Colorado Automated Decision-Making Technology Act / SB 26-189
January 1, 2027
Status: SB 26-189 repealed and re-enacted Colorado's prior AI provisions. Rules are pending; confirm final requirements before relying on this summary.
Who's Affected
Developers and deployers of automated decision-making technology used to materially influence consequential decisions affecting Colorado consumers. Final scope and implementation details may depend on pending rules.
Documentation Areas
- Technical and system documentation for covered automated decision-making technology
- Risk management and governance records
- Consumer notice and post-adverse outcome disclosure records
- Meaningful human review or reconsideration records, where applicable
- Record retention and review history
- Rulemaking and implementation tracking before January 1, 2027
Penalty reference
Colorado Consumer Protection Act enforcement may apply. Penalty amounts, cure opportunities, and enforcement outcomes depend on final rules, the facts, enforcement authority, and applicable legal analysis.
Pending Rules
Treat this as a tracking milestone, not a settled final-rule checklist.
EU AI Act - Article 50 and High-Risk Milestones
2026-2028
Status: Active regulation with phased application. Article 50 transparency obligations apply August 2, 2026. Certain Article 50(2) pre-existing-system transitions run to December 2, 2026. Annex III high-risk system obligations apply December 2, 2027. Annex I product-embedded high-risk system obligations apply August 2, 2028, where applicable.
Who's Affected
Providers and deployers of AI systems serving EU users, including systems subject to Article 50 transparency obligations and systems in Annex III high-risk domains (biometrics, critical infrastructure, education, employment, essential services/credit scoring, law enforcement, migration, justice/democracy). Timing depends on the obligation and system category.
Documentation Areas
- Annex IV technical documentation (9 sections: system description, design specs, data requirements, human oversight, predetermined changes, validation/testing, risk management, standards mapping, post-market monitoring)
- Risk management system (Article 9)
- Data governance procedures (Article 10)
- Conformity assessment (self-assessment or third-party per Annex VI/VII)
- EU database registration (Annex VIII fields)
- Post-market monitoring plan (Article 72)
- Serious incident reporting protocol (Article 73)
- CE marking and EU declaration of conformity
- Transparency disclosures and implementation records, where Article 50 applies
Penalty reference
Up to €35M or 7% of global turnover for prohibited practices. Up to €15M or 3% for high-risk non-compliance. Penalty amounts and enforcement outcomes depend on the facts, enforcement authority, and applicable legal analysis.
CPRA ADMT (California)
January 1, 2027
Status: Regulations effective January 1, 2026. Risk assessment compliance begins January 1, 2026. Submission deadlines are phased: April 1, 2028 / 2029 / 2030 depending on annual revenue.
Who's Affected
Any CCPA "business" (for-profit, doing business in CA, meeting revenue/data volume thresholds) using automated decision-making technology for "significant decisions" (financial/lending, housing, education, employment, healthcare) affecting California consumers.
Documentation Areas
- Pre-use consumer notice (purpose, how ADMT works, outputs, alternative process)
- Opt-out mechanism (or documented exception: human appeal, admission/hiring, work allocation)
- Consumer access rights response procedures
- Risk assessment report (purpose, impacts, safeguards, governance signoff)
- Risk assessment 3-year review cycle with 45-day material change updates
- Annual metrics compilation and disclosure (if processing PI of 10M+ consumers)
- Anti-dark pattern UI testing documentation
- Executive management attestation for risk assessment submissions
Penalty reference
Standard CCPA enforcement - up to $7,500 per intentional violation. Penalty amounts and enforcement outcomes depend on the facts, enforcement authority, and applicable legal analysis.
Key Nuance
ADMT = computation + personal information + replaces or substantially replaces human decision-making. Advertising is explicitly excluded. Human involvement (3-part AND test) can take you out of scope.
NYC Local Law 144
Already Enforced
Status: Active DCWP enforcement. Effective July 5, 2023.
Who's Affected
Employers and employment agencies using automated employment decision tools (AEDTs) for hiring or promotion decisions in New York City.
Documentation Areas
- Annual independent bias audit (selection rate and impact ratio by race/ethnicity and sex)
- Published bias audit summary on employer's website
- Candidate notice (at least 10 business days before AEDT use)
- Data type disclosure (what data the AEDT collects and analyzes)
- Alternative process disclosure (how candidates can request alternative selection)
- Records retention for bias audits (minimum 4 years under DCWP rules)
Penalty reference
$375–$1,500 per violation (first offense: $500). Each day of non-compliance with notice = separate violation. Each person not notified = separate violation. Penalty amounts and enforcement outcomes depend on the facts, enforcement authority, and applicable legal analysis.
Illinois AI Employment Laws (AIVIA + HB 3773)
Already Enforced
Status: Both laws active. AIVIA: January 1, 2020. HB 3773: January 1, 2026.
Who's Affected
AIVIA - any employer using AI to analyze video interviews in Illinois. HB 3773 - any employer using AI for employment decisions (screening, evaluation, discipline, termination) in Illinois.
Documentation Areas (AIVIA)
- Pre-interview notice (AI analysis disclosed before interview)
- Applicant consent (affirmative consent required before AI analysis)
- Video deletion process (within 30 days of applicant request)
- AI provider attestation or supporting records
Documentation Areas (HB 3773)
- Notice to employees and applicants when AI is used in employment decisions
- Prohibition on using AI in a way that results in unlawful discrimination based on protected characteristics
Documentation Areas (Both)
- Demographic data collection and reporting to IDCEO - applies only when an employer relies solely on AI video interview analysis to determine whether an applicant receives an in-person interview
- Bias monitoring measures
Penalty reference
Enforced through Illinois Human Rights Act and Illinois Department of Labor. Civil penalties vary. Penalty amounts and enforcement outcomes depend on the facts, enforcement authority, and applicable legal analysis.
Berly