How to Comply With Colorado’s AI Act (SB 24-205) When Using AI to Screen Job Applicants in 2026
Colorado’s AI Act (SB 24-205) requires Colorado employers using AI to screen applicants in 2026 to implement documented risk management, provide applicant notices, enable certain opt-out/human-review paths, and monitor for discrimination. The law targets “high-risk” AI systems used in consequential decisions like employment and will be enforced by the Colorado Attorney General. This article explains how to classify your hiring AI, build a compliant governance program, and update vendor contracts, policies, and applicant workflows.
What Colorado’s AI Act (SB 24-205) Means for AI-Based Applicant Screening
Colorado’s AI Act (SB 24-205) is a sweeping state-level algorithmic accountability law aimed at reducing “algorithmic discrimination” in consequential decisions. For employers, the most practical impact is on AI tools used to screen resumes, rank candidates, administer automated assessments, conduct asynchronous video interviews, or generate hiring recommendations. If the tool meaningfully influences who advances in the process, it can trigger the statute’s “high-risk” requirements.
The law’s obligations generally fall into four buckets: (1) determining whether your system is “high-risk” in the employment context; (2) adopting a documented risk management program; (3) providing required notices and certain explanations/paths for affected individuals; and (4) conducting ongoing monitoring, escalation, and vendor oversight. Colorado enforcement authority sits with the Colorado Attorney General, and compliance is easiest when built into procurement, HR workflows, and EEO/DEI governance—rather than treated as a one-time “AI policy.”
Step 1: Determine Whether Your Hiring Tool Is a “High-Risk” AI System
SB 24-205 focuses on “high-risk” AI systems used to make or substantially assist “consequential decisions,” including employment decisions. In hiring, that typically includes decisions about screening, selection, promotion, termination, compensation, or other opportunities. In practice, employers should treat the following as likely “high-risk” uses when the output is used to decide who moves forward:
- Resume scoring/ranking tools that assign fit scores or automatically shortlist candidates.
- Chatbots or pre-screening questionnaires that filter applicants based on responses.
- Automated assessments that evaluate cognitive traits, personality indicators, or “culture fit.”
- Video or audio analysis tools that infer traits from facial movements, speech patterns, or demeanor.
- Generative AI summaries used as a decisive hiring recommendation rather than a non-decisional draft.
Two common mistakes in classification are: (1) assuming a vendor’s “EEO-friendly” marketing means the tool is not regulated; and (2) treating the AI output as “advisory” when, operationally, recruiters follow it as a default. Colorado’s analysis is functional: if the system plays a meaningful role in a consequential decision, treat it as high-risk and build the compliance file accordingly.
Practical classification test for HR and legal
Ask: “If this model is wrong, can it realistically change who gets interviewed or hired?” If yes, you should plan for SB 24-205 high-risk controls, regardless of whether a human technically clicks “approve.” Document the answer in a short internal memo and keep it in your AI governance repository.
Step 2: Map Your Hiring Workflow and Identify “Decision Points”
Before writing policies, map the actual data flow: what data enters the system (resume text, application fields, assessments, video, background check results), what the model outputs (scores, labels, rankings, summaries), and where the output is used (recruiter dashboard, ATS disposition codes, interview scheduling triggers). The goal is to identify “decision points” that the AI influences and which groups could be disparately impacted.
Example: An employer uses an AI tool to score resumes from 0–100 and automatically advances applicants scoring above 80 to interviews. That is a direct employment screening decision. Even if recruiters can override, the default threshold becomes the effective decision rule and should be treated as high-risk.
Example: A generative AI tool drafts interview questions and summarizes interview notes, but hiring managers do not use it to rank or reject candidates. That may be lower risk—but only if your governance ensures outputs are not later used as a proxy ranking system (e.g., “hire/no hire” labels) without revisiting compliance.
Step 3: Implement a Documented Risk Management Program (Governance in Writing)
SB 24-205 expects organizations deploying high-risk AI to take reasonable care to prevent algorithmic discrimination and to document their approach. For employers, the compliance “spine” should include:
- AI inventory of hiring-related systems (vendor name, model purpose, versioning, dates in use, business owner, data sources).
