Colorado's Automated Decision-Making Technology (ADMT) Act: What Changes for Hiring

Colorado's ADMT Act reaches hiring directly, and the date that matters is January 1, 2027. Senate Bill 26-189, signed on May 14, 2026, repealed and reenacted the state's 2024 AI law as the Automated Decision-Making Technology Act, codified at part 17 of article 1 of title 6 of the Colorado Revised Statutes, and it applies to consequential decisions made on or after that date.

Guidance written before mid-2026 often gives February 1, 2026 or June 30, 2026 as the deadline. Both belonged to the earlier statute, SB 24-205, whose start date was pushed back twice and whose enforcement a federal court restrained in April 2026. That framework is gone, and what replaced it is narrower and easier to prepare for.

Key Takeaways

• The Colorado ADMT Act takes effect January 1, 2027 and applies to consequential decisions made on or after that date. February 1, 2026 and June 30, 2026 are dead dates from the repealed statute.
• Employment is an expressly covered domain, and "consumer" is defined to include an employee and a job applicant who is a Colorado resident.
• The reenacted law dropped the duty of reasonable care, mandatory impact assessments, and the required risk management program, replacing them with notice, disclosure, correction, and human review duties.
• Candidate-facing duties are concrete: clear notice before use, a plain language explanation within 30 days of an adverse outcome, and three years of records.
• The attorney general enforces it exclusively as a deceptive trade practice, with a 60-day cure period where a cure is possible. There is no new private right of action, and existing discrimination claims are untouched.

Why hiring sits squarely inside the Colorado AI employment law

Employment is one of seven covered domains named in the statute, specifically "employment or an employment opportunity that creates or may create an employer-employee relationship." The definition of "consumer" includes an employee and a job applicant who is a Colorado resident, so you do not need a Colorado office to be covered.

The trigger is "covered ADMT," meaning automated decision-making technology used to materially influence a consequential decision. Material influence means the output is a more-than-trivial factor affecting the outcome, including by ranking, scoring, classifying, or constraining how the decision is made. A resume screener that orders your shortlist qualifies. A spell-checker does not, and the statute puts routine technologies such as databases, firewalls, and non-machine-learning spreadsheets outside the definition.

Developer, deployer, or both

A developer builds, sells, licenses, or otherwise makes a covered ADMT commercially available. A deployer is a business in Colorado that puts one into use, which is where most employers sit.

The trap is the third limb of the developer definition: a person who intentionally and substantially modifies an ADMT so that it becomes a covered ADMT is a developer too. An employer that trains a scoring model on its own hiring history, or reconfigures a tool so its output drives a decision the vendor never documented, can carry both sets of duties.

What the new Colorado law dropped, and why it matters

Three of the most-discussed obligations of the 2024 statute did not survive the rewrite. The enacted text of SB 26-189 has no duty of reasonable care against algorithmic discrimination, no mandatory impact assessments, and no required risk management program. It also drops the headcount-based carve-out the 2024 law gave smaller deployers on certain subsections.

Do not read that as relief. Title VII and the US Equal Employment Opportunity Commission still apply, the Colorado Anti-Discrimination Act still applies, and the ADMT Act says plainly that a developer or deployer may be liable in a discrimination action arising from a decision influenced by a covered ADMT. Colorado simply stopped prescribing the governance paperwork. The NIST AI Risk Management Framework is not named in the statute, but it remains the most used voluntary reference for the review the law no longer spells out.

The four duties that touch your candidate experience

Notice comes first. Before a covered ADMT is used to materially influence a hiring decision, the deployer must give clear and conspicuous notice that it was or will be used, plus instructions for obtaining more information. A prominent public notice near the point of interaction, such as a link on the application page, satisfies this.

Adverse-outcome disclosure comes second. Within 30 days of a decision that denies or materially restricts an opportunity, the candidate gets a plain language description of the decision and the tool's role in it, a simple process to request detail including the tool's name, version, developer and data categories used, and an explanation of their rights.

Third, candidates may request their personal data and correction of anything factually incorrect or materially inaccurate. That right runs to facts, not to opinions, predictions, or scores.

Fourth, a candidate with an adverse outcome may request meaningful human review and reconsideration, to the extent commercially reasonable. The statute defines that tightly: a designated, trained person with authority to approve, modify, or override the decision, who weighs the primary evidence and does not default to the system output. Notices must be accessible to people with disabilities and people with limited English proficiency.

Enforcement and the contract clause worth checking today

The attorney general has exclusive enforcement authority through the Colorado Consumer Protection Act, and a violation is a deceptive trade practice. A notice of violation and 60 days to cure come first where a cure is deemed possible; no cure period is required for knowing or repeated violations. Rules clarifying the post-adverse-outcome disclosures are due on or before January 1, 2027, so some detail is still moving.

One provision deserves attention now. Any contract term purporting to hold a party harmless for its own acts or omissions in using ADMT in violation of Colorado anti-discrimination law is void as contrary to public policy, and fault is allocated by relative fault. An indemnity you negotiated in 2024 may not do what you assumed, which is reason enough to revisit the questions in AI Vendor Accountability Recruitment: Your Legal Duty before your next renewal.

