Colorado tried to regulate AI in hiring through two successive laws. The first, SB 24-205, drew a constitutional challenge in federal court that led to an enforcement stay in April 2026. The legislature responded with SB 26-189, a narrower replacement signed on May 14, 2026, that takes effect January 1, 2027. The ongoing case, xAI v. Colorado, keeps testing whether states can regulate AI in the face of federal preemption arguments, and that uncertainty now reaches the replacement law as well. For HR technology vendors and employers, the practical takeaway has not changed: a multi-state compliance baseline is still essential.

A crucial point is often reported incorrectly. The April 2026 stay did not stop at SB 24-205. The court's order pauses enforcement of SB 24-205 and any legislation replacing or amending it, and the Colorado Attorney General has stated it will not enforce the original law or its replacement until the rulemaking process concludes. In other words, SB 26-189 sits inside the same enforcement pause, and xAI has signaled a new motion aimed directly at it. What has not moved is the law's January 1, 2027 effective date, or the obligations imposed by other jurisdictions. NYC LL 144, California FEHA, Illinois HB 3773, and Connecticut's CART Act each impose duties regardless of Colorado's litigation timeline, and federal Title VII liability for AI-driven discrimination applies nationwide.

Schedule a consultation with Warden AI to assess your multi-state AI compliance readiness.

From SB 24-205 to SB 26-189: The xAI Lawsuit and Colorado's Legal Shift

xAI filed suit against SB 24-205 on April 9, 2026. The U.S. Department of Justice intervened on April 24, citing the federal executive order directing challenges to state AI laws. The court stayed enforcement on April 27. Colorado then passed SB 26-189 on May 14, repealing and replacing the older law. The constitutional challenge continues, and the enforcement pause and the Attorney General's non-enforcement position both extend to the replacement framework.

Timeline of the Constitutional Challenge

The case began on April 9, 2026, when xAI filed suit in the U.S. District Court for the District of Colorado against Attorney General Philip J. Weiser. The complaint challenged SB 24-205, which created broad rules for high-risk AI systems modeled in part on the EU AI Act. On April 24, 2026, the DOJ moved to intervene against the law, the first time the federal government has sought to intervene in a challenge to a state AI law. The court granted a joint motion to stay enforcement on April 27, 2026, and the Colorado Attorney General confirmed it would not enforce SB 24-205, or any law replacing or amending it, until rulemaking concluded.

The posture shifted on May 14, 2026, when Governor Polis signed SB 26-189, which repealed SB 24-205 and replaced it with a narrower framework focused on automated decision-making technology (ADMT). That legislative response did not resolve the constitutional question. Because the stay covers replacement legislation, SB 26-189's future enforcement is paused alongside the original law, and xAI has signaled a fresh motion for a preliminary injunction targeting the new statute.

Constitutional Arguments Against State AI Laws

The legal arguments center on several constitutional theories. Under the First Amendment, the plaintiffs argue that rules governing algorithmic decision-making compel and restrict how companies process and communicate information. Under the Dormant Commerce Clause, the suit argues that Colorado is regulating conduct beyond its borders. Under the Equal Protection Clause, the challengers characterize the law's treatment of diversity-promoting algorithms as impermissible. The DOJ's intervention adds a federal preemption dimension to the dispute.

None of these arguments has received a final ruling. The April 2026 stay was procedural, preserving the status quo while the court examines the merits, and the replacement of SB 24-205 with SB 26-189 adds a further question: whether the narrower law shares the alleged defects. Many organizations are watching the case closely while continuing to build bias audit and monitoring frameworks for their hiring tools.

What Colorado SB 26-189 Actually Requires

SB 26-189 is a meaningful departure from SB 24-205. The old law adopted a broad high-risk AI system framework with a duty of care, a risk management program, and impact assessments. The new law drops those elements and narrows the scope to automated decision-making technology, defined as technology that uses data to materially influence a consequential decision about a person. That definition covers hiring tools, along with systems affecting education, housing, financial services, insurance, healthcare, and essential government services.

