Key point: Colorado and Connecticut recently enacted laws regulating employers’ use of AI and automated decision-making tools in employment decisions—with notice obligations, anti-discrimination requirements, and civil penalties that will require employers operating in these states to reassess their AI-driven HR practices now. Meanwhile, Illinois paused its rulemaking efforts on the circumstances under which notice of the use of AI is required.

Amid the active state-level artificial intelligence (AI) legislation landscape, Colorado and Connecticut joined the fray in regulating certain AI use for employers. On May 14, 2026, the Colorado governor signed SB 26-189, amending and replacing the Colorado AI Act that will now go into effect on January 1, 2027. Like its predecessor, this amended law governs not just the development and deployment of high-risk AI systems, but also discriminatory AI use in certain employment decisions. On the East Coast, Connecticut just passed a wide-ranging AI law that regulates employment-related decisions made by certain AI and has staggered enforcement dates from October 1, 2026 to October 1, 2027. But in Midwest, although the statutory amendments to the Illinois Human Rights Act went into effect on January 1, 2026, the state recently announced that it would pause its proposed rulemaking which was intended to provide some guidance addressing notice requirements.

Colorado

Prior law. Two years ago, Colorado became the first state in the U.S. to enact a comprehensive AI law. The law would have established an affirmative duty for developers and deployers not to engage in algorithmic discrimination for consequential decisions made by automated decision-making technology (ADMT). Following lawsuits brought by the DOJ and Elon Musk’s company xAI, and vocal objections from the business community, the Colorado legislature passed SB 26-189 (AI Act) to repeal and replace the ambitious law.

Current law. The new AI Act is narrower in scope than its predecessor; it does not contain the same rules around the duty of care, impact assessments, attorney general notices, disclosures to consumers about non-obvious AI systems, or even algorithmic discrimination. However, it mirrors the prior law in prohibiting the use of high-risk AI systems for consequential decisions about consumers, including “access to, eligibility for, selection for, or compensation for” employment. Importantly, the AI Act’s definition of a “consumer” includes employees, Colorado resident job applicants, and “any individual whose access to, eligibility for, or opportunity in Colorado is evaluated in a consequential decision by a person doing business in Colorado,” and the AI Act’s definition of a developer encompasses employers that are using covered ADMT systems.

Employer requirements. Before employers use a “covered ADMT,” also defined in the AI Act, to “materially influence” a consequential decision about employment, the employers must provide clear and conspicuous prior notice (e.g., public notice that is “reasonably accessible at points of consumer interaction” like a pre-use notice as part of the job application process). Notably, the threshold for “materially influencing” a decision is relatively low: the law defines the term as any factor that is more than de minimis and that affects the outcome of a decision, far less than the well accepted legal interpretation of “material.” In practice, this means that even limited reliance on an AI tool in the decision-making process could trigger the law’s notice obligations.

Employers must also provide notice instructing individuals how to obtain additional information about the employer’s use of ADMT. Within 30 days of making an adverse decision materially influenced by covered ADMT, an employer must provide:

• notice that includes a plain language description of the consequential decision and the role the covered ADMT played;
• instructions and a simple process to request additional information about the covered ADMT; and
• an explanation about the rights to correct and review data and how to exercise those rights.

In response to an individual’s request, employers must provide instructions for requesting and correcting incorrect or materially inaccurate personal data used in the consequential decision along with an opportunity for meaningful human review and reconsideration. Employers must also retain records that are reasonably necessary to demonstrate compliance with the AI Act, such as covered ADMT version identifiers or change logs, for at least three years after making a consequential decision.

Penalties. The AI Act is enforced by the Colorado Attorney General through the Colorado Consumer Protection Act. Violating parties are given written notice by the Office of the Attorney General if the Office deems a cure is possible and have 60 days to cure their violations if the violations were not repeated or knowingly made. A violation of the AI Act falls under the state’s unfair and deceptive trade practices statutes, which have penalties of up to $20,000 per violation. The AI Act does not have a private right of action.

Status. This law is set to go into effect on January 1, 2027, and the Colorado Office of the Attorney General is required to complete rulemaking by this date.

Connecticut

Use prohibition. On May 27, 2026, Governor Ned Lamont signed the Connecticut Artificial Intelligence Responsibility and Transparency Act (CART Act), a multi-faceted law that addresses a multitude of AI-related activities. This law contains, among other things, provisions regarding subscription service consumer protection, frontier model safety, the creation of a state-maintained AI regulatory sandbox similar to those being established in Utah, Texas, and Delaware, companion chatbot requirements, and automated employment-related decision technology (AEDT). AEDT is defined as technology that processes personal data and uses computation to generate any output to make or materially influence an employment-related decision. Employers cannot discriminate against employees via the use of AEDT or shift liability by claiming a discriminatory employment decision was made or significantly influenced by AEDT.

Employer requirements. Employers and AI deployers must disclose in clear and plain language when employees and applicants are interacting with AEDT if a reasonable person would not deem it obvious, and they must disclose when AEDT is used to make or is a substantial factor in making an employment-related decision. Unlike the Colorado AI Act’s broad definition of  materially influence, the CART Act’s adoption of a “substantial factor” that “meaningfully alters the outcome” of an employment-related decision test appears to be a higher threshold. This distinction suggests that Connecticut’s framework may capture fewer routine or marginal uses of AI in employment decisions than Colorado’s comparatively lower bar.

