Colorado’s AI Law Stays On Track After Efforts To Change It Fail
In 2024, Colorado became the first U.S. state to pass comprehensive AI regulation with the Colorado Artificial Intelligence Act (SB205), targeting "high-risk" AI systems used in critical areas like employment, housing, and healthcare. The law mandates transparency, risk assessments, and consumer disclosures to combat algorithmic discrimination, with compliance required by February 1, 2026. While hailed as groundbreaking, the law has also sparked debate over its complexity and potential impact on innovation.
Colorado made history in 2024 by becoming the first state in the nation to enact comprehensive regulation of artificial intelligence. Senate Bill 24-205 (SB205), also known as the Colorado Artificial Intelligence Act (CAIA), established detailed compliance obligations for developers and users of "high-risk" AI systems operating in employment, housing, finance, health care, education, and essential government services.
The CAIA was intended to address concerns about algorithmic discrimination, requiring transparency, risk assessments, consumer disclosures, and risk mitigation by February 1, 2026. For employers using AI in hiring, the law introduced a sweeping new compliance landscape. While it was widely seen as a pioneering move, it also raised concerns about complexity, innovation, and unintended consequences.
Governor Polis' Reluctant Endorsement and Call for Change
When Governor Jared Polis signed SB205 into law, he did so with notable hesitation. In his signing statement, Polis warned that the law creates a "complex compliance regime" that could "tamper with innovation and deter competition" by imposing heavy burdens on developers and deployers operating in Colorado or interacting with Colorado residents. He urged Congress to step in with federal regulation to prevent a patchwork of state AI laws that could stifle technological advancement across industries.
Polis also highlighted a unique concern: the CAIA deviates from traditional discrimination frameworks by prohibiting all discriminatory outcomes from AI systems, regardless of intent. He encouraged Colorado lawmakers to reexamine this standard before the law’s 2026 effective date.
In a rare public letter co-signed by Governor Polis, Attorney General Phil Weiser, and Senate Majority Leader Robert Rodriguez, state leaders acknowledged the risks tied to the CAIA’s broad definitions and disclosure requirements. They pledged to minimize unintended consequences and encouraged future refinements to protect innovation while ensuring fairness.
SB25-318: A Measured Response That Fell Short
In 2025, legislators introduced Senate Bill 25-318 (SB318) as an attempt to refine and soften SB205 before its effective compliance date. SB318 proposed thoughtful amendments, including narrowing the definition of "algorithmic discrimination" to violations of existing anti-discrimination laws, carving out exemptions for small businesses and open-source AI developers, clarifying appeal rights and disclosure obligations, easing requirements for companies using AI solely for recruitment and hiring of external candidates, and providing a critical exemption for AI systems producing consumer reports governed by the Fair Credit Reporting Act (FCRA).
For background screening companies and employers who rely on AI-assisted background checks, these changes were meaningful. SB318 recognized that services already regulated under the FCRA should not face duplicative AI compliance obligations and that employment decisions made with meaningful human review differ fundamentally from fully automated systems.
Attorney General Phil Weiser, testifying before the Senate Business, Labor, and Technology Committee, warned that Colorado risked "moving ahead too quickly in a complex area" and recommended delaying the law’s implementation by a year to avoid "unintended consequences" and protect the state's competitiveness in emerging technology sectors.
Despite broad support from stakeholders across sectors, the proposed fix failed to gain consensus. On the final day of its committee hearing, Senator Rodriguez asked for SB318 to be postponed indefinitely, citing a lack of agreement and insufficient time to resolve complex concerns. Without legislative fixes, Colorado employers and AI developers must now prepare to comply with the original, more expansive law by February 1, 2026.
Where the Colorado AI Act May Offer Relief for Employers Using Background Checks
Despite its challenges, the Colorado Artificial Intelligence Act provides several important safeguards for employers and background screening companies. Most notably, enforcement authority rests exclusively with the Colorado Attorney General. By excluding private rights of action, the law spares businesses from the added litigation risks often associated with emerging regulatory regimes. In addition, the law allows companies to assert an affirmative defense by showing that they identified and cured violations through internal processes, encouraging proactive compliance efforts rather than penalizing good-faith mistakes.
