Correction, October 5, 2026: an earlier version said the comment period closed September 23. That date is when the Attorney General expected to post interim revisions. Comments and the hearing are October 26. We also have not confirmed the "by name" wording or the Rule 6.6 numbering against the current draft, so check coag.gov/ai before relying on either.
TL;DR: Colorado's draft Rule 6.6 would make employers name each source of personal data an AI tool used, when a candidate or employee asks after an adverse decision. The October 6 interim draft keeps the by-name rule but limits it to sources the employer knows, and sets a 15-day reply window. Comments close October 26, 2026.
If you use an AI tool to screen, rank or evaluate people for Colorado jobs, the Attorney General's draft rules expect you to be able to say where the tool's personal data came from, source by source. Ask your vendor for that list now; the October draft makes whatever the vendor tells you count as something you know.
What the law itself requires
Colorado's SB 26-189, signed May 14, 2026, applies to consequential decisions made from January 1, 2027. When an automated tool contributes to an adverse outcome, the employer (the "deployer") has 30 days to send a plain-language description of the decision and the tool's role. That notice must include a simple way to request more information, including the tool's name, version, developer, and "the types, categories, and sources of personal data used," to the extent the developer supplied that information.
The law reaches further than in-state hires. It covers employees, job applicants who are Colorado residents, and anyone whose opportunity in Colorado is evaluated by a business operating there. A tool is covered when its output is a non-de minimis factor that affects the outcome; incidental, trivial or clerical uses are not. Routine scheduling is excluded from consequential decisions.
The person can also ask to correct factually incorrect or materially inaccurate personal data and ask for meaningful human review, to the extent commercially reasonable. The statute has no impact assessment or bias audit duty.
What draft Rule 6.6 adds
The Attorney General filed proposed rules on August 11, 2026. Rule 6.6, "Deployer Responses to Consumer Requests Regarding Covered ADMTs," turns the statute's "sources of personal data" into a naming duty: "The description of the sources of Personal Data that were considered by the Covered ADMT must identify each source by name." The examples are specific data brokers, databases, courts, social media companies, schools and employers. If the data came through a data broker or aggregator, the employer must also give the original source.
The August text also required the information to be available immediately when the person clicks the link in the notice.
What the October 6 interim draft changed
The Attorney General released an interim draft on October 6. In it, the same rule is numbered 7.6 and three things moved:
| Point | August 11 proposed rules | October 6 interim draft |
|---|---|---|
| Rule number | 6.6 | 7.6 |
| Naming sources | Each source by name | Each source by name "when that information is known to the Deployer" |
| What you are presumed to know | Not addressed | Sources you received directly, sources your vendor used to run the tool for you, and sources the developer named to you |
| Data brokers | Original source | Original source plus any intermediary or vendor source, when known |
| Reply time | Immediately on clicking the link | Within 15 days |
The knowledge test sounds like relief, but it cuts both ways. Anything your vendor names to you, or uses to run the tool on your behalf, you are presumed to know. A vague vendor answer doesn't excuse you if the vendor ran the tool and knew the sources.
Both texts are drafts. The final rule could keep, loosen or drop the by-name duty.
3 checks before October 26
1. Ask each AI hiring vendor for a named source list, in writing. Ask which sources of personal data the tool considers when it scores, ranks or screens a person, by name, including any data broker and the broker's own sources. The statute ties your duty to what the developer gives you, and the interim draft treats what the developer names as known to you. A written answer is the record you'll need.
2. List the sources you feed in yourself. Background check providers, assessment vendors, your applicant tracking system and past employment records all count as sources you received directly. Write each one down against each tool, so a reply to a candidate takes hours, not a vendor ticket.
3. Test the reply process and decide whether to comment. Run one mock request from a rejected candidate: can you send the 30-day explanation and answer the follow-up request within 15 days, with named sources? If the by-name duty or the presumption doesn't work for your hiring stack, say so in a comment by October 26, 2026; our comment letter template has a starting draft.
Our take
The statute already asks for sources of personal data; the draft rule only decides how specific you have to be. Plan for names. Vendors that can't list their sources will be a problem in January whichever version is adopted, and a candidate who asks is owed an answer within weeks, not after a contract renegotiation.
One caution on timing: the Attorney General has agreed in federal court not to start enforcement until 14 days after a ruling on xAI's planned preliminary-injunction motion. That delays penalties, not the law's January 1, 2027 start or the work above.
For the full set of duties, see the Colorado AI Act compliance guide. For vendor terms, see the AI vendor due diligence checklist and the agentic AI vendor contract clauses guide. For federal screening rules that overlap, see the FCRA AI hiring guide.
Correction (October 16, 2026): We rewrote this article. Earlier versions called covered tools "high-risk", said the law covers scheduling and tools that "substantially contribute", said a September draft first required sources by name, and described a four-part human review test we could not find in the draft. We now quote the August 11 proposed rules, the October 6 interim draft and the signed act.
Related Reading
- Colorado ADMT Comment Letter Template
- NYC Local Law 144: automated employment decision tool compliance guide
- FCRA and AI hiring: vendor compliance checklist for 2026
- Workday AI lawsuit: what employer liability means for your AI hiring stack
- Colorado AI Act compliance: what SB 26-189 requires in 2027
- EEOC AI hiring guidance: what the agency said in 2026
- AI vendor due diligence checklist 2026
- Agentic AI vendor contract clauses: what to add in 2026
