Two sets of rules take effect on the same day. Colorado's SB 26-189, signed in May 2026 to replace the 2024 law a federal court had blocked, requires notice before AI is used in a consequential decision about a person, a plain-language explanation when the outcome goes against them, a way to correct the data and ask for human review, and records kept for three years. California's CPPA regulations on automated decision-making technology require notice, an opt-out, access to the logic used, and written risk assessments for uses that affect employment and other significant decisions.
Neither law cares whether the AI came from a vendor or was built in-house, and neither is satisfied by a policy alone. You need to know which decisions AI touches, who gets told, what they are told, and who reviews the outcome. Illinois has asked similar questions since January 2026, California's employment regulations since October 2025, and Texas since January 2026. Federal guidance on AI in hiring was withdrawn in 2025; Title VII, the ADA, the ADEA and the NLRA still fully apply.
Who this reaches
The obvious cases are hiring tools and performance software. The less obvious ones are the places AI has crept in quietly: a benefits administrator using a model to flag claims for review, a training center using a scoring tool to rank applicants, a dispatch office letting software suggest who gets the call, an HR platform that “summarizes” a disciplinary file. If a model reads about a person and a decision follows, you are in scope, even if a human signs the form.
The inventory is the whole game
The practical first step is an inventory: every place AI reads about a person and every decision it informs. Most organizations find fewer than ten. That list is what the notice, the review rule and the records all hang from. For each item, write down four things: what the system does, what data it sees, what decision follows, and who can overrule it. If you cannot answer the fourth question, that is your first fix.
A 90-day plan
Days 1–30: build the inventory, ask each vendor in writing how their tool makes its recommendation and what they will give you when a person asks for an explanation. Days 31–60: write the notice language and the human-review procedure, decide who owns it, and put it in the AI use policy. Days 61–90: brief the people who will handle requests, set up the record-keeping, and run one tabletop: a member or employee asks why the software said no. If that walk-through takes more than a day to answer, you are not ready.
What to ask vendors now
Ask for the explanation they will provide for an adverse outcome, in the words a person will read. Ask for their bias testing and when it was last run. Ask what they retain and for how long. Ask how a human review is triggered and recorded in their product. A vendor who cannot answer these before the end of the year is a vendor whose contract you should be reading closely.
This is a summary, not legal advice. We work alongside your counsel and put what they decide into the policy and the build.
Share this note
Forward the link, or email it to the person who should read it: send by email.