What Colorado’s Draft AI Rules Mean for Workplace Governance

Ahead of the January 1, 2027, effective date for the Colorado Automated Decision-Making Technology (ADMT) Act (SB 26-189), the Colorado Attorney General’s proposed draft regulations establish rigorous procedural, evidentiary, and recordkeeping obligations for deployers of algorithmic tools. For human resources executives, employment counsel, and compliance leaders, these mandates require moving beyond vendor representations to establish auditable, internal governance frameworks across all stages of hiring, performance evaluation, and promotion.

Scope of SB 26-189: Colorado’s new AI rules

Not every workplace software pipeline triggers the statute. The proposed regulations draw a distinct line between routine data management and covered ADMT:

• Excluded Utilities: Routine administrative tools used solely to summarize, format, organize, translate, draft, or route candidate information for human review remain outside the regulatory scope, provided they do not calculate predictive scores or filter candidates.
• Covered Systems: Predictive talent-sourcing models, resume-screening parsers, automated ranking algorithms, and software that establishes compensation structures fall squarely under the statutory framework when applied to consequential outcomes.

Under SB 26-189, a “consequential decision” involves any determination affecting an individual’s access to employment opportunities, initial screening eligibility, final hiring, promotion selection, or compensation terms.

The “Material Influence” test and the Rebuttable Presumption

Compliance duties activate when software exercises a material influence over a consequential employment determination. Under the draft regulations, this threshold satisfies a two-part standard:

• Substantive Deliberation: The algorithmic output acts as a non-trivial, non-de minimis factor in the decision-making pipeline.
• Outcome Alteration: The system demonstrably shapes the result by screening out, classifying, stack-ranking, or prioritizing candidates (such as automated knockout filters in an ATS).

To curtail defenses that automated scoring is purely “advisory,” the draft regulations introduce an evidentiary presumption:

• The Output-Match Presumption: If an evaluator has visibility into an algorithmic recommendation (such as a percentile ranking, tier score, or qualification band) and the ultimate employment outcome aligns with that output, the tool is legally presumed to have exercised material influence.
• Evidentiary Burden to Rebut: Employers cannot defeat this presumption with informal assertions of human discretion; rebuttal requires documentation showing that human reviewers independently evaluated, departed from, or superseded the model’s output.

Reach and liability

• Protected “consumers” encompass both Colorado-resident workers and any candidate evaluated for an opening tied to the state, preventing remote hiring pipelines from escaping regulatory review.
• Employers maintain strict deployer liability. Sourcing third-party recruitment agencies, staffing firms, or assessment platforms does not shift legal responsibility; an employer relying on vendor-curated shortlists remains directly liable for regulatory non-compliance.

Compliance mandates

Organizations utilizing covered talent systems must operationalize four core safeguards.

When an automated tool informs an adverse employment action, employers must deliver a formal written disclosure within 30 days. Generic rejection language is non-compliant. Adverse Action Notices must detail:

1. The exact functional role the tool served in the screening process.
2. The primary objective criteria underpinning the determination.
3. Any knockout thresholds, disqualifiers, or benchmark cutoffs triggered.
4. The specific inputs, candidate data points, and inferences considered.

Meaningful human oversight and appeal channels

Human-in-the-loop controls cannot serve as administrative rubber stamps. Designated reviewers must understand the underlying scoring rationales, have direct access to source inputs, and retain binding organizational authority to overturn algorithmic recommendations. Furthermore, organizations must implement workflows to pause contested adverse actions where commercially practicable while disputed data is reviewed and corrected.

Three-year audit trail retention

Deployers are obligated to maintain complete evidentiary records for a minimum of 36 months. This compliance repository must include candidate evaluation logs, deployed model versions, technical configuration histories, and periodic bias or risk-mitigation testing documentation.

Next steps

The Colorado Attorney General holds sole enforcement authority, and algorithmic disparities can serve as evidentiary foundations for systemic bias claims under the Colorado Anti-Discrimination Act (CADA) and Title VII.

Ahead of the 2027 enforcement deadline, HR compliance teams should execute the following steps:

1. Inventory every ATS, resume parser, sourcing platform, and video assessment tool to classify which systems satisfy the material influence standard.
2. Review and amend third-party vendor agreements to guarantee access to model version histories, scoring rubrics, validation studies, and auditable configuration change logs.
3. Establish written Standard Operating Procedures (SOPs) defining how human evaluators record independent discretion, override automated rankings, and address candidate data corrections within the mandatory 30-day window.

This publication is provided for informational and educational purposes only and does not constitute formal legal or compliance advice. Readers should not act upon this information without seeking professional counsel tailored to their specific operational workflows and jurisdictional requirements.