The federal picture moved in the other direction

Federal posture on disparate impact has receded. A June 9, 2026 Department of Justice Office of Legal Counsel opinion concluded that the EEOC's disparate-impact guidelines, including the Uniform Guidelines on Employee Selection Procedures, are unconstitutional and inconsistent with Title VII, implementing Executive Order 14281. The EEOC has aligned its enforcement priorities accordingly.

Read that carefully. An OLC opinion is executive-branch legal advice. It does not bind courts, amend Title VII, or overrule Griggs v. Duke Power Co., 401 U.S. 424 (1971). Disparate-impact liability is statutory at 42 U.S.C. 2000e-2(k), and private plaintiffs keep an independent right to sue. Fourteen state attorneys general have issued joint guidance affirming enforcement, and California, New York, New Jersey, and Illinois have codified protections. Exposure relocated toward private plaintiffs and state regulators rather than disappearing, and validation evidence and applicant-flow records remain your defense.

A readiness runway, month by month

• Now to end of 2026 Q4 - Action: Inventory every tool that scores, ranks, or filters candidates. Record vendor, version, and the stage it influences.; Output you should hold: A tool register naming each covered ADMT and its decision stage
• Same window - Action: Classify each tool: does its output materially influence the outcome, or is it incidental?; Output you should hold: A written scoping decision per tool, with reasoning
• Same window - Action: Request developer documentation: intended uses, training data categories, known limitations, human review instructions.; Output you should hold: Vendor documentation pack, or a gap list for procurement
• 2026 Q4 - Action: Review vendor contracts for void indemnity terms and add a documentation and update-notice obligation.; Output you should hold: Amended or flagged contracts
• 2026 Q4 - Action: Draft the application-page notice and the 30-day adverse-outcome template. Name a trained human reviewer with override authority.; Output you should hold: Published notice, disclosure template, named reviewer and training record
• By January 1, 2027 - Action: Switch on three-year retention for decisions, versions, changelogs, and requests. Check the attorney general's final rules.; Output you should hold: Retention schedule and a rules-review note
• Ongoing from 2027 - Action: Test selection rates by group at each stage and log correction and review requests with outcomes.; Output you should hold: Stage-level rate analysis and a request log

Two design choices shorten this runway. Structured, job-related assessment content is easier to explain to a candidate and a regulator than an opaque composite score, which favors shortlists built from skills evidence in a skill tests library over inferred traits. And keeping a human decision-maker between the output and the offer, with the reasoning written down, turns a required review into something you can show. Righteo supplies AI skill assessments and automated reference checks that produce documented, role-specific evidence; the scoping and notice calls remain yours.

This article is general information for US employers and is not legal advice. Confirm your obligations with employment counsel in the states where you hire.

Related Resources

SB26-189 Automated Decision-Making Technology | Colorado General Assembly

US Equal Employment Opportunity Commission

AI Vendor Accountability Recruitment: Your Legal Duty

How to Audit Recruitment AI Algorithms for Bias

AI Skill Assessments

HR and Pre-Employment Resources and Articles

Frequently Asked Questions

When does the Colorado ADMT Act take effect?

January 1, 2027, for consequential decisions made on or after that date. The earlier dates of February 1, 2026 and June 30, 2026 belonged to SB 24-205, which SB 26-189 repealed and reenacted on May 14, 2026.

Does the law apply if my company is not based in Colorado?

It can. The duties attach to any business doing business in Colorado, and consumer includes a job applicant who is a Colorado resident. Remote hiring into Colorado puts the question on the table.

Do I still need impact assessments for hiring tools?

Not under this statute. The reenacted law removed mandatory impact assessments, annual reviews, and the risk management program. Testing your own applicant flow for stage-level differences is still the evidence you would want in a discrimination claim, and the method is covered in How to Audit Recruitment AI Algorithms for Bias.

Can candidates sue under the ADMT Act?

The act creates no new private right of action and is enforced exclusively by the attorney general. It leaves existing rights intact, so a candidate can still bring a claim under the Colorado Anti-Discrimination Act or federal law.

If federal disparate-impact enforcement has receded, can we stop measuring adverse impact?

No. The Uniform Guidelines remain codified at 29 CFR Part 1607, disparate-impact liability remains at 42 U.S.C. 2000e-2(k), and private plaintiffs and state regulators can still pursue it. The same records also evidence intentional-discrimination claims, which the EEOC says it is prioritizing.

Narrower Duties You Can Build in a Quarter

Colorado replaced an ambitious governance statute with a narrower set of duties you can build in a quarter: know which tools materially influence a hiring outcome, tell candidates, explain adverse decisions within 30 days, offer real human review, keep three years of records. None of it needs to wait for the attorney general's final rules. Start with the tool register, because every other decision depends on it. More guidance sits in the HR and pre-employment resources library.