Colorado Draft ADMT Rules Set Employer Duties for AI Hiring and Promotion Tools

The Colorado ADMT rules took a step forward on October 6, 2026, when the state’s Department of Law released an interim draft (4 CCR 904-6) setting employer duties for AI tools used in hiring and promotion. Key rules take effect January 1, 2027.

• Colorado’s Department of Law released an interim draft of rules (4 CCR 904-6) on October 6, 2026, implementing SB 26-189 and HB 26-1263.
• A tool is presumed to have materially influenced a decision when the decision matches its score, ranking or recommendation, and rebutting that can be burdensome.
• Employers must give notice before using a covered tool and a written explanation within 30 days of an adverse decision.
• Only the Attorney General can enforce the law; a 60-day cure period generally applies until January 1, 2030.
• Key rules take effect January 1, 2027, and the draft is still subject to change after a second comment round.

Colorado’s interim draft rules put employers on the hook for AI hiring tools

The Colorado Department of Law released the October 6, 2026 interim draft of 4 CCR 904-6, according to The National Law Review. It implements two laws: the automated decision-making technology (ADMT) law, Senate Bill 26-189, and the Chatbot Safety Act, House Bill 26-1263.

The draft follows earlier steps. The Attorney General proposed rules to implement both laws on August 11, 2026. A public hearing on those rules was held on October 26, 2026, and a second round of comments was requested.

For employers, the practical effect of the Colorado ADMT rules is a defined set of obligations around any software that scores, ranks or recommends candidates or employees. The draft covers the whole path from notice before a tool is used to explanation after a negative decision, along with correction rights, human review and record retention.

The key Colorado AI hiring rules apply from the start of 2027. Because the draft is not final, details may shift, but its structure shows how the Attorney General’s office reads the statute and what it is likely to ask employers to document.

What the law and the Colorado ADMT rules cover

Automated decision-making technology, or ADMT, is technology that processes personal data and uses computation to produce outputs such as scores, rankings or recommendations used to make or assist decisions about individuals, according to the Colorado General Assembly. The statutory definition also lists predictions, classifications and other information used to make or assist a decision.

The Colorado ADMT law applies to consequential decisions. These are decisions relating to access to, eligibility for, or compensation related to education, employment, housing, financial or lending services, insurance, health-care services, and essential government services and public benefits. For this draft, the focus is employment: hiring and other employment decisions are expressly covered. That sets it apart from the Colorado Privacy Act, whose profiling rules do not reach employees.

There is a carve-out. The enacted definitions exclude tools used solely for specified administrative functions, such as summarizing and organizing information for human review, according to summitnotes.app. A tool that only tidies information for a person to read is therefore treated differently from one that produces a score or ranking.

The second law is separate in scope. The Chatbot Safety Act (HB 26-1263) regulates public-facing chatbots. Internal workplace chatbots and business productivity or training tools are excluded, so an employer’s internal assistant does not fall under it merely because staff use it.

The presumption of material influence is the draft’s central test

The draft turns on a concept called material influence, meaning that a tool’s output substantially affects a decision. The draft sets a presumption of material influence rather than leaving it to case-by-case argument.

Under the draft, if a decision-maker sees a tool’s score, ranking, recommendation or similar result and the decision matches it, the tool is presumed to have materially influenced the decision. Employers may rebut the presumption, but doing so can be burdensome, according to the law review’s analysis.

Examples the draft gives

The examples show how broad the presumption is. An internal promotion tool that scores candidates is presumed to influence the decision even if the manager also interviews everyone and reviews their files. Human involvement alone does not defeat the presumption.

A numeric score is also not required. A tool that ranks applicants from strongest to weakest without giving a number is presumed to influence the decision as well.

Scores and rankings are not the only triggers. A tool that narrows the set of options a decision-maker chooses from, sets a pass or fail threshold, or sorts people into classifications can also be presumed to influence the outcome. The draft adds a counterweight in a new defined term, the de minimis factor. An ADMT output can be treated as a de minimis factor when other factors played a significantly larger role in the decision, so the tool’s contribution was minor.

Whether an output qualifies turns on how the decision was actually made. Employers should be ready to show what else the decision-maker weighed, how much weight the tool’s output carried compared with those factors, and whether the result would have been the same without it. Under the Colorado ADMT rules, that evidence is what separates a minor input from a covered one.

What this means for employers

An employer that uses a scoring or ranking tool and then makes the same choice the tool pointed to should expect the tool to be treated as covered unless it can show otherwise. The sources describe rebuttal as possible but burdensome, and they do not detail what evidence would suffice. That remains an open point while the draft is under comment.

Who is protected and who is responsible

Protected consumers include employees and Colorado-resident job applicants. Coverage may also reach anyone whose opportunity in Colorado is evaluated, so out-of-state applicants for Colorado jobs may not be excluded, per the same analysis. The sources frame this as a possibility rather than a settled rule.

Staffing firms do not shift the duty

Using a staffing firm does not shift the compliance obligation under the draft. If a staffing company’s AI tool produces a shortlist that an employer uses to hire, the employer is responsible for compliance. The employer may contract with the firm for assistance, but the responsibility stays with the employer.

Vendor contracts and shared liability

Contract language does not change that picture. Vendor contracts cannot shift responsibility for an employer’s own discriminatory conduct, and both the employer and the vendor can be liable.

