Episode Details

Colorado’s legislature killed its own flagship AI statute before it ever took effect. The Colorado AI Act, Senate Bill 24-205, was supposed to start governing employment screening tools on June 30, 2026, after an earlier delay pushed it from its original February 1, 2026 date. Instead, Governor Jared Polis signed SB 26-189, the Automated Decision-Making Technology Act, on May 14, 2026, repealing the mandatory impact assessment program and replacing it with a narrower notice and human review model that does not take effect until January 1, 2027. A startup that spent 2026 building a Colorado specific risk assessment program built it for a law that no longer exists.

That is the environment a founder using AI to screen resumes, score interviews, or monitor employee performance is actually operating in: three states, three different statutes, three different effective dates, and a regulator in at least one of them, Illinois, that has not finished writing the rules its own statute requires. Illinois’ amendment to the Human Rights Act, codified at 775 ILCS 5/2-102(L), took effect January 1, 2026, and the Illinois Department of Human Rights withdrew its proposed implementing rules on June 2, 2026 without naming a new date. The statute binds employers anyway. There is no safe harbor for waiting on a rule that has not been written.

The question every founder asks first is whether any of this applies if a human still makes the final call. It does. None of the three states conditions its core obligations on the AI tool being the sole decision maker. Illinois’ notice duty attaches whenever an AI output is merely capable of influencing a covered decision, a standard broad enough to cover a resume ranking tool that a recruiter reviews before deciding anything. Colorado’s original substantial factor test asked whether AI generated content was capable of altering the outcome, and its replacement under SB 26-189 asks whether a covered technology materially influences the decision, again without requiring exclusive control. California’s Civil Rights Council regulations, effective October 1, 2025 at 2 California Code of Regulations sections 11008 and 11009, define an automated-decision system as one that makes a decision or facilitates human decision making, expressly folding in the advisory scoring tool that most employers actually buy.

The three states do diverge on what attaches once coverage is triggered, and that divergence is where the real compliance cost sits. California does not mandate a bias audit. It makes the presence or absence of antibias testing relevant to a discrimination claim and its defenses under section 11008.1, which functions as a market incentive rather than a legal command, but it pairs that incentive with an expanded definition of covered agent reaching any vendor that performs screening functions on an employer’s behalf, and a recordkeeping period stretched from two years to four. Illinois takes the opposite structure: a flat notice duty paired with an absolute ban on using zip code as a race or national origin proxy, a prohibition the statute makes clear a disclosure cannot cure. Colorado’s new law lands in the middle, requiring clear notice before use, a 30 day plain language explanation after an adverse outcome, and a right for the affected individual to request meaningful human review where technically feasible, performed by someone with actual authority to override the system rather than rubber stamp it.

Federal litigation is now supplying the theory that connects all three regimes to the vendor itself alongside the employer. In Mobley v. Workday, Judge Rita Lin ruled on March 6, 2026 that an employer cannot escape Title VII, ADEA, and ADA liability by routing a hiring function through a third party platform, holding that Workday can be treated as the employer’s agent for discrimination purposes and that the ADEA protects outside applicants as well as existing employees. The court condi