[co-author: Vanessa Shelton]

A new frontier emerges in the shadow of Colorado’s majestic peaks – Colorado’s governor signed into law a first-of-its-kind comprehensive artificial intelligence (“AI”) law in May 2024. Senate Bill (“SB”) 24-205, commonly known as the “Colorado AI Act,” regulates the risk of algorithmic discrimination arising from the use of high-risk AI systems in the employment context. Effective February 1, 2026, the Colorado AI Act accomplishes what California is trying to do, and what other states and localities did in limited ways, in passing legislation addressing “algorithmic discrimination.” Algorithmic discrimination occurs when the use of an AI system results in or contributes to unjustified differential treatment or impact based on actual or perceived protected characteristics.

California’s Bills Surpassed by Colorado AI Act

The Colorado AI Act beat out California’s own proposed AI law impacting the workplace. California first introduced a bill, Assembly Bill (“AB”) 331, over one year ago targeting automated decision tools that failed earlier this year. Now, AB 2930, entitled “Automated Decision Tools,” seeks to prohibit the use of any “automated decision tools” – systems or services that use AI to make consequential decisions, such as those impacting employment – that result in discrimination.

If passed, California’s AB 2930 will require developers and users of automated decision tools to provide an impact assessment to identify and eliminate “algorithmic discrimination.” Where a consequential decision is made solely based on the output of an automated decision tool, deployers of the automated decision tools will be required to accommodate a person’s request not to be subject to the tool. AB 2930 passed in the California House, and is now pending before the California Senate.

NYC, Maryland, and Illinois Laws Already Passed, But Do Not Go as Far as the Colorado AI Act

Besides Colorado, only New York City and two states (Maryland and Illinois) have passed laws addressing AI and automated decision tools in the employment context, but only in limited circumstances:

• New York City’s Local Law 144 requires employers and employment agencies that use an automated employment decision tool (“AEDT”) to provide notices, complete an annual bias audit, and to publicly share the results of the annual bias audit. Any discrimination claims involving AEDTs are referred to the NYC Commission on Human Rights, which enforces the New York City Human Rights Law. Local Law 144 imposes monetary penalties of no more than $500 for the first violation and between $500 and $1,500 for each subsequent violation.
• The other two laws addressing automated decision tools apply in the job requisition and interviewing context.
• Illinois’ Artificial Intelligence Video Interview Act prohibits employers from using AI to analyze video submissions from job applicants unless employers (1) provide notice to the applicants, before the interview, that AI may be used to assess the applicants, (2) explain how the AI system works, and (3) obtain the applicants’ consent to be assessed by AI.
• Maryland’s HB 1202 prohibits employers from using facial recognition technology in job interviews unless the applicant provides a written consent and waiver stating the applicant’s name, the date of the interview, that the applicant consents to the use of facial recognition during the interview, and that applicant read the waiver.

This means that, for now, Colorado has the only state-wide law that regulates AI and algorithmic discrimination in the employment context.

While California’s Bill Sits, Colorado AI Act Moves Ahead

The Colorado AI Act steps into the lead on state legislation regulating AI in the employment context while California’s AB 2930 awaits passage.

Like California’s bill, the focus of the Colorado AI Act is the classification of “high-risk AI systems,” which include systems that make a “consequential decision,” or a decision that has a material legal (or similarly significant) effect on providing or denying a consumer an opportunity, including employment opportunities. The Colorado AI Act requires deployers and developers to use reasonable care to avoid algorithmic discrimination arising from intended (and contracted) usage of high-risk AI systems. Specifically:

• The Colorado AI Act applies to developers and “deployers” – a person doing business in Colorado that deploys a high-risk artificial intelligence system. Commentators are construing the definition of “deployers” to include employers.
• Like California’s AB 2930, the Colorado AI Act defines “algorithmic discrimination” as “…any condition in which the use of an artificial intelligence system results in an unlawful differential treatment or impact that disfavors an individual or group of individuals on the basis of their actual or perceived” protected characteristics.
• If the Colorado Attorney General brings an enforcement action against a high-risk AI system deployer, the Colorado AI Act creates a rebuttable presumption that a deployer uses reasonable care if it is compliant with various measures, including impact assessments, notifications, and risk management policies and programs.
• A violation of the Colorado AI Act constitutes a deceptive trade practice under Colorado’s Consumer Protection Act, carrying up to a $20,000 civil penalty for each violation.

What Employers Should Know

California’s AB 2930 has not yet passed, and the Colorado AI Act does not take effect until February 2026. However, both California and Colorado employers can prepare for compliance by:

1. Designing a governance and compliance program meeting the respective statute’s requirements.
2. The Colorado AI Act refers to the “Artificial Intelligence Risk Management Framework” promulgated by the National Institute of Standards and Technology (NIST) as a benchmark for required risk management programs. However, the Colorado AI Act allows covered entities to refer to other comparable nationally or internationally recognized frameworks.
3. Building processes and designating personnel to perform impact assessments, perform bias audits, and report any adverse findings from the assessments and audits.
4. Establishing the infrastructure for documentation regarding notifications provided to job applicants, employees, and other personnel.

The Colorado AI Act ushers in a new frontier for Colorado employers who use AI and automated decision tools, requiring employers to be mindful of the tools they may use in the job requisition and assessment processes. Should California’s AB 2930 pass, California employers will be required to meet requirements like those applicable to their Colorado counterparts. Dorsey’s Workplace Privacy team will continue to monitor pending state law, and provide updates as they come.