What the Colorado AI Act requires
The Colorado AI Act (SB 24-205) is the first comprehensive state AI Act in the United States. It regulates "high-risk artificial intelligence systems"- defined as systems that make, or are a substantial factor in making, consequential decisions. Employment is one of seven explicit consequential-decision categories, alongside education, financial services, government services, housing, healthcare, insurance, and legal.
The Act imposes a duty of reasonable care on both developers (vendors) and deployers (employers) to protect consumers from algorithmic discrimination.
Who's affected
The Act covers high-risk AI used in a consequential decision about a Colorado consumer, regardless of where the deployer or developer is established. For hiring, the trigger is:
- A candidate is a Colorado resident, AND
- The AI is a substantial factor in a hiring decision (interview selection, ranking, scoring, automated rejection).
Pure scheduling assistants and recruitment marketing tools are generally out of scope. AI that filters or ranks is in.
Key deadlines
| Date | Trigger |
|---|---|
| 30 June 2026 | All deployer and developer obligations take effect. |
Colorado is unique among the US AI-hiring regimes in giving the entire ecosystem the same effective date. Plan against 30 June 2026.
What hiring deployers specifically must do
The deployer obligations under §6-1-1703 of the Act:
- Implement a risk-management policy - a documented program covering how the deployer reviews, deploys, and monitors high-risk AI. This is broadly similar to a NIST AI RMF profile.
- Complete an impact assessment before deploying the system and annually. The assessment must cover the system's purpose, intended use, deployment context, benefits, foreseeable harms, mitigations, and transparency measures.
- Notify Colorado candidates that a high-risk AI system is being used in the decision, before the decision is made.
- Provide explanations when an adverse consequential decision is made, including the principal reasons and the data used.
- Provide an opportunity to correct inaccurate personal data the system used to make the decision.
- Provide an opportunity to appeal to a human reviewer.
- Disclose to the Attorney General any discovered algorithmic discrimination within 90 days.
Small businesses (under 50 employees) are exempt from items 1, 2, and 7, but not from the candidate-facing duties.
Common misconceptions
- "Colorado is just another NYC LL 144." It is broader. LL 144 is a bias-audit obligation; the Colorado Act is a full algorithmic-accountability statute. The bias-audit obligation under Colorado is embedded inside the impact assessment, not a separate annual artifact.
- "We're not in Colorado, so we're fine." If you hire Colorado residents - including remote roles - you're in scope.
- "The notification is just a footer disclosure." No, the notification must happen before the consequential decision and give the candidate enough information to understand what is being decided and how. A privacy policy update is not sufficient.
- "Our vendor's documentation covers our impact assessment." Partially. The deployer must do the impact assessment; the vendor's documentation is an input.
How vendors are addressing it
Vendor practice on Colorado specifically is still emerging as of May 2026. What we observe in vendors' public posture:
- Most vendors have not yet updated public docs for Colorado. The vendors with the strongest EU AI Act and NYC LL 144 posture (Eightfold, Beamery, Harver, HireVue) are best-positioned to extend their existing materials; smaller vendors that rely on light disclosures will need more lift.
- The impact-assessment template is the most useful artifact a vendor can provide. It is also the rarest. A vendor that publishes a Colorado-aligned impact-assessment template the deployer can complete is doing meaningful work; a vendor that publishes only a "we comply" blog post is not.
See per-vendor profiles for cited evidence behind each vendor's FRIA Support and Customer Documentation scores - which map cleanly onto Colorado's impact-assessment requirement, and which the methodology sets out in full. The categories most often in scope: screening, assessment, sourcing, and ATS-integrated AI.