Quick Hits
- Colorado’s proposed AI regulations require employers to disclose the use of automated decision-making technology when making significant employment decisions starting January 1, 2027.
- Employers would need to explain how AI influenced decisions and provide detailed information about the data sources used if an adverse outcome occurs.
- The proposed rules emphasize transparency and consumer rights and would mandate clear disclosures and technical requirements for request mechanisms for affected employees.
- The rules would further expand what constitutes an affected employee or job applicant’s right to a meaningful human review, reinforcing independence of the review process and authority to override AI-driven adverse outcomes.
On August 11, 2026, the Colorado attorney general’s Office Department of Law filed the proposed “Automated Decision-Making Technology and Conversational Artificial Intelligence Service rules” with the Colorado secretary of state. The proposed draft rules seek to implement and clarify two new Colorado laws regulating AI signed into law by Governor Jared Polis in May 2026: the Automated Decision-Making Technology in Consequential Decisions (ADMT) Act, Senate Bill (SB) 26-189, and the Chatbot Safety Act, House Bill (HB) 26-1263. Both laws are set to take effect on January 1, 2027.
The proposed rules, which would also take effect January 1, 2027, are an initial set of draft rules released for comment and are part of the evolving rulemaking process. While the rules are not final, they highlight potential new compliance obligations for employers seeking to use AI-powered tools to make employment decisions.
Of particular concern to employers, the proposed rules clarify and would expand the requirements under SB 26-189, which repealed and replaced the state’s landmark 2024 AI law. SB 26-189 mandates that “deployers,” including employers, disclose the use of ADMT before making a “consequential decision,” such as hiring or termination, affecting a “consumer,” including employees and job applicants. When an ADMT results in an “adverse outcome,” the law allows affected consumers to request that their personal data be corrected and that the decision be subjected to meaningful human review and reconsideration.
Adverse Outcome Disclosure
When notifying an affected employee or applicant of an adverse outcome from an ADMT-driven decision, Rule 6.4 of the proposed rules would require employers to describe the “specific purpose” for which they used a covered ADMT, “the role” the ADMT played in making a consequential decision, and “the role of any human reviewer(s) and other ADMT or similar systems.” In addition, employers must describe the principal reasons for the adverse outcome “with specificity” and in a manner that avoids language “that is overly broad or vague.” The proposed rules specify an example of an employer disclosing to an “unsuccessful candidate for employment” that it used an “automated system to produce a score, and that score is equally weighed along with the scores created by company employees that interviewed the unsuccessful candidate.”
Of note, the proposed rules explicitly state that a deployer would not comply if it cannot explain how the ADMT materially influenced the decision or how the ADMT used a consumer’s personal data in connection with a decision or if it cannot accurately explain the principal reasons for the adverse outcome. Colorado employers that are currently using ADMTs may wish to ensure that they have the necessary understanding of how these tools are used in order to be prepared to provide compliant notifications to employees and job applicants once the law takes effect.
Responding to Consumer Requests for ADMT Information
If an affected employee or job applicant requests additional information about a covered ADMT, Rule 6.6 of the proposed rules would require employers to describe the “types and categories” of information sufficiently so that the employee or job applicant can meaningfully understand the information the ADMT considered, such as “credit score,” “medical or health information,” and “criminal history.” Second, and more demanding, each source of personal data must be identified by name—specific data brokers, databases, social media companies, schools, and employers.
If the employer obtained personal data through a third-party aggregator, the disclosure would need to trace the chain back to the original source and identify every intermediary. This could require employers that rely on third-party assessment platforms, background check providers, or data aggregators to ensure that vendor contracts include access to such information.
Submitting Rights Requests Post-Adverse Outcome
The ADMT law requires that deployers provide an explanation of ADMT consumer rights and how to exercise them. Rule 7.2 of the proposed rules would specify that an outcome disclosure must include a clearly labeled link that leads directly to the request mechanism, as well as a mailing address or toll-free number.
Employers would be required to offer two or more designated methods for submitting requests, taking into account how they typically interact with employees and job applicants. Those methods would need to be regularly monitored by someone with the knowledge and ability to process the request. Affected consumers would also need to be able to submit requests at any time—not just during business hours—and the process must require as few steps as possible.
