AI hiring laws from January 1, 2027: Colorado and California

Colorado's AI law, Senate Bill 26-189: what employers must do from January 1, 2027

Colorado's governor signed Senate Bill 26-189 on May 14, 2026. It repeals and reenacts Senate Bill 24-205, the state's 2024 law on artificial intelligence (AI) systems. Its duties take effect January 1, 2027, and apply to consequential decisions made on or after that date.[2][1]

The law covers automated decision-making technology. That is software that processes personal data to produce a score, ranking, recommendation, or prediction used in a decision about a person.[2]

A consequential decision includes one about employment. It covers employees, and job applicants who are Colorado residents. It also covers anyone a business doing business in Colorado evaluates for an opportunity there.[2]

A tool is covered when it materially influences the decision: its output is more than a trivial factor and affects the outcome. A tool that only summarizes or organizes information for a person to review, with no score or ranking, is outside the definition.[2]

As the deployer (the business that uses the tool), an employer must:

The developer (the vendor) must give you documentation from January 1, 2027: intended uses, training data categories, known limits, and instructions for human review. Only the attorney general enforces the law, as a deceptive trade practice. There is no new private right of action.[2]

Before acting, the attorney general must give a 60-day notice to cure when a cure is possible. That step ends on January 1, 2030, and does not apply to knowing or repeated violations. The law requires rules on the adverse-outcome explanations, correction, and human review by January 1, 2027.[2]

A developer or deployer can be liable under Colorado's anti-discrimination laws for a decision a covered tool materially influenced. The law splits fault between them by relative fault. A contract term that shields either party from liability for its own discriminatory acts is void, and complying with this law is no defense.[2]

The attorney general's rules are not final. The Colorado Department of Law filed proposed rules on August 11, 2026 and released an interim draft on October 6, 2026. It published a regulatory analysis on October 21, 2026. Its hearing is October 26, 2026, the last day for written comments unless the hearing continues.[3]

California's automated decisionmaking rules: compliance by January 1, 2027

The California Privacy Protection Agency (CPPA) rules on automated decisionmaking took effect January 1, 2026. A business that uses such technology for significant decisions must comply by January 1, 2027.[4][5]

They apply to businesses covered by the California Consumer Privacy Act. One test is annual gross revenue in the preceding calendar year over $26,625,000, the amount set on January 1, 2025. The agency adjusts it for inflation every odd-numbered year, so it can change on January 1, 2027.[7][10]

Employees and job applicants who live in California count as consumers. A significant decision includes hiring, assigning work, pay, promotion, demotion, suspension, and termination.[6][5]

California's definition is narrower than Colorado's. It covers technology that replaces human decisionmaking, or substantially replaces it by deciding without human involvement. Human involvement means a reviewer who can interpret the output, reviews it with other relevant information, and has authority to change the decision.[5]

A business that uses such a tool for a hiring decision must give:[5]

Three exceptions to the opt-out can apply in employment. You need no opt-out if you let the person appeal to a human reviewer with authority to overturn the decision.[5]

Nor do you need one for a hiring tool that only assesses ability to do the job. The same goes for a tool used only to allocate work or set pay. In both of those cases the tool must work for its purpose and not unlawfully discriminate.[5]

The CPPA enforces these rules through administrative actions, and the California Attorney General through civil actions. Each can seek up to $2,663 per violation, or $7,988 per intentional violation, at the amounts set on January 1, 2025.[10][7]

AI hiring rules already in force: California's Civil Rights Council and Illinois

California's Civil Rights Council rules took effect October 1, 2025. They bar employers from using an automated-decision system that discriminates on a basis protected by the Fair Employment and Housing Act (FEHA). FEHA's ban on discrimination covers employers with 5 or more employees.[11][12]

The rules define agents and employment agencies as covered entities, so a vendor acting for an employer can be covered.[11]

Employers must keep employment records, automated-decision data included, for at least 4 years.[8]

Illinois Public Act 103-0804 (House Bill 3773) took effect January 1, 2026. Under the Illinois Human Rights Act, it is a civil rights violation to use AI that has a discriminatory effect on a protected class. Using zip codes as a proxy is a violation. Employers must give employees notice of AI use in employment decisions.[9]

The Illinois law's definition of employer includes anyone with 1 or more employees in Illinois for 20 or more calendar weeks a year. It directs the Illinois Department of Human Rights to adopt rules on when and how to give the notice.[9]

A person can file a discrimination charge with the Illinois Department of Human Rights.[15]

The department proposed such rules on May 15, 2026 and withdrew them in June 2026 to consult other state agencies. No final rules were found as of October 22, 2026.[13][14]

What employers should do before January 1, 2027

State AI rules sit alongside the employee and contractor classification rules.

Colorado's meaningful human review needs a trained reviewer who weighs relevant primary evidence and does not default to the tool's output.[2]