What Denver Employers Actually Have to Do Under Colorado's AI Hiring Law
Colorado's SB 24-205 takes effect February 1, 2026. Here's what the disclosure requirements, impact assessments, and candidate notification rules mean for your HR department — and why CDLE is the w…
Colorado’s SB 24-205 takes effect February 1, 2026. Here’s what the disclosure requirements, impact assessments, and candidate notification rules mean for your HR department — and why CDLE is the wrong agency to be watching.
Picture this: A recruiting manager at a RiNo software company is working through hundreds of applicants for a mid-level engineering role. She’s using HireVue to conduct asynchronous video interviews, and the platform’s behavioral scoring algorithm is ranking candidates before any human reviews a single resume. She’s heard vaguely about some new state AI law but assumes it applies to big corporations, not a smaller shop in Denver’s tech corridor.
As of February 1, 2026, she’ll be wrong. Her company will be out of compliance on at least three separate requirements.
Colorado’s SB 24-205, signed by Governor Polis on May 17, 2024, is one of the most specific AI hiring laws in the country. It requires employers to disclose AI use to candidates before it happens, conduct annual impact assessments of high-risk tools, and provide a meaningful path for candidates to challenge automated decisions. Civil penalties are attached. This is enforceable law, not a best-practices framework.
This piece is for the HR director, the in-house counsel, and the operations manager at Denver firms who have been searching for a straight answer on what compliance actually looks like — not a law firm’s lead-generation page, not coverage written for job seekers. What follows is what the law requires, which tools trigger it, what enforcement looks like heading into the effective date, and what your business needs in place before February 1.
The Law Itself and Who Actually Enforces It
SB 24-205 is codified under Colorado Revised Statutes § 6-1-1701 et seq., placing it within Colorado’s Consumer Protection Act framework. That statutory home matters enormously because it determines who can bring enforcement actions.
The enforcing agency is the Colorado Attorney General’s office at 1300 Broadway in Denver. Not the Colorado Department of Labor and Employment. This distinction is being blurred in nearly every piece of published coverage — including client alerts from national employment law firms that should know better. CDLE handles wage theft, labor standards, and workplace safety. It has no primary enforcement role under SB 24-205. HR departments monitoring CDLE’s website for AI hiring guidance are watching the wrong agency. Full stop.
The AG’s office spent 2024 and into 2025 conducting stakeholder listening sessions across the state. Some definitional questions remain unsettled pending final regulations — what constitutes a “material change” to an AI system, what format requirements apply to candidate disclosures. This is genuinely frustrating if you’re trying to build a compliance program right now, but the unsettled questions are narrow. The core obligations are clear.
Employers should bookmark coag.gov and monitor the AG’s rulemaking dockets directly. The AG’s approach through 2025 has been explicitly educational — the law hasn’t taken effect yet, and no enforcement actions have been brought under SB 24-205. Once February 1 arrives, the AG’s Consumer Protection Division will be positioned to receive complaints and investigate violations. That educational window is closing.
Which Hiring Tools Are Actually in Scope
The statute answers the threshold question through a two-part definition: a covered tool must be (1) a “high-risk AI system” that (2) makes or substantially influences a “consequential decision.”
A “consequential decision” in the employment context includes hiring, promotion, termination, and compensation. The filtering question is whether a given tool qualifies as a “high-risk AI system” — defined as a system that makes, or is a substantial factor in making, decisions with a significant effect on individuals, using machine learning, neural networks, or similar techniques to process personal data.
Standard ATS keyword filters are almost certainly not in scope. A boolean filter that flags resumes containing “Python” or “five years of experience” is executing a rule a human wrote. The statute targets systems that derive scoring or ranking from personal data.
AI-assist add-ons are a different picture. Greenhouse resume ranking and Lever Talent Intelligence both use machine learning to score candidates against job requirements. When those features are active and influencing which candidates advance, you’re deploying a high-risk AI system for a consequential employment decision. These are opt-in features, not defaults — which means employers who haven’t audited their ATS configuration may not know whether they’re running covered tools right now. Worth sitting with for a moment.
HireVue behavioral and cognitive video scoring is clearly in scope. The system analyzes facial expressions, vocal patterns, word choice, and response content to generate candidate scores, and it’s explicitly designed to rank and screen. HireVue has published bias audit documentation in anticipation of multi-state AI hiring regulations, which suggests the company knows exactly which way this is going. If your company is using HireVue beyond simple recorded video storage — if scores or rankings are being generated — you’re covered.
AI-scored personality assessments, cognitive tests, and cultural-fit tools also trigger the law. Products that process candidate responses and generate scores influencing hiring decisions fit the definition regardless of what the vendor calls them.
The “substantial factor” language is the unresolved edge case. When a recruiter receives an AI-generated ranking but makes the actual screening call independently, does the AI score constitute a substantial factor? Nobody has a clean answer yet. The AG’s rulemaking is expected to address it. Until it does, the cautious interpretation — and the one most Denver employment attorneys are recommending — is to treat any AI-generated score that a human reviewer sees before making a decision as a substantial factor. The final rule may allow more flexibility. But “the final rule might let us off” is a terrible compliance posture.
