AI hiring laws in Colorado and Illinois: a guide for small employers

Last checked October 23, 2026 · About 7 minutes · Not legal advice

What changed in 2026

Colorado passed the first broad US law on high-risk AI in 2024 (SB 24‑205). It was delayed, challenged and, in May 2026, replaced. The new law, SB 26‑189, was signed on May 14, 2026 and takes effect on January 1, 2027. It's narrower than the old one: no impact assessments, no risk-management program. What's left is mostly about transparency: notices, explanations and a few rights for the people affected.

That's good news for small employers, with one catch. The law has no size threshold, so the notice duties apply to a 5-person company the same as to a bank. Hiring is where most small businesses will meet it, because so many applicant tracking systems now rank or filter applications by default.

Who it covers

The law applies to "deployers" (businesses that use the technology) and "developers" (companies that make it). If you buy software and use it, you're a deployer.

You're covered when automated decision-making technology (software that processes personal information and generates an output such as a score, ranking, recommendation or prediction used to make or assist a decision) materially influences a consequential decision about someone. Consequential decisions cover access to:

• employment
• education
• Colorado residential real estate (renting or buying a home)
• financial services, such as loans or credit
• insurance
• health care
• essential government services

What "materially influences" means

The Attorney General's draft rules presume that a tool materially influences a decision when its output screens people, sets a threshold, or produces a score, ranking or recommendation that the decision-maker reviews or uses, and the outcome matches it. You can rebut that by showing the output was only a minor ("de minimis") factor. Tools used only to summarize, organize or present information for a person to review fall outside the definition.

Hiring examples

• Likely covered: your applicant tracking system ranks, scores or auto-rejects applications; a skills assessment scores candidates and you use the score; a video interview tool rates answers; AI sourcing decides who gets contacted; software flags employees for discipline or promotion.
• Likely not covered: a tool that only summarizes applications for a person to read; interview scheduling; spell-check.

The law also covers housing, lending, insurance, health care and education decisions. This guide focuses on employment.

What you have to do

1. Notice before you use it

Give clear and conspicuous notice before the technology is used in a decision about someone. A link or posting near the point of decision (your job ad, application page or rental application) can do this, as long as it tells people how to get more information. The draft rules ask for plain, jargon-free language that people with disabilities or limited English can use.

2. A written explanation within 30 days of an unfavorable decision

When a decision goes against someone and the technology materially influenced it, you must give them, in writing and within 30 days:

• a plain-language description of the decision and the technology's role in it;
• instructions for requesting more information about the technology, its inputs and its developer;
• an explanation of their rights and how to use them.

Earlier drafts of the rules also asked for the main reasons for the decision with specificity; the October draft focuses on describing the technology's role specifically. Including the main reasons is the safer choice. Printed letters must be in at least 12-point type.

Already send FCRA adverse action notices? The draft rules let you put the required information in, or alongside, a Fair Credit Reporting Act or Equal Credit Opportunity Act notice, if it goes out within 30 days. That's relevant for background checks and tenant screening.

3. Respond to requests

• Information: the technology's name, version, developer, and the types and sources of personal data it used. The October draft gives 15 days for requests by link or phone.
• Correction: instructions for getting and correcting personal data that is factually incorrect or materially inaccurate. Opinions, predictions and scores aren't covered.
• Human review: meaningful human review and reconsideration, to the extent commercially reasonable. The reviewer can be internal or external but must be able to change the decision.

4. Keep records

Keep the records you'd need to show you complied: which tools you use, the notices you published, the letters you sent and the requests you answered. Plan on at least three years.

Recruiters and staffing agencies

If you screen candidates with AI for client employers, plan on the duties applying to both you and your client. Colorado's draft rules keep a business responsible when a third party runs the technology for it and it uses the output in its decision. Illinois's withdrawn draft rules applied to employers' agents, including recruiters. Agree in writing with each client who publishes the notices, who sends decision letters, and who handles requests.

Enforcement

Only the Colorado Attorney General can enforce the law, under the Colorado Consumer Protection Act; individuals can't sue under it. Before acting, the Attorney General generally has to give notice and 60 days to fix the problem, unless the violation was knowing or repeated. That cure period ends on January 1, 2030.

Illinois: AI notices in hiring, already in force

Illinois amended its Human Rights Act with HB 3773, effective January 1, 2026. If you have at least one employee in Illinois:

• You must notify employees and applicants when you use AI for recruitment, hiring, promotion, renewal of employment, training selection, discharge, discipline, tenure or other terms of employment.
• You must not use AI in a way that has the effect of discriminating on the basis of a protected class, or use zip codes as a proxy for protected classes.

Illinois defines AI broadly, including generative AI, and the notice duty applies to any use of AI for these purposes, not only fully automated decisions. The state proposed detailed notice rules in May 2026 and withdrew them in June 2026, so there's no prescribed format yet. The withdrawn draft is still a useful guide: name the tool and its vendor, say which decisions it affects, what data it uses and how it works, give a contact, mention the right to request a reasonable accommodation, and put the notice in job postings, your handbook and your website.

Key dates

A 30-minute plan

1. List your tools. Check your applicant tracking system, assessments and interview software. Note any that score, rank, filter or recommend candidates or employees, and whether auto-reject settings are on.
2. Ask your vendors for their statement of intended uses, known risks and limitations. Colorado requires developers to provide one.
3. Write your notices: a short one for where decisions start and a full one for your website.
4. Prepare your decision letter and your replies to information, correction and review requests.
5. Set up a log of decisions, letters and requests.
6. Illinois employers: add the statement to job postings and give employees the notice now.

Sources

• Colorado Department of Law, ADMT rulemaking page and interim draft rules (October 6, 2026)
• Seyfarth Shaw, Colorado enacts artificial intelligence replacement law
• Paul Hastings, Colorado enacts new, narrower, less burdensome AI law
• Orrick, Colorado releases revised proposed ADMT rules
• Hunton Andrews Kurth, Illinois enacts new law regulating employer use of AI
• National Law Review, Illinois postpones proposed AI employment regulations