What HR Leaders Need to Know as a June 30 Deadline Looms
A legal battle that could reshape the future of artificial intelligence in the American workplace escalated sharply this week when the Trump administration's Department of Justice moved to join a lawsuit already filed by Elon Musk's AI company, xAI, seeking to block Colorado's first-in-the-nation law regulating the use of AI in hiring and other high-stakes decisions.
The law — Senate Bill 24-205, known formally as the Colorado Anti-Discrimination in AI Act (ADAI) — is scheduled to take effect on June 30. For HR professionals operating in Colorado, or at companies that deploy AI tools touching the state's workers, the clock is ticking on one of the most consequential workplace compliance deadlines in recent memory. Whether that deadline survives federal court scrutiny is now an open question.
Read next: 'Reese is right': The AI skills gender gap is real
A law years in the making, now under siege
Colorado Governor Jared Polis signed SB 24-205 into law in May 2024, though not without reservations. In a signing letter, he urged state legislators to revisit several of the law's core provisions before they took effect, noting that it departed from the traditional model of anti-discrimination enforcement by targeting outcomes rather than intent.
Despite that lukewarm endorsement, the law stood. It became the first comprehensive state statute in the United States to impose governance obligations on both developers and deployers of high-risk AI systems — a category that, for HR departments, encompasses any tool that uses algorithmic processing to meaningfully influence a consequential employment decision.
Under the law, a "high-risk AI system" includes software used to screen or rank job applicants, evaluate employee performance, recommend promotions, or determine eligibility for benefits. Notably, the law sets no minimum employee threshold: any employer that develops or deploys such a system is subject to its requirements.
Read next: AI was supposed to elevate HR. What if it does the opposite?
The law was originally set to take effect in February 2026, but the deadline was pushed back to June 30 to allow more time for industry negotiation and potential legislative amendments — a process that remains unresolved as the state legislature's session is scheduled to close on May 13.
What the lawsuit argues
xAI filed its lawsuit on April 9 in federal court in Denver. The complaint raises six constitutional claims, centering on two main arguments.
First, xAI contends that building an AI model is a form of protected speech under the First Amendment, and that forcing developers to redesign their systems to avoid disparate outcomes amounts to government-compelled expression. The company cited recent Supreme Court precedents — including 303 Creative v. Elenis — in arguing that such compulsion triggers strict scrutiny, a standard it claims Colorado cannot meet.
Second, xAI argued that the law is "unconstitutionally vague" and would burden interstate commerce by purporting to regulate AI systems developed and deployed entirely outside Colorado's borders.
The Justice Department's intervention, filed on April 24, added a significant new dimension. DOJ attorneys argued the law violates the Equal Protection Clause of the Fourteenth Amendment by distorting AI model outputs in ways that, they claim, effectively require developers to make decisions based on race, sex, religion, and other protected characteristics. The filing also contended that the law contains an explicit carveout for discriminatory algorithms designed to advance diversity or redress historical discrimination — an asymmetry the DOJ characterized as constitutionally impermissible.
The intervention marks the first time the DOJ has moved to challenge a state AI regulation in court. It is also notable because Colorado's law was the only state AI statute specifically named in President Trump's December 2025 executive order directing federal agencies to push back against state-level AI rules deemed to stifle innovation.
Colorado's Attorney General's Office declined to comment on the federal government's filing.
What HR leaders are required to do under the law — for now
Unless a court intervenes, the compliance obligations for HR teams are substantial. Legal experts advising Colorado employers have recommended that HR departments take the following steps before June 30:
Audit your AI tools. Any software used in hiring, performance management, promotion decisions, or benefits eligibility that involves algorithmic processing could qualify as a high-risk AI system. The audit should identify whether the vendor classifies the tool as high-risk and whether they have provided the disclosures required under the law.
Read next: Inside the Grammys' Anthropic experiment: How in‑house AI Is rewriting workforce rules
Build a documented AI governance program. The law requires deployers to maintain a written risk-management program that specifies the personnel, processes, and principles used to identify and mitigate algorithmic discrimination. The National Institute of Standards and Technology's AI Risk Management Framework is explicitly recommended by the statute as a compliance guide.
Complete written impact assessments. Before deploying any high-risk AI system, employers must document the system's purpose, the data it uses, how it was tested, and what risks it poses. These assessments must be updated annually.
Issue required notices. The law mandates two types of disclosure: a public-facing statement on the company's website describing its use of high-risk AI, and a direct notice to any Colorado resident who receives an adverse consequential decision — such as a rejection — based on an AI-assisted process.
Report discriminatory outcomes to the state. If a deployed AI tool is found to have produced a discriminatory result, employers must notify the Colorado Attorney General. Failure to do so could result in enforcement action under the state's Consumer Protection Act, which authorizes civil penalties.
It is worth noting that there is no private right of action under SB 24-205. Enforcement authority rests exclusively with the Colorado Attorney General's office. Employers who can demonstrate they followed the law's compliance steps benefit from a rebuttable presumption of reasonable care.
A politically contested landscape
The legal battle reflects deeper tensions about who should govern AI in the workplace — and on what terms.
The law attracted criticism even before Musk's lawsuit. LinkedIn co-founder Reid Hoffman called the law "not a smart play" at a 2024 summit in Denver. The U.S. Chamber of Commerce raised concerns about its potential to burden small businesses and impede AI adoption. Governor Polis, while signing the bill, warned that the legislation's focus on unintentional disparate impact rather than intentional discriminatory conduct represented a significant departure from traditional civil rights law.
Those concerns echo arguments now being litigated in federal court. The irony is not lost on legal observers that a law designed to prevent discrimination is being challenged in part on the grounds that it itself mandates discriminatory outcomes.
