The law applies to employers and other deployers doing business in Colorado, as well as developers of automated decision-making technology. Employers must provide clear pre-use notice that automated systems are being used, post-decision notice for adverse outcomes, and allow affected individuals to access data, correct inaccuracies, and seek meaningful human review where commercially reasonable. Liability is allocated based on relative fault between developers and deployers. The Colorado Attorney General enforces the statute, and there is no private right of action.
Colorado enacted its original AI law in 2024 as a broad "high-risk AI" regime covering employment, housing, health care, and education. Business and legislative concerns about compliance burden prompted a postponement of the original timeline and a 2026 working group that proposed replacing the audit-heavy model with the current transparency framework. The revision materially changes employer obligations before the law takes effect and gives companies a different compliance path for AI use in hiring, promotion, and discipline. As one of the first states to enact comprehensive AI legislation, Colorado's shift from audit requirements to disclosure requirements is likely to influence other states considering similar laws.