Colorado made national headlines in 2024 by becoming the first state to enact a comprehensive law regulating high-risk artificial intelligence (AI) systems. The law immediately drew significant attention and criticism, from businesses and technology companies, prompting concerns about compliance burdens, uncertainty, and the potential impact on innovation. Following extensive stakeholder feedback, legislative debate, and ongoing legal challenges, Colorado has now substantially revised that framework through SB 26-189, replacing the original law before many of its core requirements took effect. 

Governor Polis signed SB-26-189 into law on May 14, 2026, and it takes effect January 1, 2027.  

Rather than regulating “high-risk AI systems,” the new law focuses on the use of automated decision-making technology (ADMT) in specified high-impact decisions. While the revised approach is narrower and less prescriptive than the original law, employers using AI to assist in making consequential employment-related decisions should not assume they fall outside the law’s revised scope.  

A few key definitions employers should keep in mind: 

• Automated Decision-Making Technology (ADMT). SB 26-189 defines ADMT as technology that processes personal data and uses computation to generate outputs such as predictions, recommendations, classifications, rankings, scores, or similar information that are used to make, guide, or assist decisions about an individual.  

• Consequential Decision. A consequential decision is defined as one that materially affects an individual’s access to, eligibility for, or opportunity regarding important areas of life, including employment. Employment decisions covered by the law include hiring, promotion, discipline, termination, compensation, and other decisions that materially affect employment opportunities.  

What Does It Mean? 

Colorado’s revised law reflects an important shift in AI regulation. Rather than abandoning AI oversight following significant business opposition, Colorado’s legislature chose to significantly narrow and simplify the original framework while preserving consumer transparency protections for AI-assisted consequential decisions. 

AI governance continues to grow in importance, particularly where AI tools influence employment decisions. Employers using resume screening tools, applicant ranking software, automated assessments, or other technologies that help make or influence employment decisions should understand when those tools qualify as ADMT under the new law and what obligations may apply. Employers should think broadly when evaluating these technologies.  

As AI use in the workplace becomes ubiquitous, employers should avoid assuming ADMT applies only to commercially available AI products designed specifically for human resources. Under the revised law, the analysis focuses on whether technology processes personal data and generates outputs that are used to make, guide, or assist consequential decisions, not on who developed the technology. As organizations and their employees increasingly move toward developing their own internal AI workflows, custom GPTs, AI agents, automated scoring models, or other AI-enabled processes using company-approved (or not approved!) AI tools, those internally developed solutions could potentially qualify as ADMT if they are used to influence consequential employment decisions. Employers should therefore evaluate both vendor-provided AI solutions and internally developed AI workflows, agents, applications, and other AI-enabled processes as part of their overall AI governance and compliance efforts. 

More broadly, Colorado’s experience illustrates how rapidly AI regulation continues to evolve. Even where states revisit or scale back earlier legislation, lawmakers continue to pursue frameworks governing the use of AI in consequential employment-related decisions rather than stepping away from regulation altogether. 

A few key next steps:  

• Inventory AI tools used throughout the employment lifecycle, including recruiting, hiring, promotion, performance management, and termination decisions. 

• Determine whether any AI tool – or the way an AI tool is being used – constitutes ADMT and whether it is used to materially influence consequential employment decisions under the statute. 

• Review vendor agreements and documentation to understand how AI tools function, what data they use, and what information vendors can provide to support compliance. 

• Strengthen AI governance practices by establishing internal review processes and documenting human oversight, and periodically reviewing new AI use cases developed within the organization.