Picture a $70 million distributor in Ohio. It posts jobs on its own careers page, and applications flow into the applicant tracking system it has used for six years. Last spring the vendor added a feature that ranks applicants by how well they match the job description, and the HR team turned it on because it saved hours. Nobody at the company thinks of it as an AI system. Nobody bought one. Then an applicant from Denver applies for a remote sales role.
Nobody at the company thinks of it as an AI system. Nobody bought one.
On January 1, two state rules take effect that may reach that company anyway, and the reason has less to do with law than with knowing what software you are running.
Two States, One Date
Colorado’s new law on automated decision-making technology, SB 26-189, was signed on May 14, 2026, replacing the state’s earlier and broader AI act before it ever took effect. Starting January 1, 2027, a business that uses software to materially influence a consequential decision about a person, including decisions about employment, housing, lending, insurance, health care, and education, has four core duties. It must give clear notice at the point the person interacts with the tool. After an adverse outcome, it must provide a plain-language description of the tool’s role within 30 days. It must let the person correct inaccurate personal data and request meaningful human review and reconsideration. And it must keep the records needed to show compliance for at least three years. The software’s developer, in turn, must give the business documentation of the tool’s intended uses, limitations, and how humans should review it. The state attorney general enforces the law as a deceptive trade practice, with a 60-day chance to cure violations until 2030, and there is no private right to sue under it.
California’s version arrives the same day through a different door. In September 2025, the state finalized regulations under its consumer privacy law covering automated decision-making technology, and businesses using it for significant decisions, including hiring, pay, promotion, work assignment, and termination, must comply by January 1, 2027. Those duties include a notice before the technology is used, a way for people to opt out in many cases, and a right to request information about how the tool reached its output. The California privacy law reaches businesses that do business in the state and meet its thresholds, the most common being annual revenue above $26,625,000 as adjusted for 2025, which describes a large share of the mid-market.
Neither state is alone. Illinois has required employers to notify workers about AI used in employment decisions since January 2026, California’s civil rights regulations on automated decision systems in employment took effect in October 2025, and New York City has regulated automated hiring tools since 2023. But January 1 is the date when two of the most demanding sets of duties start at once.
Where the Two States Draw the Line
The two states define covered software differently, and the difference matters. California’s rules apply to technology that replaces or substantially replaces human decision-making, which law firm summaries read as an output used to make a decision without meaningful human review. Colorado’s law applies when software materially influences a decision, which it describes as being a non-trivial factor that affects the outcome, including by ranking, scoring, or recommending.
In practice, that means a common defense, “a person makes the final call,” may carry weight in California and much less in Colorado, where a ranking that shaped which candidates a recruiter looked at can count even if a person signed off. That is our reading of the published summaries, not legal advice, and both states’ rules have exceptions and details that counsel should apply to your facts.
You May Not Have Bought AI, but You May Be Running It
The company in our opening picture is the common case. Most mid-market firms did not purchase AI hiring tools. They bought applicant tracking, scheduling, performance management, or compensation software, and over the last two years the vendors added features that screen, rank, score, or recommend. The feature may be on by default. It may have been switched on by a manager who liked the time savings. It rarely shows up in an IT inventory, because it arrived as an update to a system the company already owned.
Reach is the other surprise. Proskauer’s summary of the Colorado law notes that it applies to Colorado residents applying for or holding jobs, and concludes that with web-based applications, no employer can assume the law will not apply to it at all. A company with no office in Colorado can still receive a Colorado applicant on Monday.
A company with no office in Colorado can still receive a Colorado applicant on Monday.
What About Federal Preemption?
Federal action could change this picture, but as of this writing it has not. A December 2025 executive order directed the Justice Department to challenge state AI laws and asked Congress for a federal framework, and a bipartisan House discussion draft released in June 2026 would preempt some state laws on how AI models are built while leaving laws on how AI is used largely alone. Neither has produced a statute or a court ruling against these rules, according to the tracking we have seen. Our judgment is that planning as if both take effect on schedule is the safer course, because the work they require is work a well-run company should want done anyway.
What to Do in the Next Seven Weeks
Start with an inventory. List every tool that touches a decision about hiring, pay, promotion, scheduling, performance, or termination, including features inside systems you already own, and for each one, write down what it does with personal data and what it produces. Then ask the question both states turn on: does the output decide, or shape, the decision, and who reviews it before it takes effect?
Next, ask your vendors. Colorado’s law requires developers to give deployers documentation of a covered tool’s intended uses, limitations, and how humans should review it, so a request for that documentation is reasonable and will tell you quickly whether your vendor has done the work. Ask whether ranking or scoring features can be turned off or limited to administrative use.
Then build the minimum process. Draft the notices. Decide who writes the plain-language explanation after an adverse decision and how it gets out within 30 days. Set up a way to receive data corrections and a real human review path. Keep the records for three years. And decide, with counsel, whether to apply these practices to every applicant nationwide rather than sorting people by state, which is often simpler to run.
Finally, name an owner. Every one of these steps fails without a person who is accountable for the inventory and for keeping it current as vendors ship new features.
This Is a Governance Problem Wearing a Legal Label
None of the work above is exotic. It is an inventory, an owner, a review path, and a record, which is what governance is. The deadlines will keep moving; Colorado has already rewritten its law once, and other states are drafting their own. Our view, which we laid out in If Your Tech Budget Looks Like Last Year’s, You Missed the Turn, is that the thing to fund is not compliance with one rule but the capacity to comply with whichever rule arrives next. A company that knows which AI is running in its systems, who owns it, and how its decisions get reviewed can absorb the next state law in a week. A company that does not will rediscover its own software every time a regulator asks.
A company that knows which AI is running in its systems, who owns it, and how its decisions get reviewed can absorb the next state law in a week.
That is also why we treat governance as what lets a company move faster rather than slower, the idea behind Governance Is a Freeway, Not a Roadblock. The same inventory supports our Citizen AI and Production AI pipeline, where anything that touches a decision about a person belongs on the Production side, with an owner and a tested review path. If you want the full sequence, our 90-day pathway to passing an AI governance audit starts with exactly this inventory.
What This Will Not Do
This is not legal advice. It summarizes the Colorado statute’s official summary, California’s announcement of its regulations, and law firm analyses of both, and the details, exceptions, and thresholds should be applied to your situation by counsel. Colorado’s attorney general is due to issue rules on the adverse-decision disclosures by January 1, and those rules may change the specifics. The federal picture could shift. Our reading of where the two states draw the line, and our advice to apply one practice nationwide, are our judgment. What this article supports is a short, concrete task list that is worth doing whatever the courts or Congress decide.
Where to Start
This week, ask your HR and IT leads for one list: every tool that ranks, scores, screens, or recommends anything about an applicant or employee, and whether each feature is turned on. If that list takes more than a few days to produce, it is the finding. If you would like help building the inventory and the review process before January 1, our independent assessment can include this governance review. If you would rather talk it through first, you can reach us through the contact form on our About page.