[Editor’s note: The resolution of the “substantial factor” standard in AG rulemaking and any updated vendor compliance documentation from HireVue, Greenhouse, and Lever should be confirmed against current coag.gov filings before final publication.]
What You Must Tell Candidates and When
The disclosure obligation is where many Denver employers are most exposed. It’s also, bluntly, the most straightforward compliance work if you actually do it.
The required notice must come before the AI tool is used. Not at the point of rejection. Not buried in a general privacy policy. Before.
Four specific elements are required. First, candidates must be told in advance that an automated system will play a role in evaluating their application or interview. A generic “we use technology in our hiring process” statement doesn’t satisfy this. Second, you must specify what role the AI plays — what is the tool actually doing? Scoring video responses? Ranking resumes? Generating a fit score? The notice must be specific enough that a candidate understands what the system is doing to their application. Third, disclose the categories of personal data being processed. If HireVue is analyzing facial expressions and vocal patterns, say so. If a resume-ranking system is analyzing work history and education, list those categories. Fourth, candidates must understand their right to appeal or request human review if they receive an adverse decision.
The most sensible place to surface this notice is at the point of application, before any AI tool touches the candidate’s data. For employers using HireVue, that means the notice should appear before the candidate begins the video interview — on the invitation landing page or in the initial instructions screen. For ATS-based ranking tools, it belongs in the job application flow itself.
The appeal mechanism requires more process design than most HR departments have considered. What does a candidate actually do when they receive a rejection? Is there a dedicated email address? A form? A phone number reaching someone with authority to pull the file and conduct a genuine human review? A web form routed to an unmonitored shared inbox is not a compliant appeal mechanism. It’s a liability dressed up as a process.
What an Impact Assessment Actually Contains
The annual impact assessment is the obligation most employers have heard of and least understand. Here’s what the statute requires deployers — the Denver employer using the AI tool, not the developer who built it — to document.
You need to identify the system’s intended purpose and use. Not the vendor’s marketing description. Your documented understanding of why you chose this tool and how it fits your workflow. You also need the system’s known limitations and error rates. Vendors are required to supply technical documentation to deployers, including performance data across demographic groups and known failure modes. If HireVue or a comparable vendor hasn’t provided this, requesting it is a required step. A vendor’s refusal to supply technical documentation is itself a compliance signal — and not a reassuring one.
Your assessment should detail which consequential employment decisions the AI system influences: initial screening, interview selection, offer generation, or all three. Document the steps you’ve taken to address algorithmic discrimination — what has the employer actually done to identify and reduce the risk that the AI system produces biased outcomes across protected classes? This might include reviewing vendor bias audit results, limiting the tool’s use to specific stages, or building in mandatory human override checkpoints.
Document your data governance and monitoring measures: how candidate data is collected, stored, and protected, and what ongoing monitoring you’re doing to detect whether the AI system’s outputs are shifting or producing disparate results over time.
The minimum cadence is annual, but a new assessment is required when a material change is made to the AI system — a definition the AG has not yet fully operationalized. This matters practically because platforms like HireVue push product updates on their own schedules. A significant algorithmic update could require a new assessment. Employers who aren’t monitoring vendor release notes may not know when that threshold has been crossed. Build a vendor notification requirement into your contract language now, before the clock starts.
The developer-versus-deployer distinction is worth emphasizing. HireVue, Greenhouse, and Lever are developers. Your company is the deployer. Developers must supply technical documentation; deployers must conduct impact assessments using that documentation. If your vendor isn’t explaining how their AI works, providing error rates, and sharing bias testing results, you can’t build a compliant impact assessment. Start asking why they’re not providing it.
The Enforcement Picture Heading Into the Effective Date
The law takes effect February 1, 2026. No enforcement actions have been brought under SB 24-205 — nor could they be, since the law isn’t operative yet. That pre-enforcement window is narrowing faster than most Denver employers seem to realize.
Once the effective date arrives, the AG’s Consumer Protection Division will be empowered to investigate complaints and bring civil actions. Civil penalties under the Colorado Consumer Protection Act framework run up to $20,000 per willful violation.
[Editor’s note: Before publication, the $20,000 figure must be confirmed as per-violation rather than per-affected-candidate. The distinction is material to any characterization of employer risk exposure. Confirmation from AG’s office or statute text is required.]
The AG’s enforcement mechanism means this law can be triggered by individual candidate complaints, not just agency audits. A candidate who was screened out by an AI system, wasn’t told about it, and couldn’t find an appeal mechanism has a clear path to the AG’s office at 1300 Broadway. Denver’s hiring market for software engineers and healthcare workers involves exactly the kind of candidates sophisticated enough to know this law exists and use it. These are people who read legislation. The time to build a documented compliance posture is before February 1 — not after the first complaint lands on the AG’s desk during a Q1 hiring push.