Clarifying Rights to Request Personal Data and Make Corrections
Rule 7.3 of the proposed rules would entitle employees and applicants to specific pieces of personal data used in the consequential decision in a concise, transparent, and intelligible form. The proposed rules define this information broadly, including not just raw inputs but also the final rank, score, classification, recommendation, prediction, or other inferences about the individual.
Moreover, Rule 7.4 of the proposed rules would require employers to correct any incorrect information in their “existing system[s].” While employers would be entitled to request supporting documentation for a correction request, employers would need to give the employee or job applicant requesting the correction “a meaningful understanding of why the documentation is necessary.” . Where possible, the adverse outcome would need to be stayed pending correction of incorrect personal data.
Right to Independent Human Review
A central part of the ADMT law is that consumers (i.e., employees and job applicants) have a right to request “meaningful human review and reconsideration” of an adverse outcome in a “consequential decision, to the extent commercially reasonable.” (Emphasis added). Rule 7.7 of the proposed rules would further clarify the procedures for such requests, requiring employers to confirm receipt within ten days and complete a review within forty-five days, mandate that reviews be independent, and establish a multifactor test for determining commercial reasonableness.
The proposed rules clarify that meaningful human review requires that the review “be conducted by an independent reviewer” who has authority to approve, modify, or override the decision. The reviewer should, “whenever feasible,” not be the individual who made the original decision or a subordinate of that decisionmaker. Further, the reviewer would need to “have a level of subject matter understanding that is commensurate with the nature of, and negative consequences” of the adverse outcome and be properly trained on the ADMT.
In light of the possibility that the final rules will incorporate many, if not all of these elements, employers doing business in Colorado that use or plan to use ADMTs may wish to begin considering how they will operationalize the requirements, including identifying and training the individuals who will conduct a meaningful human review and developing a process for documenting any such reviews in the manner required by the rules.
Commercial Reasonableness for Human Review
Further, the proposed rules would clarify what constitutes “to the extent commercially reasonable,” establishing a multifactor test that balances the type of review required, the magnitude and reversibility of the harm, the value of evidence review, the deployer’s size and capacity, the marginal cost and technical feasibility, and the availability of qualified reviewers.
The proposed rules would create a rebuttable presumption of commercial reasonableness when an adverse outcome results in a “severe and irreversible denial of a basic human need.” Employers would bear the burden of rebutting that presumption by showing technical or financial impossibility, or that the review could not change the outcome. This presumption could likely be triggered by employer decisions that affect an individual’s livelihood—particularly terminations of employment or nonrenewals of essential positions.
Types of Meaningful Human Review
The proposed rules contemplate two types of human reviews. First, when an employee or applicant suggests that an ADMT may have “functioned incorrectly” or not as intended, “including with respect to accuracy, output, transcription, and glitches, or errors in configuration, instruction, or other technical failures,” then the review may include correcting the ADMT tool and rerunning the decision-making process.
Second, if the employee or job applicant suggests that “the ADMT itself was problematic,” such as it considered the wrong factors, did not have access to relevant information, or was not meant to make the decision at issue, then a meaningful human review “would likely include the review of additional relevant evidence” provided by the employee or job applicant and a consideration of whether such evidence changes the adverse outcome. A decision to override the original decision and reverse the adverse outcome would be sufficient to indicate that “human review was meaningful.”
Next Steps
For employers using AI-driven tools in hiring, promotions, employment terminations, or other workforce decisions, the proposed rules would impose new technical requirements and substantially increase compliance obligations from the new statutory framework. Employers and other stakeholders may wish to stay informed about further developments in the rulemaking and begin considering how to operationalize requirements that may be incorporated into the final rules.
Ogletree Deakins’ Artificial Intelligence and Innovation Practice Group will continue to monitor developments and will provide updates on the Colorado, Cybersecurity and Privacy, Employment Law, and Artificial Intelligence and Innovation blogs as additional information becomes available.
Follow and Subscribe
LinkedIn | Instagram | Webinars | Podcasts
