violates the Equal Protection Clause of the Fourteenth Amendment.[4]

Meanwhile, the Colorado Work Group finalized a new framework and recommended its adoption to the legislature.[5]

SB26-189

On May 9, 2026, Colorado lawmakers passed SB26-189 (the “Act”). The governor signed it into law, and it is now codified at Colo. Rev. Stat. §§6-1-1701 to 6-1-1709, 6-1-105, and 10-3-1104.9.[6] The Act is detailed and should be read in its entirety. In short, the Act governs the deployment of ADMT used to “materially influence” a “consequential decision” and creates new notice and disclosure requirements for employers while providing employees with processes for challenging decisions made by ADMT. Employers who deploy covered ADMT must comply with the Act by January 1, 2027. Although certain types of entities are exempted from the requirements of the Act to the extent they comply with other legal obligations.

Failure to comply with the Act constitutes a deceptive trade practice under the Colorado Consumer Protection Act (CCPA), allowing the AG to assert claims against employers and to impose expensive monetary penalties for each violation. Failure to comply may also constitute discrimination, subjecting employers to anti-discrimination claims. The Colorado Attorney General (AG) is charged with enforcing the Act and has been instructed by the legislature to adopt rules to clarify and implement the new law. The AG must, however, issue a notice of violation and provide the employer sixty days to cure the violation (unless it is a knowing or repeated violation). Notably, the Act does not create a private right of action for employees.

The Act also addresses the allocation of fault between developers and deployers of ADMT and prohibits certain types of risk-shifting provisions in contracts between developers and deployers.

ADMT is defined by the Act as “technology that processes personal data and uses computation to generate output, including predictions, recommendations, classifications, rankings, scores, or other information that is used to make, guide, or assist a decision, judgment, or determination concerning an individual.”[7] “A “consequential decision” is a decision, determination, or action made about an employee[8] that relates to the provision of or an employee’s access to, eligibility for, selection for, or compensation for employment or an employment opportunity that creates or may create an employer-employee relationship. A consequential decision is also defined as a decision, determination, or action about an employee that relates to compensation or other material terms in a manner that is reasonably likely to materially limit, delay, effectively deny, or otherwise fundamentally alter the employee’s access, eligibility, or opportunity for employment or an employment opportunity that creates or may create an employer-employee relationship.[9]

The Act requires employers who use “covered ADMT”[10] to materially influence a consequential decision to comply with the following requirements:

• Employer Record Keeping. For at least three years, employers must keep all records reasonably necessary to demonstrate compliance with the Act such as covered ADMT version identifiers, changelogs, and documentation of material mitigation changes.[11]
• Point-of-Interaction Notices. Prior to using covered ADMT to materially influence a consequential decision, an employer must provide a clear and conspicuous notice to an employee that the employer used or will use a covered ADMT in a consequential decision affecting the employee and give the employee instructions regarding how the employee may obtain additional information about the covered ADMT. An employer complies with this requirement by maintaining a prominent public notice that is reasonably accessible at points of employee interaction, including through a link or posting that is reasonably proximate to the interaction or transaction in which a consequential decision may occur.[12]
• Adverse Outcome Description and Instructions. If an employer uses covered ADMT to materially influence a consequential decision that results in an adverse outcome for an employee, the employer must provide the employee with a description of the consequential decision and the role the covered ADMT played in the consequential decision along with instructions, a simple-to-follow process to request additional information about the covered ADMT, and an explanation of the employee’s rights, which are discussed below.[13]
• Employee Rights, Correction, Human Review, and Reconsideration. When an employee experiences an adverse outcome resulting from a consequential decision in which covered ADMT materially influences the consequential decision, the employee may request: (1) instructions for requesting personal data and correcting factually incorrect or materially inaccurate personal data used in a consequential decision that used covered ADMT; and (2) an opportunity for “meaningful human review”[14] and reconsideration of the consequential decision, to the extent commercially reasonable.

The Act provides that a developer or deployer of ADMT (including employers) may be held liable in an action alleging unlawful discrimination under state anti-discrimination laws arising from a consequential decision materially influenced by a covered ADMT.[15] In an action of this type, fault is allocated among deployers and developers based on their relative fault for the violation.[16] The Act does not create joint and several liability.[17] It is also important to note that the Act makes indemnity or risk shifting provisions in contracts between developers and deployers related to liability for the developer’s or deployer’s own acts or omissions related to the use of ADMT in making significant decisions in violation of the Act void as against public policy.[18]

Next Steps for Employers 

Employers have until January 1, 2027, to prepare for the implementation of the Act and should consider taking steps now to ensure they are able to timely comply with its requirements. As a starting point, an employer would be wise to do the following: (1) familiarize yourself with the Act; (2) determine if your business or organization is required to comply with the Act; (3) watch for related regulations to be proposed by the AG for the purpose of enforcing the Act; (4) watch for federal legislation or lawsuits that may add to or negate compliance with the Act; (5) inventory all ADMT being used by the business or organization and determine if it constitutes covered ADMT; (6) prepare and implement the required notices and processes outlined above; (7) develop a record keeping system; and (7) review third-party and vendor contracts for compliance with the Act.

If you have questions about SB26-189 and its potential effect on your business, please contact BHGR’s Employment Group today.

Sources

Read More Read Less