This spring, two regulatory developments have emerged that establish the latest compliance obligations for private companies using artificial intelligence (AI) for employment and other consumer-related purposes.
In Colorado, Gov. Polis signed into law the nation's first comprehensive AI legislation. Effective in February 2026, it will place significant guardrails around private companies that create or use AI systems for purposes the law deems “high risk,” including employment decisions.
Separately, pursuant to President Biden's October 2023 Executive Order, the U.S. Department of Labor (DOL) has now promulgated AI-related guidance to private sector employers and to federal contractors. The guidance offers insights into complying with federal labor laws and avoiding discriminatory and other unlawful outcomes while utilizing AI.
Colorado AI Legislation
The Colorado AI Act is the first comprehensive AI-specific law in the United States. The law takes effect in February 2026, and will regulate both “developers” (businesses creating and selling AI systems at market) and “deployers” (those using AI systems created by others). The law will apply to all businesses engaging Colorado residents with AI, except for certain small employers that do not use their own data to train AI models.
The Colorado law will regulate “high-risk” uses of AI systems, which includes all uses of AI that will operate as a substantial factor in “consequential decisions,” including employment decisions, financial, credit, educational, the provision of government services, health care, housing and legal.
AI users will be required to take “reasonable care” to protect consumers from discrimination from high-risk AI uses. To that end, the law identifies several specific safeguards for users to implement. Such safeguards include:
- Implementing a recognized risk management framework such as the “Artificial Intelligence Risk Management Framework” published by the National Institute of Standards and Technology;
- Conducting regular impact assessments of high-risk AI systems; and
- Providing certain required notices to 1) consumers, regarding the impact of the AI on the consumer and allowing an appeal of an AI-based decision; and 2) the Colorado Attorney General, if the AI use causes algorithmic discrimination.
We expect Colorado regulators to issue updates in the coming months clarifying the law's impact.
The DOL Guidance
The DOL issued guidance to both federal contractors, and private employers more broadly, about using AI systems for employment purposes.
The OFCCP Guidance
Guidance from the Office of Federal Contract Compliance Programs (OFCCP) addresses how federal contractors and subcontractors can avoid unlawful discrimination while using AI systems for employment purposes. Chiefly, it provides that, if a federal contractor's use of an AI system has had an "adverse impact" on a protected group, then the contractor is required to demonstrate the following:
- The business needs that motivate the use of the system;
- The job-relatedness of the system selection procedure;
- The results of any assessment of system bias, debiasing efforts and/or any study of system fairness;
- That it has conducted routine independent bias assessments; and
- That it has explored less discriminatory alternative selection procedures.
An AI system is deemed to have an “adverse impact” if the selection rate for members of a protected class is less than 80 percent of the selection rate for the majority group. The guidance also clarifies that contractors must maintain records and confidentiality about their AI uses for employment, provide documentation when requested, and provide reasonable accommodations to an applicant with a protected disability under federal law.
Wage and Hour Guidance
The DOL also issued guidance for all employers subject to federal labor laws about maintaining compliance with federal labor laws while using AI systems in relation to a variety of practices.
Timekeeping: The guidance warns that using AI to track employees' working time may result in undercounting time worked, which can lead to liability for unpaid wages and overtime. Further, it notes that using AI to administer breaks could violate employers' obligations to provide "reasonable" break time to nursing employees to express breast milk.
Leave: The guidance cautions against using AI systems to evaluate and administer leave requests under the Family Medical and Leave Act. When using AI systems, employers may need to monitor what medical information is being requested to ensure it is not more than necessary and may need to prevent the AI from penalizing employees for missing a certification deadline or failing to properly track employees' eligibility timing.
Lie Detection Tests: The Employee Polygraph Protection Act of 1988 (EPPA) generally prohibits private employers from using lie detector tests in the workplace. The guidance provides that AI systems that can analyze body movements to identify deception would also fall under the EPPA and be prohibited.
Retaliation: Employers who use AI systems to take adverse actions against employees who have engaged in protected activities or to predict or monitor employees engaging in protected activities, which could be engaging in prohibited retaliation and could implicate other federal labor laws, such as the National Labor Relations Act.
The Takeaway
Employers should monitor the Colorado AI Act as it develops. Employers should also remember that using AI systems in the workspace does not relieve them from their obligations to comply with labor laws. As such, employers should review their AI policies to ensure proper oversight of these systems.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.