[Editor’s note: On-record quotes from Fisher Phillips at 1125 17th St. or Ogletree Deakins at 1700 Lincoln St. are required before publication. At minimum, one Denver employment attorney should speak on record about how they’re advising clients on documentation posture ahead of the effective date.]
Does This Law Apply to Your 12-Person Business
Direct answer: the final version of SB 24-205 contains no small-employer exemption by headcount. Early drafts included size-based carve-outs; those provisions were removed before the bill passed.
[Editor’s note: Confirm no small-employer safe harbor was added post-signing, either in a subsequent amendment or in AG rulemaking. Check current codified statute text.]
The practical filter is definitional, not numerical. A 12-person Denver business using standard Greenhouse with manual human review at every stage is almost certainly not covered — their tool isn’t making scored decisions using machine learning. A 12-person Denver business using HireVue video scoring or an AI-powered personality assessment is inside the law’s scope regardless of headcount. Most small employers are asking the wrong question. They’re thinking about size when they should be thinking about tools.
Three questions that will tell you where you stand:
Does any part of your hiring process use a tool that generates a score, rank, or recommendation about a candidate using machine learning or algorithmic analysis? If yes, you’re likely covered. Is that score or recommendation seen by anyone before a hiring decision is made? If a human decision-maker sees an AI-generated ranking at any point, the AI is almost certainly a substantial factor. Did your vendor describe their product using words like “AI-powered,” “machine learning,” “predictive,” “automated screening,” or “intelligent matching”? If yes, request their technical documentation and treat yourself as a potential deployer under the statute until you can confirm otherwise.
[Editor’s note: An on-record quote from a Denver HR director at a mid-size firm — a Colorado SHRM state council contact is the recommended starting point — on how they made the threshold determination internally is required before publication. This section needs a practitioner voice.]
What Denver Employers Should Do Before February 1, 2026
The work is urgent but manageable if it’s sequenced correctly. There’s time to build a defensible compliance posture. There’s no time to wait.
Audit your hiring stack first. Go through every tool your HR team uses: ATS configurations, interview platforms, assessment vendors, any software that touches candidate data between application and offer. For each tool, determine whether AI-powered scoring or ranking features exist and whether they’re active. This is where many Denver employers will be surprised. AI add-ons in platforms like Greenhouse and Lever are opt-in features that may have been activated without deliberate review — turned on during a demo, enabled by a vendor rep, and never revisited.
Request technical documentation from your vendors in writing. Under the statute, developers must provide deployers with documentation about how their AI systems work, including performance data and bias testing results. Send a written request to your account representative specifically asking for SB 24-205 compliance documentation. Document that you requested it and when. A vendor’s inability or unwillingness to provide this is important information — both about your compliance posture and about the vendor.
Draft your candidate notice with specificity. Write plain-language disclosure language that covers all four required elements. Have legal counsel review it. Identify precisely where in your application and interview flow the notice will appear and document the delivery process.
Design a real appeal process. That means a named contact, a defined response time, and someone with actual authority to conduct a human review when a candidate requests one. A web form that goes nowhere isn’t compliant. It’s a liability.
Conduct your first impact assessment. If you don’t have compliance counsel or internal bandwidth, get help. Employment law firms in Denver — Fisher Phillips at 1125 17th St. and Ogletree Deakins at 1700 Lincoln St. are among the largest local presences — are building templated assessment processes for Colorado clients. As part of our business & professional coverage, we’ve tracked how Denver small employers are managing other new state mandates; how Denver small employers are managing Colorado FAMLI costs offers a useful parallel on building internal compliance systems for unfamiliar state obligations. The annual assessment isn’t a legal opinion. It’s a documented review of your AI tools, their limitations, and your mitigation steps. Do it on a calendar now so the habit is already built when the law takes effect.
Set a coag.gov alert for final AG rulemaking. Outstanding definitional questions on material changes, disclosure format, and the substantial-factor standard will be resolved in published rules. When those rules drop, your compliance program may need updating. The AG’s published rulemaking dockets are faster and more authoritative than waiting for a law firm’s client alert.
Local resources worth knowing: the Colorado SHRM state council has been actively tracking SB 24-205 and is a practical resource for HR professionals who want peer perspective on implementation. The Denver Metro Chamber of Commerce has addressed the law in member programming.
Denver’s tech, healthcare, and professional services employers are the first wave of compliance test cases under a law being watched nationally. A candidate complaint landing on the AG’s desk during your busiest quarter is a genuinely terrible way to learn about a law that’s been on the books since May 2024. The effective date is fixed. The preparation window is not.
CityDesk Denver will update this piece as AG rulemaking is finalized. Employers with questions about the statute can contact the Colorado AG’s Consumer Protection Division at 1300 Broadway, Denver, CO 80203. Corrections, on-record comments, or additional practitioner sources may be submitted to the editors.
