Colorado AI Employment Rules After the Oct. 26 Hearing: What’s Law, What’s Still Proposed, and What Starts Jan. 1

Colorado’s AI employment rulemaking has passed its scheduled hearing date, but employers still need to separate two documents. Senate Bill 26-189 establishes the statutory framework for January 1, 2027. Proposed 4 CCR 904-6 describes how the Attorney General would implement that framework. A hearing does not turn a draft into an adopted rule, and unresolved implementation details do not erase the enacted statute.

The Department of Law’s updated rulemaking page says it hosted a public formal hearing on October 26. That is the verified post-hearing development. The page does not publish a transcript, recording, testimony summary, response to comments, or replacement draft. This report therefore explains the current legal baseline and the remaining proposal without claiming that the hearing settled contested questions.

• Colorado enacted-law record
• Separate proposed-rule record
• Official rulemaking status

Where things stand now

Enacted law: Governor Jared Polis signed SB 26-189 on May 14, 2026, as Chapter 131. Section 5 makes most provisions effective January 1, 2027 and applies the act to consequential decisions made on or after that date. Specified rulemaking, procedural, and appropriation provisions took effect upon passage. Calling the bill enacted in May and its employment duties operative in January describes different legal events.

Proposed rules — not final: the official title is Automated Decision-Making Technology & Conversational Artificial Intelligence Service Rules, 4 CCR 904-6. The Department filed the proposal August 11 and released an interim redline October 6. Its October 21 regulatory analysis is a pre-hearing explanation of the proposal, despite the word “Final” in the analysis filename. It is not an adoption order or final rule text.

As of October 28, no adopted rules, adoption date, announced rule effective date, further hearing, or new comment round was identified in the accessible official materials. The Secretary of State’s eDocket entry 2026-00360 independently lists the proposal and hearing; its adopted-rule, adoption-date, and effective-date fields are blank. Together, those records support continuing to label 4 CCR 904-6 proposed, not final.

What SB 26-189 already requires for January 1

Coverage starts with use, not a vendor’s AI label. Section 6-1-1701 defines ADMT around personal-data processing and computational output used to make, guide, or assist an individual decision. Covered ADMT materially influences a consequential decision. Material influence requires a nontrivial factor used in the decision and an effect on its outcome; the statute expressly includes constraining, ranking, scoring, recommending, and classifying, while excluding incidental, trivial, or clerical use.

Employment is a covered domain, including an employment opportunity that creates or may create an employer–employee relationship. The consumer definition expressly includes employees, Colorado-resident job applicants, and individuals whose Colorado access, eligibility, or opportunity is evaluated in a consequential decision by a person doing business in Colorado. A deployer is a person doing business in Colorado that deploys covered technology. Applicants are therefore part of the statutory analysis, even though not every software interaction is a covered hiring decision.

Developer duties under section 6-1-1702 include making reasonably understandable documentation available to deployers: intended and known harmful uses, training-data categories to the extent known, known limitations, and instructions for appropriate use, monitoring, and meaningful human review where applicable. Developers must provide information reasonably necessary for deployer disclosures, subject to protected-information provisions, and notify deployers within a reasonable time of material updates and specified modifications. The statute limits these obligations by the developer and intended-use definitions; it does not make every general-purpose software supplier a covered developer.

Deployer notice is already statutory. Before using covered ADMT to materially influence a consequential decision, section 6-1-1704 requires clear and conspicuous notice of that use and instructions for obtaining further information. A prominent public notice reasonably accessible at points of interaction, including a reasonably proximate posting or link, can satisfy the initial notice provision. That option should not be confused with the separate duty following an adverse outcome.

Within 30 days after a covered adverse decision, the deployer must provide a plain-language description of the decision and the technology’s role, a simple process for requesting specified system and input information, and an explanation of consumer rights. Requested information includes the system name, applicable version, developer, and personal-data types, categories, and sources, to the extent the deployer receives the necessary developer information. These core duties come from section 6-1-1704(3), not from the October draft.

Section 6-1-1705 provides request-based rights after a covered adverse outcome: instructions for requesting personal data and correcting factually incorrect or materially inaccurate data, and an opportunity for meaningful human review and reconsideration to the extent commercially reasonable. It does not require correction of opinions, predictions, scores, or protected evaluations. Under the statutory definition, a trained reviewer must consider relevant available primary evidence, have authority to approve, modify, or override the decision, and avoid defaulting to the system output. Proprietary source code or model weights need not be disclosed.

Recordkeeping is also enacted. Developers retain reasonably necessary compliance records for at least three years after their creation; deployers retain them for at least three years after the consequential decision, with longer periods where other law requires. The Attorney General enforces Part 17 through the Colorado Consumer Protection Act. Before January 1, 2030, a possible cure generally brings notice and 60 days to cure; knowing or repeated violations do not guarantee that opportunity. There is no new private right of action, and existing discrimination and other legal obligations remain.

Coverage exceptions require care. The definitions exclude specified infrastructure and solely administrative tools and certain routine processes. Section 6-1-1708 includes sector-specific provisions for insurance, HIPAA-covered activities, and medical devices. Crucially, the insurer and HIPAA provisions preserve employment-related coverage in their stated circumstances. An employer cannot infer an employment exemption merely because it operates in health care or insurance.

• Signed statute, §§ 6-1-1701–1708 and Section 5
• Existing Colorado employer guide

What the proposed rules would clarify

If adopted, proposed Rule 4.3 would expressly allocate deployer responsibility in a staffing example. An employer retains a staffing company to narrow applicants using covered ADMT, receives recommendations, and uses them to select a hire. The employer remains responsible for deployer duties, while a contract may require the staffing company to assist. The example does not settle every independent rejection by a staffing firm or every direct communication with an applicant.

