AI Decision Rules on 1 January 2027: What Colorado and California Now Require

The original law, SB 24-205, was due to apply on 1 February 2026. A 2025 bill pushed that to June 2026, as summarized by Baker Botts. It never took effect. On 14 May 2026 the governor signed SB 26-189, which repeals the earlier law and replaces it from 1 January 2027, according to a Davis Wright Tremaine alert.

The same alert lists what was removed: the risk-management program, impact assessments, the duty of care and the notices to the Attorney General that were tied to high-risk AI systems. What remains is a set of duties that look like paperwork and process.

Enforcement sits with the Attorney General under the state consumer protection law. There is no private right to sue. A 60-day period to fix a violation applies until 1 January 2030. The alert gives no penalty amounts.

The California Privacy Protection Agency's regulations on automated decision-making technology, risk assessments and cybersecurity audits took effect on 1 January 2026. Hunton's summary says businesses using the technology for significant decisions, which include employment decisions, must comply with the specific requirements by 1 January 2027. Those are a pre-use notice, an opt-out that can be submitted in at least two ways, and access.

A separate set of rules already applies to employers. Civil Rights Council regulations on automated-decision systems took effect on 1 October 2025. Mayer Brown reports that employers must keep related records, such as inputs, outputs and selection criteria, for four years, up from two.

So a California employer has two sources to read. Whether your tool counts, and whether your business is covered by the privacy law, are questions for counsel.

Illinois HB 3773 has applied since 1 January 2026. As summarized by Hinshaw, it makes discriminatory use of AI in hiring, promotion, discipline and similar decisions a civil rights violation, and it makes failing to give notice of AI use a separate violation. It does not require a bias audit.

What a compliant notice looks like is undefined. Seyfarth reports that the Illinois Department of Human Rights published proposed notice rules on 15 May 2026 and withdrew them on 2 June 2026. The statute still applies without them.

New York City Local Law 144 has been in force since July 2023. A New York State Comptroller audit published in December 2025, covering July 2023 to June 2025, called enforcement ineffective and found the city agency had received two complaints about automated hiring tools in that period.

Addleshaw Goddard reports that the EU adopted its Digital Omnibus on AI in 2026. It was published as Regulation (EU) 2026/1744 on 24 July 2026 and entered into force on 27 July 2026.

Stand-alone high-risk obligations, which include systems used in employment and worker management, now apply from 2 December 2027. Obligations for AI built into regulated products apply from 2 August 2028.

In Mobley v. Workday, a California federal court preliminarily certified an age-discrimination collective in May 2025 for applicants aged 40 and over. CDF Labor Law reports that in June 2026 the court largely denied a motion to dismiss the latest complaint and let California state-law claims proceed, and that a class motion is pending.

Kistler v. Eightfold AI, filed in January 2026, alleges that candidate scores are consumer reports under the Fair Credit Reporting Act, which would bring disclosure, authorization and dispute rights. Jones Walker reports that Eightfold denies this. The research found no ruling.

Neither case has been decided, and both are aimed at vendors.

Colorado's first law was delayed and then repealed before it applied. Davis Wright Tremaine reported that xAI said it would file a new motion for a preliminary injunction against the replacement law by 11 June 2026, and that a ruling in its favor could delay the effective date. The research behind this article found no outcome for that motion.

The Colorado Attorney General must also adopt rules on the format of adverse-outcome disclosures by 1 January 2027. The research could not confirm that those rules are finished.

The sensible reading is that the duties are likely and the date is not guaranteed. Notices and records are cheap to prepare and are useful under every version of these rules, including the California ones.

Ask counsel which of these steps your business is bound by.

• List each tool that scores, ranks or screens people, and the decision it feeds.
• Draft a pre-use notice that says an automated tool is used and what it is used for.
• Draft an adverse-outcome notice and set a 30-day clock for Colorado decisions.
• Name the person who carries out human review, and write down how someone asks for it.
• Set up a way to correct personal data, and for California an opt-out with two ways to submit it.
• Keep each notice with the date, the person and the version of the wording, for at least three years in Colorado and four years for California employment records.
• Check that notices can be read by people with disabilities and by people with limited English.