If an employer is also a developer of AEDT (i.e., if an employer has developed an in-house AI tool for employment decisions), they, as a deployer, must provide employees and applicants with written notice about the technology, including:

• that the employer has deployed AEDT;
• the purpose of the technology and nature of the employment-related decision at issue;
• the trade name of the AEDT;
• the categories of personal data concerning the employee or applicant that the technology will analyze or process, and how that data will be used to reach a decision;
• the sources of personal data being used; and
• the contact information of the employer.

Penalties. The Connecticut Attorney General enforces the CART Act through the state’s unfair and deceptive trade practices act and can seek civil penalties of up to $1,000 per violation. Employers may receive a notice for certain violations from the AG with a cure period of 60 days, after which the AG may bring an enforcement action. Like the Colorado AI Act, the CART Act does not have a private right of action.

Status. This law contains staggered enforcement dates, with the relevant dates to employers being October 1, 2026 and October 1, 2027. By the 2026 enforcement date, employers conducting mass layoffs or plant closings must disclose to the Connecticut Labor Department if AI was used to influence that decision. By the 2027 enforcement date, employers using AEDT for hiring, promoting, or firing must provide individuals and applicants with written notice.

Illinois

Use prohibition. On August 9, 2024, Illinois Governor JB Pritzker signed HB 3773 into law, amending the state’s Human Rights Act (IHRA) to prohibit employers and their agents from using AI in a way that “has the effect of subjecting employees to discrimination on the basis of protected classes” (for example, using zip codes as a proxy for protected classes). Specifically, covered employers cannot discriminate against protected classes with their use of AI in:

• recruitment
• hiring
• promotion
• renewal of employment
• selection for training or apprenticeship
• discharge
• discipline
• tenure
• the terms, privileges, or conditions of employment.

Employer requirements. The proposed rules would require employers using AI for any of the above purposes to provide employees with notice within 30 days of adopting a new or substantially updated AI system. While the proposed rule regarding notice timing has been paused, the statutory notice requirement itself is still generally in effect; notice should be provided in employee handbooks, in a “conspicuous location” on the employer’s physical premises and intranet or external website, and in job postings. Unlike the Colorado AI Act, the amended IHRA does not require entities using AI in an employment context to conduct bias or impact assessments.

Penalties. The 2024 amendments to the IHRA also updated the penalties. An Illinois Human Rights Commission administrative law judge could previously recommend remedies including cease-and-desist orders, actual damages, reinstatement, back pay, attorney’s fees, and notice posting. The amendment allows for such a judge to impose a civil penalty for each civil rights violation, payable to the state, with a first violation costing $16,000, a second violation within five years costing $42,500, and any further violation within seven years costing $70,000. It is worth noting that when a violation is attributed to the same individual responsible for prior violations, such as the same HR manager, the five- and seven-year limitation periods do not apply, and the enhanced penalty may be imposed regardless of time that has passed.

Status. The Illinois Department of Human Rights published its proposed rules to implement the AI amendments to the IHRA on May 15, 2026, and subsequently announced that it was temporarily postponing those proposed rules on June 2, 2026. Unlike Colorado and Connecticut, there is a private right of action under the IHRA, but it must begin with an administrative charge to the Illinois Department of Human Rights, even if the claimant later opts-out to pursue civil relief in a state court in the county where the violation allegedly occurred.

Looking ahead

This is not the first time Colorado, Connecticut, and Illinois have been proactive with respect to consumer rights and data protection. For example, Colorado was the third state and Connecticut the fifth to pass a comprehensive data protection law. As of today, twenty-three states have done so. Illinois was the first of three states in the U.S. to pass a biometric data privacy law, and now, along with Colorado and Connecticut, joins California and New York City in passing laws prohibiting the discriminatory use of AI and automated tools for employment decisions.

Despite these forward-leaning legislative actions, it is worth noting that when Colorado repealed and replaced its original AI law, the legislature eliminated the impact assessment obligations as part of the intentional effort to make the AI Act’s compliance obligations less burdensome for businesses. Similarly, Illinois bill HB 5116 was originally proposed to impose AI governance obligations for deployers using ADMT as well, like performing annual impact assessments when ADMT is used to make a consequential decision, but this was ultimately not passed alongside the IHRA amendment, which is now temporarily on hold.

This legislative recalibration implies that states are beginning to understand the importance of regulating ADMT in the workplace and are keeping business needs and compliance feasibility in mind as they pass bills operationalizing AI governance. Employers operating in Colorado, Connecticut, and Illinois, or hiring residents of those states, should assess their use of AI and automated tools in employment decisions and take steps toward compliance well before the applicable effective dates. Husch Blackwell’s employment and data privacy teams are monitoring developments in each of these states and are available to assist.

Contact us

If you have questions regarding your use of AI in the workplace as a developer or deployer, contact Erik Dullea, Laura Malugade, Anokhy Desai, or your Husch Blackwell attorney.