If a covered employer hires a staffing company to run a covered automated screening tool, receives its recommended applicants, and uses those recommendations to decide whom to hire, the October 6 proposal identifies the employer as the Deployer. Proposed Rule 4.3 says the employer remains responsible for Deployer obligations even if its contract asks the staffing firm to help perform them. That answer fits the rule’s stated example; it does not decide every arrangement in which an agency makes its own rejection or talks directly to candidates.

Colorado enacted the underlying Automated Decision-Making Technology Act in May. The October proposal supplies possible implementation details, not current final duties. The August hearing notice explicitly asked who should bear Deployer duties when a staffing agency operates a tool whose output an employer relies on, and what should happen when the agency deals directly with applicants. The interim draft answers the first question for a specified chain of events.

What the staffing example actually assigns

Proposed Rule 4.3(A) covers a third party running Covered ADMT on behalf of or at the direction of a Deployer when that Deployer makes the Consequential Decision using the third party’s output. It assigns all Deployer obligations to that decision maker. Subsection (B) permits a contract requiring the operator to perform functions that assist compliance. Its staffing example specifies an employer that retains a staffing company to narrow a pool, receives a recommended list, and uses it to select the hire. The example calls the employer the Deployer because the commissioned output materially influenced its hiring decision.

A contract can therefore arrange who supplies tool information, records, candidate communications, or review support, but the proposal does not let this employer transfer its own Deployer duties by contract. Rule 4.3(C) also limits required assistance under that rule: a third party can be required to help with Deployer compliance only if the Deployer itself is covered by the Act. The rule does not generally declare an operating staffing company exempt from every independent duty.

Why ‘AI screening’ is shorthand

The law’s operative term is Covered ADMT, not any product marketed as AI. SB 26-189 defines ADMT as technology that processes personal data and uses computation to generate an output used to make, guide, or assist a judgment about an individual. Covered ADMT is ADMT used to materially influence a Consequential Decision. The statute includes employment and an employment opportunity that creates or may create an employer–employee relationship among covered domains. It includes employees, Colorado-resident applicants, and certain individuals whose Colorado opportunity is evaluated by a person doing business in Colorado. A Deployer is a person doing business in Colorado that deploys Covered ADMT. A tool’s label, or the fact that a staffing firm uses software, alone cannot establish coverage.

The enacted material-influence test requires both a nontrivial output used in making the decision and an effect on its outcome, including through constrained choices, ranking, scoring, recommendation, or classification. The statute excludes incidental, trivial, and clerical uses. It also excludes listed infrastructure tools and tools used solely to summarize, organize, translate, draft, route, or present information for human review of administrative processing. Routine or low-stakes processes that do not materially influence selection are outside the defined Consequential Decision. Those boundaries matter before anyone allocates notices or review work.

How the proposed material-influence test would work

Proposed Rule 6.1 presumes influence when an output constrains an option set, sets a threshold, or produces a ranking, score, classification, recommendation, prediction, or other inference about the individual; the output is reviewed by the decision maker or screens the data available to that person; and the output is consistent with the eventual decision. The proposal lets the Deployer rebut that presumption with evidence the output was de minimis. Examples include substantial independent review by someone with the expertise and authority to decide, a consistently applied independent cutoff, a decision inconsistent with the output, or other persuasive contemporaneous evidence. A manager’s nominal final click does not, by itself, establish independence.

Proposed Rule 6.2 illustrates that a ‘strongest candidates’ to ‘weakest candidates’ ordering can trigger the presumption without numeric scores. Rule 6.1(D) carries forward the statute’s administrative-tool exclusion. The Department’s updated cover letter says commenters disputed the rebuttable presumption and asks for alternatives, so its final form remains unsettled.

When the agency makes a decision, or speaks to applicants

The example assumes the employer decides whom to hire. If an agency independently rejects applicants before any client sees them, the example does not decide who is responsible for that agency action. The general definitions still matter: ask whether the rejection itself is a Consequential Decision about a covered employment opportunity, whether a Covered ADMT materially influenced it, whether the agency is a person doing business in Colorado, and who actually deployed the tool to make it. Depending on those facts, an agency could have its own Deployer obligations. A client’s later hiring decision could raise a separate analysis. The draft does not supply a universal allocation for both decisions.

The August notice also asked about a candidate-facing staffing agency. Proposed Rule 4.3 permits assistance by contract but does not expressly reassign a covered employer’s statutory notices, information responses, or human-review accountability merely because an applicant communicates with the agency. The precise handling of candidate-facing delivery and requests in a particular arrangement remains an implementation question. The parties should identify which entity receives each request, has the underlying data, can correct it, and can authorize a real reconsideration.

A three-party chain adds another role: the software company may be a Developer if, while doing business in Colorado, it commercially provides Covered ADMT or a covered component. The agency may also be a Developer if it commercially provides a covered system or intentionally and substantially modifies one; merely configuring a purchased system according to developer instructions generally does not make a Deployer a Developer under the proposed definition, subject to the statute’s actual developer test. A firm may occupy more than one role across different activities. The statute gives Developers documentation and update duties, and both Developers and Deployers must keep compliance records for at least three years. Rule 4.3’s allocation of the employer’s Deployer duties does not erase those separate obligations.

Other October changes, in brief

  • Adverse-outcome explanation: the interim redline removes August language requiring principal reasons, underlying inference data, and scores in the general disclosure rule. It retains the enacted statute’s plain-language description of the decision and ADMT’s role, the route to request specified system and input information, and an explanation of consumer rights. The proposed description must accurately explain the tool’s role, including human reviewers where applicable.
  • FCRA substitution: the interim draft’s employment example allows an FCRA adverse-action notice to avoid a separate Colorado adverse-outcome disclosure only when the FCRA notice contains the information required by section 6-1-1704(3)(b)–(c). This is an overlapping-notice accommodation, not a blanket FCRA exemption or a waiver of other Colorado duties. The proposal’s general ECOA/FCRA provision also conditions substitution on content and timing.
  • Human review: proposed Rule 8.7 would allow an internal or external reviewer with actual authority to approve, modify, or override the decision; it drops August’s categorical independent, non-subordinate reviewer phrasing. A contracted external reviewer must meet added accountability and insulation conditions. The proposed review and reconsideration process still needs a substantive decision and records; removal of one proposed condition does not displace other law.

What each party can prepare now

  1. Employers: inventory agency-provided rankings, filters, and shortlists that reach hiring managers, and map the actual decision maker and Colorado applicants. For qualifying decisions beginning January 1, 2027, the enacted statute sets Deployer notice and recordkeeping duties, with disclosure, data-rights, and human-review duties triggered by a covered adverse outcome. Separately, plan how an agency could assist under proposed Rule 4.3 if adopted.
  2. Staffing firms: separate client-directed screening from decisions the firm makes itself. The enacted definitions may make the firm a Deployer or Developer for its own covered activities; assess each workflow. Proposed Rule 4.3 would permit contractual assistance to a covered employer, so prepare to negotiate data access, retention, and review support without assuming a client contract settles the firm’s independent role.
  3. Software vendors: check Developer status under the enacted statute, which requires documentation and material-update notices for covered products and three-year compliance records. Document intended uses, inputs, limitations, updates, and human-review instructions. Proposed rules may add implementation detail; do not treat their current wording as final.

These are preparation steps for a proposed rule layered on an enacted statute. Other employment, discrimination, privacy, disability, and consumer-reporting obligations may apply regardless of how Colorado finalizes this draft. This article provides general regulatory information, not individualized legal advice.