Colorado just made your hiring stack a regulated system
The Colorado AI Act took effect June 30, 2026. If AI substantially factors into decisions about jobs, lending, housing, or insurance for Colorado residents, you now owe a named set of duties, and hiring is where most companies get caught.
Colorado's SB 24-205 is the first broad US state law aimed squarely at companies that deploy high-risk AI, not just the ones that sell it. After a delay from February, it is now in force. The concept at its center is algorithmic discrimination, and the duty is reasonable care to protect consumers from it.
The law reaches any company doing business in Colorado that uses AI as a substantial factor in consequential decisions: employment, education, financial services, essential government services, health care, housing, insurance, or legal services. Remote hiring makes this everyone's law: if Coloradans apply to your roles and an AI ranks them, you are in scope.
The deployer checklist
For each high-risk system, a deployer needs:
- A risk management policy and program covering the system
- An impact assessment, refreshed at least annually and after major changes
- Notice to the consumer before the decision, in plain language
- After an adverse decision: an explanation, a chance to correct data, and a path to appeal with human review where feasible
- Notice to the attorney general within 90 days if you discover algorithmic discrimination
There is a meaningful small-company carve out for some duties, and a rebuttable presumption of reasonable care if you follow a recognized risk framework. Both reward the same behavior: documented, systematic handling of your AI use rather than vibes.
Hiring is the collision point
Overlay the map and hiring sits at the center of it. New York City has required bias audits and candidate notice since 2023. Illinois added its Human Rights Act amendment in January 2026. The EU AI Act treats employment AI as high risk outright. Colorado now adds impact assessments and appeal paths.
If you use an ATS with AI ranking, the work is convergent: know the tool, get the vendor's audit and data practices in writing, tell candidates, document human review, and keep records. Do it once, properly, and you have satisfied the spine of four frameworks at the same time.
Regolyn content is preparation, not legal advice. Dates and duties are stated as of publication; the product's obligation library is the versioned, maintained source.