Developer obligations

Developers of covered ADMT carry their own duties under the statute. Starting January 1, 2027, they must provide deployers with technical documentation covering:

• intended uses;
• categories of training data;
• known limitations;
• instructions for appropriate use and human review.

Developers must also notify deployers of material updates or modifications to covered ADMT. For employers, this documentation is the main input for the notices and explanations the draft requires.

Notices, explanations, correction and human review employers must provide

The draft sets out a sequence of employer obligations, from before a tool is used through the period after an adverse decision.

Notice before use

Before using a covered tool, employers must give a clear, conspicuous, plain-language and accessible notice that the tool is being used and how to get more information.

Explaining an adverse decision

If a tool contributes to a rejection or other negative decision, the employer must explain in writing within 30 days. The explanation must be sent through every channel normally used to communicate with the person.

Rejection notices must do several things:

• explain the tool’s role;
• give the principal reasons;
• disclose any score or inference and the underlying data;
• identify any automatic-disqualification factor;
• say what information is missing, if the information was incomplete.

Employers that already send adverse-action letters may not need a second notice. The interim draft lets an adverse-action notice under the Equal Credit Opportunity Act (ECOA) or the Fair Credit Reporting Act (FCRA), or a risk-based pricing notice, satisfy the Colorado disclosure if it includes the required content and is sent within the same window. Deployers covered by FERPA may use FERPA channels instead. How these notices fit with Colorado Privacy Act profiling notices is still an open question in the draft, so we suggest mapping your existing letters against the list above before deciding whether one document can do both jobs.

Correction and human review

On request, employers must explain how to correct inaccurate data and provide meaningful human review where commercially reasonable. The statute lets consumers request correction of factually incorrect personal data used by a covered ADMT, and meaningful human review and reconsideration after an adverse outcome. The draft would require pausing the adverse outcome where possible while data is corrected.

Reviewers may be internal or external. They must be trained, have authority to override the decision, and consider the underlying evidence rather than defer to the tool.

The reviewer cannot use ADMT to carry out the review itself. Non-ADMT tools that only organize or present information may assist, but the judgment has to be the reviewer’s own. The draft also sets deadlines for acknowledging a human review request, for completing the review, and for answering a request for more information about the tool. The exact periods may still change before adoption, so build tracking for all three into your intake process now.

Recordkeeping

Compliance records must be kept for at least three years. They may include covered ADMT version identifiers, changelogs, and documentation of material mitigation changes, according to The National Law Review and the Colorado General Assembly.

Enforcement stays with the Attorney General, but discrimination claims remain available

Only the Attorney General can enforce the law, and the office does so through the Colorado Consumer Protection Act, which treats a violation as a deceptive trade practice. Until January 1, 2030, the Attorney General generally must give 60 days’ notice and an opportunity to cure before suing, where cure is possible. The exception is knowing or repeated violations, to which that step does not apply.

The law creates no new private right of action, so job applicants and employees cannot sue directly under it. That does not close off every route. AI-influenced decisions can still be challenged under existing discrimination law, including the Colorado Anti-Discrimination Act.

The combination matters for risk planning. Enforcement of the new notice, explanation and review duties sits with the regulator, while a discriminatory outcome from an AI-assisted decision can still be pursued through laws that were already in place. As noted above, an employer’s contract with a tool vendor does not remove exposure for the employer’s own conduct, and that point applies here too.

How the rules differ from the 2024 Colorado AI Act

SB 26-189 repealed and reenacted the provisions of 2024’s SB 24-205 with new requirements on automated decision-making technology in consequential decisions, according to the Colorado General Assembly. The new law therefore replaces, rather than sits beside, the earlier statute.

The 2024 Colorado AI Act was set to take effect February 1, 2026, per Katten. It gave the Attorney General exclusive enforcement authority and no private right of action. Deployers were required to keep impact assessment records for 3 years and to provide for appeal of adverse decisions, including human review where technically feasible.

Several features carry over in spirit: exclusive Attorney General enforcement, no private right of action, a three-year record period and human review after adverse outcomes. What the draft adds is detail, including the presumption of material influence, the 30-day written explanation and the contents of rejection notices.

The sources differ on dates. Katten gives February 1, 2026 as the start of the 2024 Act, while The National Law Review and summitnotes.app describe the rules under SB 26-189 as applying from January 1, 2027. The two dates belong to different statutes, the original and its replacement.

Employers should also evaluate obligations in other states such as California, Connecticut, Illinois and New York, which may be distinct from Colorado’s law.

Deadlines and open questions before January 1, 2027

The key Colorado ADMT rules take effect January 1, 2027, and developers must provide vendor documentation starting the same day. Employers relying on third-party tools will depend on that documentation to build their notices and explanations.

The Attorney General must also adopt rules clarifying post-adverse-outcome disclosure requirements by January 1, 2027. What those rules will contain is not stated in the sources, so the exact disclosure requirements after a negative decision remain open.

The draft itself is not final. A second round of comments was requested after the October 6 interim draft, and it remains subject to change. Provisions such as the presumption of material influence, the pause on adverse outcomes during data correction and the record contents could be adjusted before adoption.

Sources

• The National Law Review
• Colorado General Assembly
• summitnotes.app
• katten.com

Photo courtesy of Colorado General Assembly