Using AI to Hire in Colorado: What You Owe Applicants

Employment is the category that catches the most Colorado businesses under SB 26-189, and hiring is where it bites first. If software ranks, scores, screens, or recommends job applicants, and that narrowing happens before a person makes the call, you have obligations starting January 1, 2027.

You do not need to be running anything exotic. Most employers who are covered got there by turning on a feature inside a product they already pay for.

Why hiring is the common trigger

A consequential decision under SB 26-189 includes a decision, determination, or action about a consumer relating to the provision of, or access to, eligibility for, selection for, or compensation for, employment or an employment opportunity that creates or may create an employer-employee relationship. Selection for is the word that reaches shortlisting. Hiring, promotion, and compensation decisions all sit inside that. So does anything that determines who gets an interview.

Covered automated decision-making technology is technology that processes personal data and makes computations including predictions, recommendations, classifications, rankings, or scores used to make, guide, or assist a decision. An applicant tracking system that sorts candidates by fit score does exactly that. So does a job board feature that surfaces recommended applicants and buries the rest.

The tool does not have to make the decision. It has to materially influence it, meaning it is a non-de-minimis factor that constrains, ranks, scores, recommends, or classifies. If forty applicants became a shortlist of six before you read a single resume, the software influenced the outcome regardless of who signed the offer letter.

What is probably in your stack already

• Applicant tracking systems with match scores, fit ratings, or auto-rejection rules
• Job boards with candidate matching, ranked results, or recommended-applicant panels
• Resume parsing that filters on keywords, years of experience, or credentials
• Assessment platforms that produce a numeric or banded score
• Video interview tools that rate responses
• Background check services returning a risk score rather than a records report

Worth knowing what is not on that list. Routine scheduling is expressly excluded from the definition of a consequential decision, as are administrative routing, customer service triage, communication of decisions, and workflow management. A tool that books interview slots is not covered. A tool that decides who gets offered one is.

Payroll and HR suites bundle several of these. Owners often do not know a scoring feature is switched on, because it was enabled by default or turned on by whoever set the system up.

The three things you owe

Notice before you use it. Clear and conspicuous notice before the technology is used to materially influence the decision, with instructions for how to get more information. For hiring, that means the notice reaches applicants at or before application, not after a rejection.

Notice within 30 days of an adverse outcome. If the technology materially influenced a rejection, you owe a plain-language description of the role it played, how to request more information, and what rights the applicant has. Thirty days is not long when rejections go out in batches, and a generic rejection email does not satisfy it.

Records for at least three years after the decision, documenting compliance.

The part that changes how you operate

After an adverse outcome, an applicant can request instructions for correcting personal data that is factually incorrect or materially inaccurate, and can request meaningful human review and reconsideration where that is commercially reasonable.

Sit with the second one. If a rejected applicant asks a human to look again, somebody has to be able to do that, retrieve what the system produced, and reconsider. For a small employer that is a named person with time and access, not a line in a policy. Most hiring workflows have no step for it, because until now nothing required one.

The first one has teeth too. Correcting inaccurate data assumes you can see what data the tool used. Plenty of platforms do not readily show that to the employer, which turns a compliance duty into a vendor problem.

Your vendor has information you are going to need

The obligations attach to you as the deployer, not to the company that built the software. Licensing a hiring platform does not move the duty.

What it does is create a dependency. Your adverse outcome notice has to describe the role the technology played in the decision. That description lives with the vendor. If your agreement does not entitle you to it, you owe a disclosure you cannot make. Most standard terms of service were written before any of this and say nothing about it. Getting those terms amended is ordinary contract work pointed at a new requirement, and it takes longer than people expect because the vendor has to agree.

What enforcement looks like

The Colorado Attorney General enforces SB 26-189 as a deceptive trade practice under the Colorado Consumer Protection Act. There is no private right of action, so a rejected applicant cannot sue you under this statute.

Before an enforcement action the Attorney General must issue a notice of violation and allow 60 days to cure where a cure is possible. That cure period sunsets January 1, 2030 and does not cover knowing or repeated violations. An employer who made a real effort and got a notice wrong is in a very different position from one who was told and ignored it.

Worth separating: SB 26-189 is a disclosure statute, not a discrimination statute. The 2024 law it replaced had a duty of care around algorithmic discrimination, and that duty is gone. Existing anti-discrimination law did not go anywhere. A hiring tool that screens out applicants on a protected basis is still a problem under other law. SB 26-189 simply does not add to it.

What to do between now and January

To that end, open your hiring systems and find every place a score, rank, rating, or auto-rule touches an applicant. Turn off what you do not need, because a feature you switch off is a feature you do not have to paper. For what stays, draft the two notices, name the person who performs human review, and set the records to retain for three years.

Then read your vendor agreement and see whether it gives you what your notices require. That is usually where the work stalls, so start it early.

The SB 26-189 compliance checklist runs the coverage question end to end, and the small business coverage article covers why there is no size exemption. If you would like to walk through your own hiring stack together, I would welcome the conversation. AI governance and compliance is a practice area at Hoog Law.