Colorado Just Killed Its Own AI Hiring Law. California Didn't.

If you've been pacing toward a June 30, 2026 Colorado AI Act deadline, stop. The law you were preparing for doesn't exist anymore. Governor Polis signed SB 189 on May 14, 2026, which delayed the effective date to January 1, 2027 and gutted most of the duty-of-care regime that made the original bill scary in the first place. The trade press calling this "limited enforcement creating a false sense of safety" has the right instinct and the wrong target. The exposure didn't disappear. It moved.

What actually happened to SB 24-205

Colorado's original AI Act (SB 24-205, signed May 17, 2024) was the first comprehensive state AI law in the country. It regulated "high-risk AI systems" in consequential decisions across employment, housing, healthcare, education, and lending. For hiring teams, that meant resume screeners, video interview scorers, and AI sourcing tools were all in scope. Violations were going to be prosecuted as deceptive trade practices at up to $20,000 per violation.

Three things killed it before June 30.

First, on April 9, 2026, xAI filed a federal constitutional challenge. On April 24, the DOJ Civil Rights Division (AAG Harmeet K. Dhillon) moved to intervene, arguing the law's anti-disparate-impact requirements violate the Fourteenth Amendment's Equal Protection Clause. The DOJ framed the case publicly around "DEI ideology." It's the first time the federal government has actively tried to invalidate a state AI bias law.

Second, on April 27, 2026, a federal magistrate judge stayed enforcement.

Third, Senate Majority Leader Robert Rodriguez and Rep. Brianna Titone, the same legislators who authored SB 24-205, sponsored SB 189 to replace it. This was a managed retreat, not a hostile repeal. They saw the constitutional litigation coming and rewrote the law into something narrower that could survive.

What SB 189 actually requires (and what it dropped)

The new January 1, 2027 regime is meaningfully smaller. Out: the duty of care aimed at preventing algorithmic discrimination, deployer obligations to maintain risk management programs, mandatory impact assessments, and certain reporting obligations to the Colorado Attorney General. That's the entire pre-deployment compliance stack.

In: a disclosure-and-notice regime centered on adverse decisions.

When a deployer (the employer, in hiring) makes an adverse decision (say, a rejection) using automated decision-making technology, they must provide disclosures within 30 days. Those disclosures must include a plain-language explanation of the decision and the role of the ADMT, instructions for requesting further information, and rights including a request for meaningful human review. Records must be retained for at least three years. Enforcement is centralized with the Colorado AG. There's a 60-day pre-enforcement cure period that sunsets January 1, 2030.

That's structurally lighter than SB 24-205 but operationally awkward in a way most TA teams aren't ready for. The 30-day per-rejection AI disclosure doesn't exist under SB 24-205 and doesn't exist under California FEHA. Almost no ATS today is wired to generate it. If your funnel rejects 4,000 candidates a quarter and 1,200 touched an AI screener, that's 1,200 individualized plain-language explanations with human-review instructions, on a 30-day clock, retained for three years.

$20,000

The exposure that didn't go away: California

Here's the part the "Colorado punted to 2027" headlines are burying. If you run a resume screener, video interview tool, or sourcing AI on any Colorado applicant pool, you are almost certainly running the same tool on California applicants. And California's regime is already live.

The California Civil Rights Council finalized regulations under FEHA that took effect October 1, 2025. They apply to all employers in California using AI, machine learning, algorithms, or statistics in employment decisions. They cover both direct discrimination and disparate impact. They specifically name the high-risk tooling categories: assessing applicants with questions, puzzles, games, and other challenges; directing job advertisements to targeted groups; screening resumes for terms and patterns; evaluating facial expressions and speech and voice patterns in online interviews; and analyzing applicant or employee information from third parties.

The recordkeeping rule doubled. California now requires preservation of "automated-decision system data," including data provided by or about applicants and employees, data reflecting employment decisions, and data used to develop or customize an ADS. The retention window went from two years to four.

And, critically, California extended liability to vendors under an agency theory. Mobley v. Workday is the template: in the Northern District of California, the AI vendor was treated as a potential "agent" of the employer for disparate-impact purposes. The new FEHA regs codify that posture. If your screener vendor builds a tool that disparately impacts protected groups, both you and the vendor are on the hook.

Multi-state employers are the worst-positioned. If your hiring stack screens candidates in any of California, Illinois (whose Human Rights Act AI amendment took effect January 1, 2026 and includes a private right of action), or New York City (LL 144), and you've been waiting for Colorado before you build process, you have already been out of compliance somewhere for months.

What "limited enforcement" actually means right now

There's no enforceable Colorado AI-specific employment regime today. The federal stay plus SB 189's repeal-and-replace means SB 24-205 is dead and SB 189 doesn't kick in until 2027. That's true. It's also irrelevant to your risk calculation.

The risk calculation runs through three other doors:

1. California FEHA, already in force. Disparate impact claims can be filed today against your screener. The absence of anti-bias testing is admissible against you.
2. Illinois HRA AI amendment, in force since January 1, 2026. Private right of action. Plaintiffs' bar is the enforcer, not a state AG.
3. NYC Local Law 144, in force since 2023, requiring annual bias audits for automated employment decision tools.

