Does Colorado require AI impact assessments?
Answer
No longer. SB 26-189 (signed May 14, 2026) repealed and reenacted Colorado's AI Act, eliminating the impact-assessment requirement entirely. Deployers of automated decision-making technology must instead give clear interaction notice, disclose adverse consequential decisions within 30 days, allow correction of inaccurate personal data, and provide meaningful human review. The statute takes effect August 12, 2026, but all compliance obligations begin January 1, 2027.
No longer. SB 26-189 (signed 2026-05-14) repealed and reenacted Colorado's AI Act, eliminating the impact-assessment requirement entirely. Colorado now instead requires deployers of automated decision-making technology (ADMT) to: give consumers clear interaction notice, disclose adverse consequential decisions within 30 days, allow correction of incorrect personal data, and provide meaningful human review and reconsideration. The statute formally takes effect 2026-08-12, but all compliance obligations — for deployers and developers alike — begin 2027-01-01.
Sources checked
Scope
Answers the impact-assessment question under current Colorado law (SB 26-189), which repealed and reenacted the original Colorado AI Act. It covers what replaced the assessment requirement; it does not detail Illinois or Texas hiring law except by contrast. Obligations begin January 1, 2027.
Operational implication
The repealed impact assessment is replaced by operating duties, not paperwork relief. From 2027 deployers must run interaction notice, a 30-day adverse-outcome disclosure clock, data-correction handling, and meaningful human review — a trained reviewer with authority to override. Those are workflow controls, plus 3-year per-decision record retention, which employers should design now.
Applicable Regulations
Colorado AI Act — Automated Decision-Making Technology (SB 26-189, repeal & reenactment of SB 24-205)
On 2026-05-14 Governor Polis signed SB 26-189, which repeals and reenacts the Colorado AI Act (originally SB 24-205). The new law abandons the risk-management / annual-impact-assessment model and replaces it with a disclosure-and-notice framework governing "automated decision-making technology" (ADMT) that makes or substantially influences "consequential decisions" (education, employment, housing, financial services, insurance, healthcare, government services). The statute formally takes effect 2026-08-12 (no safety clause), but all substantive compliance obligations — for both deployers and developers — begin 2027-01-01, which is the operative date for regulated businesses; the Attorney General's implementing rules are also due by 2027-01-01. The AG has stated he will not enforce until the mandatory rulemaking process concludes.
Key Requirements
Full State Analysis
Where this lands operationally
Gridex turns the compliance or coverage question into operated workflow controls: intake, review points, audit trails, and the places a person stays in the decision.
Map This Workflow With Gridex
Prepare for January 1, 2027 by building meaningful-human-review routing, the 30-day adverse-outcome process, and 3-year record retention with Gridex's governed AI deployment workflow (/services/governed-ai-deployment/).
Map This Workflow With Gridex →Related Questions
- Can I use AI for hiring in Illinois? Yes, but two distinct Illinois laws apply. HB-3773 (effective January 1, 2026) amended the Illinois Human Rights Act to prohibit employers from using AI that discriminates against protected classes or uses zip codes as a proxy, and it requires notice to employees that AI is being used in employment decisions (recruitment, hiring, promotion, discipline, tenure, or terms and conditions). Separately, the Illinois Artificial Intelligence Video Interview Act (PA 101-0260, 820 ILCS 42), in effect since 2020, applies specifically when AI analyzes applicant video interviews: employers must notify the applicant, explain how the AI works, obtain written consent, limit video sharing to necessary evaluators, delete videos within 30 days of an applicant's request, and — per the 2022 amendment (PA 102-47) — report applicant racial/ethnicity data annually to DCEO. If AI hiring tools also capture biometric identifiers (e.g., facial geometry from video), the separate Illinois Biometric Information Privacy Act (BIPA) creates additional consent and liability obligations. Illinois employers using AI for any form of employment decision should map their process against all three regimes.
- How do Illinois and Colorado AI hiring laws compare? Illinois regulates AI hiring through two laws: the Artificial Intelligence Video Interview Act (820 ILCS 42), which requires notice, explanation, and written consent for AI-analyzed video interviews, and HB-3773, which adds employee/applicant notice and an anti-discrimination duty for AI used in employment decisions (effective January 1, 2026). Colorado's AI Act (SB 26-189, which repealed and reenacted SB 24-205) takes a disclosure-and-notice approach: employers using automated decision-making technology (ADMT) to make or substantially influence consequential employment decisions must give interaction notice, provide a plain-language adverse-outcome explanation within 30 days, allow data correction, and ensure meaningful human review. Colorado no longer requires algorithmic impact assessments or high-risk AI system classification — that model was repealed when SB 26-189 was signed on May 14, 2026; its disclosure-and-notice obligations begin January 1, 2027.
- What AI rules apply to hiring in Texas? Texas does not currently have a private-sector AI hiring disclosure or candidate opt-out law comparable to Illinois, Colorado, or NYC Local Law 144. Texas HB-2060 was a state-agency AI advisory and inventory law, not an employer hiring rule. The main Texas AI law for private employers is HB-149 (TRAIGA), effective January 1, 2026: for hiring AI it matters mainly if the system is intentionally deployed to discriminate against protected classes or otherwise falls into TRAIGA's prohibited-practice categories. TRAIGA's biometric-identification and social-scoring prohibitions apply to government entities only — biometric consent for private-sector AI tools, such as video-interview face or voice capture, is governed by Texas's CUBI statute (Tex. Bus. & Com. Code §503.001), not TRAIGA. Employers using AI in Texas should still document the tool, human review points, bias controls, and any biometric consent process.
- How should multistate employers comply with AI hiring laws? Multistate employers should baseline AI hiring workflows against the strictest active regimes, then layer state-specific rules. In practice, that means Illinois notice, consent, non-discrimination, and reporting obligations; Colorado ADMT interaction notice, adverse-outcome disclosure, data correction, and meaningful human review for consequential employment decisions beginning January 1, 2027; Minnesota profiling and data-protection-assessment obligations where covered; and Texas TRAIGA controls for prohibited discriminatory or biometric AI uses. Texas HB-2060 should not be treated as a private-employer hiring disclosure or opt-out law; it was a state-agency AI advisory and inventory statute.