Thought Leaders: What Employers Need to Know About New Consumer Protections for AI

During the 2026 legislative session, Colorado lawmakers significantly amended the Consumer Protections for Artificial Intelligence Act and decreased the burden on employers who use artificial intelligence (AI) to make important employment decisions about hiring, job performance, compensation, and termination. This article summarizes employer obligations under the new law. 

Colorado lawmakers just passed SB26-189 (the Act), and the governor signed it into law. The Act replaces the Consumer Protections for Artificial Intelligence Act (SB24-205) in its entirety and is less onerous than its predecessor. The Colorado Attorney General (AG) is charged with enforcing the Act and will be adopting rules to clarify and implement it. Failure to comply with the Act constitutes a deceptive trade practice under the Colorado Consumer Protection Act, which allows the AG to impose expensive monetary penalties for each violation.

The Act requires employers who are using covered automated decision-making technology (ADMT) to materially influence a consequential employment decision to:

• Keep all records reasonably necessary to demonstrate compliance with the Act for at least three years;

• Provide a clear and conspicuous notice to an employee that the employer used or will use ADMT in a consequential decision affecting the employee and give the employee instructions regarding how the employee may obtain additional information about the ADMT;

• Provide an employee with a description of any consequential decision that results in an adverse outcome for an employee in which ADMT was used and identify the role ADMT played in the decision along with instructions and a simple-to-follow process to request additional information about the ADMT; and 

• When an employee experiences an adverse outcome resulting from a consequential decision in which ADMT materially influences the consequential decision, to provide at the employee’s request: (a) instructions for requesting personal data and correcting factually incorrect or materially inaccurate personal data used in a consequential decision that used ADMT; and (b) an opportunity for meaningful human review and reconsideration of the consequential decision, to the extent commercially reasonable.

What Next?

Employers have until January 1, 2027 to prepare for implementation of the Act and should consider taking steps now to ensure they are able to timely comply with its requirements. As a starting point, an employer would be wise to: (1) familiarize itself with the Act; (2) watch for related regulations to be proposed by the AG; (3) inventory all ADMT being used by the business related to employment decisions; and (4) prepare and implement the notices and processes required by the Act.

If you have questions about SB26-189 and its potential effect on your business, please contact BHGR’s Employment Group today.

This article is informational only. The presentation or use of this information does not in any manner constitute an attorney-client relationship between BHGR and the website user. While the information on this site concerns legal issues, it is not intended as legal advice and is not a substitute for particularized advice from your own legal counsel.