Key Compliance Duties

Employers and vendors using ADMT in hiring face four core deployer obligations. First, pre-use notice: you must give clear and conspicuous notice before ADMT is used to materially influence a decision, with instructions for obtaining more information. Second, adverse-outcome notice: within 30 days of a consequential decision that produces an adverse outcome, you must give the person a plain-language description of the decision, the role the ADMT played, and how to request further detail. Third, the right to request additional information and human involvement in reviewing the outcome. Fourth, correction rights covering erroneous data used in the evaluation.

These duties overlap with elements of NYC LL 144 and California FEHA, which is useful for organizations already operating in those jurisdictions. Importantly, SB 26-189 does not mandate an annual bias audit by name. Its emphasis is disclosure, transparency, and human review rather than mandated testing, though independent bias audits remain the strongest way to evidence good-faith compliance across all of these frameworks.

Enforcement and Right to Cure

The Colorado Attorney General has sole enforcement authority. There is no private right of action, so individuals cannot sue under the statute. Violations are enforced under the Colorado Consumer Protection Act and treated as a deceptive trade practice. Before initiating an action, the AG must give notice and a 60-day opportunity to cure where a cure is deemed possible, though that opportunity does not apply to knowing or repeated violations. This structure contrasts with California FEHA, where private plaintiffs can bring disparate impact claims, and with NYC LL 144, which pairs its audit mandate with penalties for non-compliant tools.

Colorado SB 24-205 (repealed) compared with SB 26-189 (new), by compliance feature.
Compliance Feature Repealed SB 24-205 New SB 26-189
Scope of technology High-risk AI systems Narrower ADMT framework
Required assessments Duty of care and impact assessments Notice and disclosure duties
Notice timing Prior to use Prior to use, plus 30-day adverse-outcome notice
Mandated bias audit Not required by name Not required by name
Enforcement Attorney General Attorney General only, no private right of action
Right to cure None specified 60-day cure, except knowing or repeated violations
Effective date June 30, 2026 (enforcement stayed) January 1, 2027

[Image] Legal document with Colorado state seal representing AI compliance legislation and regulatory framework. Caption: Colorado SB 26-189 replaces the broader SB 24-205 with a narrower ADMT framework focused on disclosure and human review.

Why the Litigation Does Not Remove Your Compliance Obligations

It is tempting to read the enforcement pause as permission to wait, but that reading does not hold. The stay is procedural, and while it currently pauses enforcement of both SB 24-205 and SB 26-189, it has not changed the replacement law's January 1, 2027 effective date, and the pending Colorado rulemaking will define how the duties are applied. The case could resolve at any time, and an organization that treated the pause as a stop signal would face a compressed runway to build disclosure, human review, and monitoring systems that take months to stand up.

The rest of the regulatory landscape has not paused at all. Most HR technology companies operate across several states, and the overlapping obligations there are already live. Colorado is one piece of a broader picture that includes NYC LL 144, California FEHA, Illinois HB 3773, Connecticut's CART Act, and federal Title VII. Each is summarized briefly below, with links to fuller guidance.

NYC LL 144 requires an annual independent bias audit for automated employment decision tools used in New York City. California FEHA regulations took effect October 1, 2025, and extend the state's anti-discrimination duties to automated decision systems in employment. Illinois HB 3773, effective January 1, 2026, requires disclosure of AI use in hiring and bars the use of zip codes as proxies for protected characteristics. Connecticut's CART Act adds transparency obligations and credits anti-bias testing as a mitigating factor in discrimination defense. For how these fit together, see the Warden AI multi-state compliance guide, and for the Colorado specifics, see the SB 26-189 vs SB 24-205 comparison.

Federal Risk Under Title VII

State developments do not touch federal liability. Title VII of the Civil Rights Act applies nationwide to AI-driven hiring decisions regardless of any state law's status. The EEOC has issued guidance on AI and adverse impact, and the Mobley v. Workday litigation supports the view that AI vendors can face liability as agents in the hiring process. Using bias audit findings to evaluate your tools helps demonstrate the standard of care Title VII expects, and that value holds even when a particular state law is contested.