The Colorado punt doesn't reduce your AI hiring risk. It just removes the one regulator who was going to give you a 60-day cure period.

What to actually do in the next 28 days

Here is what the 28-day window is for, given the new facts.

1. Inventory every tool that touches a hiring decision

This is the unglamorous step everyone skips. Pull a list of every system in your funnel that scores, ranks, filters, matches, or routes candidates. Include sourcing tools. Include your ATS's "fit score." Include video interview platforms. Include anything your vendors quietly added an "AI" toggle to in the last six months. For each one, you need to know: what data goes in, what decision comes out, who the vendor is, and whether the vendor has run disparate-impact testing.

2. Get the bias audit, even though Colorado isn't asking

Under California FEHA, the absence of anti-bias testing is admissible against you. Under NYC LL 144 it's already mandatory. Under SB 189 it's not required, but the NIST AI Risk Management Framework (which the original SB 24-205 made a rebuttable presumption of reasonable care) is still your best documentary defense against an Illinois private action or a FEHA claim. Run the audit. Keep the artifacts. Bias audits are now a litigation defense, not a checkbox.

3. Build the 30-day adverse decision disclosure workflow

Even though it's not required until 2027, it takes longer than a year to build. Your ATS vendor needs to emit a plain-language explanation of the AI's role in a specific rejection. Your recruiters need a script for "meaningful human review" requests. Your data team needs three-year retention on the underlying records. Start now or you'll be the team trying to retrofit this in Q4 2026.

4. Re-paper your vendor contracts

Mobley v. Workday matters because California codified the agency theory. Your contracts with screener and sourcing vendors should now include: indemnification for disparate-impact claims, audit rights, bias testing artifacts on demand, and notice obligations when the vendor changes the underlying model. Most vendor MSAs signed before October 2025 don't have any of this.

5. Watch coag.gov/ai/ for SB 189 implementing rules

Colorado AG Phil Weiser's office is the place the implementing rules will land. The statutory text is narrow but the rules will define what "plain-language explanation" actually means in practice. Whatever shape those rules take will pull California's interpretive practice with them. Get on the notification list.

The sourcing angle

If you're a TA leader staffing up a privacy or AI compliance function around this, the hiring pool is small and concentrated. The people who have actually shipped NYC LL 144 audits or FEHA-compliant ADS rollouts mostly sit at large enterprises in California and New York. Sourcing them via Boolean on LinkedIn returns the same 200 names everyone else is contacting. This is the kind of search where you need cross-platform signal, conference talks, GitHub commits on open-source fairness tooling, blog posts on adverse impact methodology, which is exactly the problem Refolk was built for. You describe the person in plain English and get a ranked shortlist across GitHub, LinkedIn, and the open web.

4 years

For the same reason, if you're trying to build out an in-house bias audit capability rather than buy it, your candidate pool overlaps heavily with academic fairness ML researchers, ex-Workday and ex-HireVue model risk people, and lawyers with a quant background. Standard recruiter searches miss most of them. A query like "ML engineers who've published on fairness and worked at an HR tech company" through Refolk surfaces the cross-section in a way Boolean can't.

The bigger pattern

The DOJ intervention is the leading indicator. Bias-audit mandates and disparate-impact regimes at the state level are going to face Equal Protection challenges, not just lobbying pushback. Expect Illinois HRA and NYC LL 144 to draw similar suits. Expect California to be the constitutional fight that actually matters, because California's regime is the broadest and the most willing to extend liability to vendors.

Colorado punted. California didn't. Your screener doesn't care which state's law it's violating.

FAQ

Is Colorado's AI Act still happening on June 30, 2026?

No. Governor Polis signed SB 189 on May 14, 2026, which delayed the effective date to January 1, 2027 and replaced most of the original framework. The original duty of care, impact assessment requirements, and risk management program obligations are gone. What remains is a narrower disclosure regime around adverse decisions, enforced by the Colorado AG with a 60-day cure period.

If Colorado's law is on ice, do I need to do anything before 2027?

Yes, but for California reasons, not Colorado ones. California's FEHA automated decision system regulations took effect October 1, 2025 and apply to any employer using AI, ML, algorithms, or statistics in hiring decisions on California candidates. Illinois HRA's AI amendment has been in force since January 1, 2026 with a private right of action. If your screener touches candidates in either state, you're already in scope.

What's the most underrated SB 189 requirement?

The 30-day post-adverse-decision disclosure. When you reject a candidate where automated decision-making technology played a role, you owe them a plain-language explanation of the tool's role, instructions for requesting more information, and a right to meaningful human review. Almost no ATS today is wired to emit this. Building it takes longer than the time between now and January 1, 2027.

Does the DOJ intervention mean other state AI laws are vulnerable?

Probably yes. The DOJ's Equal Protection theory against SB 24-205 applies, in principle, to any state law that mandates prevention of unintentional disparate impact. Illinois HRA, NYC LL 144, and California's FEHA regs are all plausible next targets. Bias audits are still the right thing to run because they double as litigation defense under all three regimes, but expect the constitutional fight to continue.