The Act also focuses its strictest obligations on AI systems that serve as the principal basis for consequential decisions without meaningful human involvement. This structure suggests that traditional background screening tools, which typically involve a human review of findings before an employment decision is made, may fall outside the most burdensome requirements. Under the Colorado Artificial Intelligence Act, the distinction between providing information to inform a decision and making the decision itself is critical. A consumer reporting agency that supplies background check reports, particularly under the Fair Credit Reporting Act’s procedural safeguards, generally does not act as the final decision-maker. Instead, employers retain discretion and must undertake individualized assessments before taking adverse action, preserving meaningful human involvement.
While Senate Bill 25-318 would have codified a clear exemption for systems governed by the Fair Credit Reporting Act, even without its passage, the law’s emphasis on final decision-making authority may point toward more favorable treatment for employment background checks that comply with federal consumer reporting standards. However, employers should not assume that FCRA compliance alone will shield them from all AI-related obligations. How AI systems are deployed, the level of human review involved, and the extent to which automated outputs influence final decisions will remain critical factors in determining compliance risks under the Colorado AI Act.
Areas of Compliance Concern for Employers and Consumer Reporting Agencies
While these statutory protections may ease some compliance burdens, employers and consumer reporting agencies must remain mindful of several significant risks under the Colorado Artificial Intelligence Act. The Act defines an "artificial intelligence system" broadly as any machine-based system that infers outputs from inputs, which risks capturing traditional automation tools and rules-based adjudication technologies not typically associated with adaptive learning or bias. Without a clear narrowing to machine-learning systems, background screening and compliance support tools could fall within the scope of regulation.
The definition of "high-risk" artificial intelligence systems also raises questions. Under the law, any AI system that substantially influences employment decisions could be deemed high-risk, even if the final decision involves meaningful human judgment. Employers using AI tools to assist in background checks or hiring assessments will need to carefully evaluate the level of human oversight embedded in their processes.
The law’s consumer disclosure requirements may create operational burdens as well. Employers must notify individuals when AI meaningfully influences a consequential decision and must explain the system's role in the decision-making process. Meeting these requirements will likely depend on AI vendors providing detailed technical disclosures, which could present challenges if vendors are unwilling or unable to share the necessary information.
Finally, recordkeeping requirements under the Act demand that companies retain documentation of impact assessments and risk management policies for at least three years after deploying a high-risk system. These obligations may impose additional recordkeeping burdens compared to existing federal standards under the Fair Credit Reporting Act or Equal Employment Opportunity Commission regulations, creating potential tension between state and federal compliance frameworks. Employers will need to align their documentation procedures carefully to avoid conflicting retention obligations.
Parting Thoughts
While Colorado’s pioneering law reflects important goals of fairness and transparency in AI use, the failure to adopt SB318 leaves employers with significant compliance uncertainty. The original law’s breadth risks capturing low-risk technologies and could dampen innovation in hiring, screening, and HR technology.
Employers using AI, whether directly or through third-party vendors, must take proactive steps now. Reviewing AI risk management practices, ensuring human oversight of decision-making processes, and preparing robust disclosures will be essential ahead of the February 1, 2026 deadline.
In the absence of federal intervention, Colorado's experience offers a preview of how states might shape the next chapter of AI regulation and why careful drafting will be key to balancing innovation with consumer protection.
Release Date: May 27, 2025
Alonzo Martinez
Alonzo Martinez is Associate General Counsel at HireRight, where he supports the company’s compliance, legal research, and thought leadership initiatives in the background screening industry. As a senior contributor at Forbes, Alonzo writes on employment legislation, criminal history reform, pay equity, AI discrimination laws, and the impact of legalized cannabis on employers. Recognized as an industry influencer, he shares insights through his weekly video updates, media appearances, podcasts, and HireRight's compliance webinar series. Alonzo's commitment to advancing industry knowledge ensures HireRight remains at the forefront of creating actionable compliance content.