Colorado AI Impact Assessment Template (SB 24-205)

Colorado's SB 24-205 (Colorado AI Act) requires employers to complete impact assessments before deploying high-risk AI systems in employment decisions. The effective date is June 30, 2026 — and with rulemaking still ongoing, employers need to start building their assessment process now, not after the deadline.

This template provides a practical framework structured around the law's requirements. It covers every major element the statute calls for: system identification, risk evaluation, data governance, bias testing, and governance controls.

• Statute: Colorado SB 24-205, § 6-1-1306
• Effective Date: June 30, 2026
• Who must complete: Employers (deployers) using high-risk AI in employment decisions
• When required: Before deploying a high-risk AI system; updated annually or when significant changes occur
• Enforced by: Colorado Attorney General
• Penalties: Up to $20,000 per violation after 60-day cure period

What Is a High-Risk AI System Under Colorado Law?

Before using this template, confirm your AI tool qualifies as "high-risk." Under SB 24-205, a high-risk AI system is one that:

1. Uses machine learning, statistical modeling, data analytics, or AI
2. Makes or is a substantial factor in a consequential decision
3. Employment decisions are explicitly listed as consequential decisions

For a detailed analysis of what qualifies, see: What Counts as High-Risk AI in Employment Under Colorado Law

Colorado AI Impact Assessment Template

Section 1: System Identification

Complete one assessment per AI system deployed.

1.1 System Description

Describe what the AI system does in plain language. What inputs does it use? What output does it produce?

1.2 Purpose in Employment Context

How is this system used in your employment decision-making process? What decisions does it inform?

1.3 Employment Decisions Affected

Check all that apply:

• Resume / application screening
• Candidate ranking or scoring
• Video interview analysis
• Skills or cognitive assessment
• Background check or risk scoring
• Promotion or advancement decisions
• Performance evaluation
• Compensation determination
• Termination / discipline risk scoring
• Other: ___________

1.4 Affected Population

How many candidates or employees are evaluated by this system annually in Colorado?

Estimated annual count: ___________

Section 2: Vendor Information and Due Diligence

2.1 Vendor Identity

2.2 Vendor-Provided Documentation

Confirm you have obtained the following from your vendor:

• Description of the AI system's purpose and intended use cases
• Documentation of training data sources
• Disparate impact testing results by demographic group
• Validation study demonstrating job-relatedness
• Description of known limitations and failure modes
• Contractual representation that vendor will notify you of material changes
• Vendor's own impact assessment (if deployer is also developer)

2.3 Gaps in Vendor Documentation

List any requested documentation the vendor did not provide, and steps taken to address the gap:

Section 3: Data and Training Information

3.1 Training Data Sources

What data was used to train or validate this AI system?

3.2 Data Relevance to Your Workforce

Was the training data representative of the population you hire from? Are there demographic groups in your hiring pool not well-represented in training data?

3.3 Data Collection for Ongoing Use

What data about candidates or employees does the system collect during use? How is it stored and for how long?

3.4 Data Rights and Deletion

Can candidates request deletion of their data? Is there a process for honoring such requests?

• Yes — process exists and is documented
• No — needs to be created
• Unknown — requires vendor clarification

Section 4: Bias and Disparate Impact Analysis

4.1 Pre-Deployment Testing

Has this AI system been tested for disparate impact before deployment? If yes, provide results summary:

4.2 Methodology for Bias Testing

Describe the methodology used for disparate impact analysis. Was the EEOC's Uniform Guidelines on Employee Selection Procedures (UGESP) or another validated framework used?

4.3 Results Summary

• No significant disparate impact detected
• Disparate impact detected — see remediation plan below
• Insufficient data for complete analysis — see plan to obtain data

4.4 Remediation Plan (if disparate impact detected)

If disparate impact was detected, describe steps being taken to address it:

Section 5: Consumer Notification Plan

Under Colorado SB 24-205, employers must notify affected individuals that a high-risk AI system was used in a consequential decision about them.

5.1 Notification Method

How will you notify candidates/employees that AI was used in their evaluation?

• Written notice in application process (pre-use)
• Email notification after decision
• Online portal notification
• Other: ___________

5.2 Notification Timing

When will notification be provided? (The law requires notice before or contemporaneous with the decision)

5.3 Notification Content

Your notification must include:

• Statement that a high-risk AI system was used
• The type of AI system used
• The purpose of the system
• Contact information for questions

Sample Notification Language:

"As part of our hiring process for [Position], we used an automated AI system called [System Name] to assist in evaluating applications. This system analyzes [describe what it evaluates] to provide a recommendation that was a factor in our hiring decision. If you have questions about this process, please contact [HR Contact] at [email/phone]."

Section 6: Opt-Out and Appeal Process

6.1 Opt-Out Mechanism

Colorado SB 24-205 provides candidates with the right to opt out of certain AI-assisted decisions and appeal adverse decisions.

Describe your process for candidates to opt out of AEDT evaluation or request human review:

6.2 Appeal Process

How can a candidate appeal an adverse employment decision that was influenced by AI?

6.3 Human Review Alternative

If a candidate opts out of AI evaluation, what alternative assessment process is provided?

Section 7: Governance and Oversight

7.1 Internal Owner

Who in your organization is responsible for AI compliance?

7.2 Review Schedule

Per SB 24-205, impact assessments must be updated:

• Before deploying a new AI system
• When there are significant changes to the system
• At least annually

7.3 Change Management

How will you be notified if the AI vendor makes material changes to the system? Is this addressed in your vendor contract?

Section 8: Sign-Off and Certification

Assessment Certification

I certify that this impact assessment was completed in good faith and to the best of my knowledge accurately reflects the AI system's design, data, and deployment in our organization's employment decision-making process.

Using This Template: Next Steps

Once you've completed the assessment:

1. Store it securely — You may need to produce it in response to an AG investigation
2. Set a calendar reminder for annual review
3. Share with your AI vendor — Ask them to review and confirm accuracy of technical sections
4. Brief your HR team on the notification and opt-out processes
5. Integrate into your onboarding for any new AI hiring tools going forward

Related Resources

• Colorado AI Act: Full Employer Guide
• What Counts as High-Risk AI in Employment Under Colorado Law
• EEOC AI Hiring Guidance 2026
• EEOC vs. NYC vs. Colorado: AI Hiring Compliance Comparison
• AI Bias Audit Guide
• Compliance Checklist 2026

EmployArmor automates Colorado AI Act compliance — including impact assessment generation, candidate notification workflows, and audit-ready documentation. Get Your Compliance Assessment →

Legal Disclaimer: This template is a starting framework for informational purposes only and does not constitute legal advice. Colorado SB 24-205 requirements are subject to ongoing regulatory rulemaking that may change specific requirements. Always consult qualified employment counsel to finalize your compliance documentation. EmployArmor does not provide legal services.

Last updated: April 2026