[Image] Compliance calendar timeline showing overlapping state AI law deadlines. Caption: Overlapping effective dates across state AI laws show why a multi-state baseline is essential despite Colorado's ongoing litigation.

How to Prepare for Colorado ADMT Compliance

The same infrastructure that satisfies SB 26-189 also supports NYC LL 144, California FEHA, Illinois HB 3773, Connecticut's CART Act, and Title VII, so preparation is rarely wasted. Building it now, rather than waiting for the litigation to resolve, is the lower-risk path.

  • Inventory your ADMT tools. Identify every automated decision-making technology in your hiring workflow, determine which ones materially influence consequential decisions, and document the data inputs, decision logic, and outcomes for each.
  • Establish disclosure workflows. Build processes for clear pre-use notice to candidates and employees that explain what the tool evaluates, what data it uses, and how the output affects the decision.
  • Create adverse-outcome procedures. Develop a system for notifying individuals within 30 days when an ADMT produces a negative outcome, including a route to request more information and to correct erroneous data.
  • Implement human review. Ensure qualified people can review, override, or explain ADMT outputs on request. This is a core SB 26-189 duty and a key defense against Title VII disparate impact claims.
  • Start bias monitoring. Use continuous testing to catch drift in model outputs and to build evidence of good-faith compliance, and review bias audit findings to understand how tools perform across protected groups.
  • Maintain thorough records. Document each step of the program. Retention policies should account for the 60-day cure period and overlapping requirements from other jurisdictions.

Related Articles

Ready to build your multi-state compliance program?

Colorado is one piece of a broader regulatory picture. NYC LL 144, California FEHA, Illinois HB 3773, and Connecticut's CART Act each require different but overlapping measures. Organizations that build a unified compliance infrastructure, rather than reacting to each law in isolation, save time and reduce legal risk. Warden AI helps companies navigate this landscape with independent AI assurance services that certify systems for fairness, compliance, and defensibility across jurisdictions.

Talk to the Warden AI compliance team about your organization's readiness for the AI regulatory environment.

‍

Colorado SB 26-189 Enforcement and Litigation FAQs

SB 26-189 was signed on May 14, 2026, and takes effect January 1, 2027. The April 2026 federal court stay pauses enforcement of Colorado's AI law, and the Colorado Attorney General has said it will not enforce the original law or its replacement until rulemaking concludes. The effective date has not changed, so organizations should plan to be ready by January 1, 2027 regardless of the litigation.

The April 27, 2026 stay was entered against SB 24-205, but its terms cover any legislation replacing or amending that law, which includes SB 26-189. The Attorney General has confirmed it will not enforce either statute until rulemaking is complete, and xAI has signaled a new motion targeting SB 26-189 directly. The enforcement pause is therefore best understood as covering the replacement law as well.

No. The pause is procedural and temporary, and it has not changed SB 26-189's January 1, 2027 effective date or the Colorado rulemaking that will define its duties. Other laws remain fully in force: NYC LL 144 requires annual bias audits, California FEHA took effect October 1, 2025, Illinois HB 3773 took effect January 1, 2026, and Connecticut's CART Act adds transparency duties. Federal Title VII liability applies nationwide. Litigation in one state does not eliminate multi-state obligations.

The case creates uncertainty about whether states can enforce AI laws in the face of federal preemption arguments, and the enforcement pause currently reaches SB 26-189. The law's substantive duties have not changed, so vendors and employers should keep building disclosure, human review, and bias monitoring capabilities. Those measures support compliance however the litigation resolves and also satisfy overlapping requirements under other state and federal law.

SB 24-205 was a broad high-risk AI system framework modeled on the EU AI Act, with a duty of care, risk management program, and impact assessments, and a June 30, 2026 effective date that was stayed by federal court action. SB 26-189 replaces it with a narrower ADMT framework focused on notice, disclosure, and human review rather than mandated impact assessments. It was signed May 14, 2026 and takes effect January 1, 2027.