- Risk assessments for each high-risk use case (foreseeable harms, affected populations, controls).
- Policies and procedures for approved uses, prohibited uses, and escalation.
- Training for recruiters and hiring managers on how to interpret outputs and avoid overreliance.
- Monitoring and testing plan for ongoing disparate impact and drift.
In employment, tie the AI program to existing compliance frameworks: Title VII, ADA, ADEA, Colorado Anti-Discrimination Act (CADA), the FCRA (if consumer reports are involved), and record retention obligations. Courts and regulators often judge “reasonableness” based on whether governance was real, consistent, and followed—not whether a policy existed in a PDF.
Bias and disparate impact testing: what to measure
SB 24-205’s core concern is algorithmic discrimination. For applicant screening tools, a defensible monitoring plan often includes:
- Selection rates by protected-class proxy where lawful and feasible (or by job-related groupings and geography where direct measurement is constrained).
- Adverse impact analyses (e.g., four-fifths rule as a screening heuristic, with counsel-guided statistical review).
- False negative review (qualified candidates rejected by the model).
- Model drift checks (changes in output distributions after updates, new job families, or labor market shifts).
Because measuring protected traits can raise legal and practical complexity, coordinate with employment counsel on lawful data collection, anonymization, retention, and use limitations. The key is demonstrating a good-faith process to detect and mitigate discriminatory effects.
Step 4: Provide Applicant-Facing Notices and Meaningful Transparency
When AI meaningfully influences hiring decisions, employers should prepare applicant-facing disclosures that are clear and operationally accurate. Practically, this means updating job postings, career portal language, and application workflows so that candidates understand:
- AI is being used in the screening or evaluation process.
- The purpose of the AI tool (e.g., resume ranking, assessment scoring).
- How the output is used (e.g., one factor among others vs. automatic thresholding).
- How to request human review or appeal where required/available.
Transparency is not just a legal checkbox. It reduces applicant complaints, supports defensibility in discrimination claims, and aligns internal stakeholders on what the tool actually does.
Sample notice language (adapt to your workflow)
“We use automated tools to help review applications for this role. These tools may analyze information you provide (such as resume content and application responses) to generate a score or recommendation. A recruiter reviews applications and may consider the tool’s output along with other job-related factors. If you would like to request an alternative evaluation process or have questions about this notice, contact [email/phone].”
Have counsel vet the wording to avoid overpromising (e.g., “humans review every application”) and to match reality in your ATS.
Step 5: Build a Human-in-the-Loop Process That Is More Than a Rubber Stamp
Many organizations assume that “a human clicks the final button” eliminates AI risk. Regulators increasingly look for whether human review is meaningful. A robust process includes:
- Reviewer guidance on what the score means and what it does not mean.
- Prohibition on sole reliance unless validated and approved for that use.
- Override workflows with rationale fields (to avoid rubber-stamping and to create an audit trail).
- Escalation triggers when the system rejects disproportionately in a job family or location.
Example: If an AI assessment flags applicants as “high turnover risk,” train managers not to treat that label as a proxy for protected traits (e.g., disability-related attendance issues) and require a job-related explanation for adverse decisions.
Step 6: Vendor Due Diligence and Contract Terms for SB 24-205
Most employers will comply through vendors embedded in ATS platforms, assessment tools, and screening services. SB 24-205 compliance requires more than a glossy SOC 2 report. During procurement and renewal, require vendors to provide:
- System documentation describing intended use, limitations, and known risk factors.
- Evaluation/validation artifacts (testing methodology, bias testing summaries, performance metrics by job family where available).
- Change management notice obligations for model updates, new features, or new data sources.
- Audit cooperation and access to information needed for your risk assessments.
- Incident notice provisions for discriminatory outcomes, data breaches, or regulator inquiries.
Key contract clauses to consider: representations about compliance with applicable AI and employment laws; allocation of responsibility for notices; indemnities tailored to discrimination and regulatory investigations; confidentiality carve-outs to enable legally required disclosures; and clear ownership of outputs and logs