Proposed Rule 6 would supply a rebuttable material-influence presumption. It addresses outputs that constrain choices or produce rankings, scores, classifications, recommendations, predictions, or other inferences; are reviewed or screen the information available to the decision maker; and align with the eventual outcome. The proposal allows rebuttal with evidence of a de minimis role, including substantial independent review by someone with expertise and authority. A final human click alone would not, by itself, demonstrate the substantial independent review described in the proposal.

October’s redline also revises communications and documentation mechanics. Proposed Rule 7 changes delivery methods and the contents of initial adverse-outcome explanations while separating requests for additional system and input information. Rules 4 and 5 address upstream documentation and developers that also deploy their systems. These details would guide implementation if adopted; the statutory documentation and disclosure obligations already exist independently.

Proposed Rule 8 addresses data requests and review procedures. The October version distinguishes data held or controlled by the deployer from third-party data, permits internal or qualifying external human reviewers with real decision authority, and adds contemporaneous review documentation. It removes the August proposal’s stay of an adverse outcome while review is pending. Proposed request-response periods and reviewer arrangements should remain configurable until the final text is available.

The draft also addresses interaction with existing federal notices, including the Fair Credit Reporting Act. Employers using consumer reports should map overlapping processes rather than assume one notice automatically satisfies every regime. The October 21 analysis discusses possible efficiencies from existing compliance programs. That pre-hearing agency assessment neither proves the issue was debated on October 26 nor establishes a blanket employment exemption.

• October 6 proposed redline
• Staffing example and its limits
• October 21 regulatory analysis

What can be established about the October 26 hearing

The Department’s post-hearing webpage confirms that it hosted the hearing. It says written comments received by October 26 at 11:59 p.m. MST will be considered in drafting final rules and added to the official record. That stated cutoff has passed. The page does not announce an extension, a continued hearing, or another comment round. It also does not expressly document adjournment, so this report cannot independently establish whether proceedings formally concluded that day.

A public comment archive is linked, but its submissions did not render in this review. No individual submission was verified or attributed. No official transcript, audio, video, testimony summary, or post-hearing response document was found among the linked materials. This is a finding about accessible evidence, not proof that no recording exists. The August statement of basis and purpose remains a proposal-stage document; it is not a post-hearing adoption statement.

Accordingly, there is no verified basis here to name witnesses, rank the issues that dominated testimony, infer agreement, or say a commenter caused a rule change. Staffing firms, material influence, ranking and scoring, notices, human review, developer documentation, and FCRA interaction are documented implementation subjects in the pre-hearing materials. Whether or how each was discussed at the hearing remains unverified. A later transcript, submission, or agency response could support a more specific account.

What remains unresolved

The final language, adoption schedule, and eventual rule effective date remain unresolved in the reviewed record. So do the final form of the material-influence presumption, practical notice channels, third-party information access, commercially reasonable human review, and assistance across vendor chains. The statutory January 1 start and deadline for required rulemaking should not be reported as an announced effective date for an unadopted draft.

Employers can prepare the statutory workflows now while keeping proposed procedures adaptable. Useful governance work includes mapping decisions and responsible parties, locating records and documentation, and identifying who can actually reconsider an outcome. These are practical preparation steps; the statute does not separately command a named inventory project, a particular contract template, or the repealed 2024 framework’s general impact-assessment and risk-management program.

January 1 checklist: Required by enacted law

• For covered use, provide the initial clear and conspicuous notice and access instructions before use; assess the statutory public-posting option (§ 6-1-1704(1)–(2)).
• After a covered adverse decision, provide the description, information-request process, and rights explanation within 30 days (§ 6-1-1704(3)).
• Respond to qualifying requests with data and correction instructions and an opportunity for meaningful human review and reconsideration to the extent commercially reasonable (§ 6-1-1705).
• As a covered developer, make required documentation available and provide required update notices within a reasonable time (§ 6-1-1702).
• Retain reasonably necessary compliance records for the statutory minimum: developers from record creation and deployers from the consequential decision, generally at least three years (§§ 6-1-1702(4), 1703).

Prepare in case the proposed rules are adopted

• Inventory rankings, scores, screening thresholds, and shortlists; document independent judgment relevant to the proposed presumption.
• Check staffing and vendor contracts for assistance with communications, data access, upstream documentation, and review; treat the staffing example as proposed.
• Prototype proposed delivery channels, request-response timing, reviewer arrangements, and review records, with room to change them.
• Map existing FCRA and other notices against proposed coordination provisions; verify final language before relying on combined processes.

What the law does not mean

This is not a blanket AI ban, and not every HR tool is covered. The enacted framework turns on definitions, exclusions, consequential decisions, and actual material influence. Conversely, describing a tool as advisory does not resolve those tests. Proposed rules remain proposals even where they repeat statutory language. Employers should distinguish the underlying duty from a draft’s particular method of satisfying it, and should not assume the final text will preserve every October provision.

Timeline and next milestone

The practical conclusion

The October 26 hearing occurred, but the accessible record supports no claim that it finalized the rules. Employers have an enacted January 1 baseline and a proposed implementation layer to watch. Building the statute-backed process while reserving flexibility for final rules addresses both realities. This article provides general regulatory information, not legal advice; specific coverage and workflow decisions require the applicable facts and legal review.

• Colorado state coverage
• AI Hiring
• Human Oversight
• Automated Employment Decisions
• Regulatory tracker
• Research methodology
• Newsletter