Meanwhile, Colorado is not alone. Illinois and Texas have both enacted laws targeting discriminatory AI use in hiring, effective at the start of 2026. California regulatory agencies have issued similar requirements for certain employers. New York City passed an automated employment decision tool law in 2021. Legal analysts suggest that the fate of Colorado's law will likely influence the trajectory of AI regulation across multiple states — and potentially at the federal level.
What HR leaders should do right now
The uncertainty created by the lawsuit does not eliminate compliance risk. Courts could allow the law to take effect on schedule while litigation proceeds, and an injunction is far from guaranteed. Employment law specialists advise HR teams to proceed with compliance preparation while monitoring the case closely.
A few practical considerations:
- Do not assume the lawsuit will succeed. Legal challenges of this kind often take months or years to resolve. The law may take effect June 30 regardless of pending litigation.
- Engage your AI vendors now. Under the law, developers of high-risk AI systems have their own disclosure and reporting obligations. HR leaders should request documentation from vendors confirming what risk assessments have been conducted and what data the system uses.
- Document everything. If the law does take effect and the company faces an enforcement inquiry, a well-documented compliance effort will be the primary defense.
- Watch the Colorado legislature. A Colorado AI Policy Working Group released a reform proposal in March that would roll back some of the law's most burdensome requirements, including mandatory annual reviews and attorney general reporting. A legislative fix remains possible before May 13, though the window is narrow.
For HR leaders, the core question posed by Colorado's law — whether the AI systems shaping decisions about people's livelihoods are producing fair, accountable results — will not disappear regardless of what happens in Denver federal court. The lawsuit may delay a legal reckoning. It will not forestall the broader one.
The case is xAI v. Weiser, 1:26-cv-01515, U.S. District Court, District of Colorado.
For further reading, see the full text of SB 24-205 and the Colorado Attorney General's ADAI rulemaking page.
Global AI Hiring Laws: Country Comparison
Status of laws and regulations affecting the use of AI in employment decisions — April 2026
| Jurisdiction | Status | Enforcing body | Key HR obligations |
|---|---|---|---|
| Europe | |||
 European Union |
Binding | National market surveillance authorities | AI Act classifies almost all HR AI as “high-risk.” Requires conformity assessments, risk management documentation, human oversight mechanisms and transparency to workers before deployment. Applies to any organisation deploying covered AI within the EU, regardless of where the tool was built.
High-risk employment provisions phasing in; full enforcement no later than December 2027 |
 United Kingdom |
Binding | Information Commissioner’s Office (ICO) | Data Use and Access Act 2025 (DUAA): impact assessments required for significant automated employment decisions; individuals retain right to human review and override. ICO codes of practice on AI hiring tools updated. Existing equality law already applies to AI-assisted decisions.
Lighter touch than EU AI Act but binding obligations in force |
 Germany & EU states |
Binding | Works councils / labour courts | Works council co-determination rights when introducing AI-based HR tools. Employers must consult and agree with works councils before deploying AI in hiring or performance management. Applies in Germany, France, Spain, Italy, Austria and the Netherlands.
Operates alongside EU AI Act obligations; consent required before deployment |
| North America | |||
 USA — Federal |
Retreating | DOJ / EEOC (limited) | No comprehensive federal AI employment law exists. The Trump administration is actively challenging state laws it regards as DEI-linked regulation. Colorado’s AI Act was the only state law named in a December 2025 executive order. A National AI Legislative Framework was published in March 2026 but is advisory only and imposes no obligations on employers.
Diverging sharply from the direction of most other major economies |
| Colorado (USA) |
In dispute | State Attorney General | SB 24-205 (due 30 June 2026): written impact assessments; AI governance programme; bias monitoring; transparency notices to applicants; reporting of discriminatory outcomes to the Attorney General. Most comprehensive US state AI law to date.
Currently subject to federal lawsuit filed by DOJ and xAI; legal status uncertain |
| Illinois (USA) |
Binding | Illinois Dept of Human Rights | Human Rights Act amendment (in force January 2026): prohibits use of AI that causes discriminatory effects on any protected class in hiring, promotion or termination; advance notice required when AI is used; applies to any employer with one or more employees in Illinois.
In force since 1 January 2026 |
| New York City (USA) |
Binding | NYC Dept of Consumer & Worker Protection | Local Law 144 (in force since July 2023): annual independent bias audit of automated employment decision tools (AEDTs); public summary of audit results required; candidate notice required when an AEDT is used in hiring or promotion.
First US jurisdiction to require bias audits; in force since 2023 |
| California (USA) |
Binding | CA Civil Rights Dept / CPPA | FEHA regulations (in force 2025–2026): AI tools causing discrimination on protected characteristics are unlawful; four-year record retention required. CCPA automated decision-making regulations (January 2026): risk assessments for sensitive data; opt-out rights for significant employment decisions including hiring, firing and performance evaluation.
Multiple overlapping frameworks; among the most detailed in the US |
 Canada |
Partial | Federal / Provincial regulators | Ontario Working for Workers Act (in force January 2026): employers must disclose when AI is used in the hiring process. Federal Artificial Intelligence and Data Act (AIDA) pending: would regulate high-impact AI in employment nationwide. Existing federal privacy law (PIPEDA) applies to AI data processing.
Patchwork of provincial obligations; comprehensive federal law still pending |
| Asia-Pacific | |||
 South Korea |
Binding | National AI Committee | AI Basic Act (in force January 2026): high-impact AI used in employment must allow meaningful human oversight and intervention at all times; transparency and labelling required; risk assessments must be documented; foreign companies must appoint a Korean local representative.
First comprehensive national AI law in Asia-Pacific; closest to EU AI Act in structure |
 China |
Binding | Cyberspace Administration of China (CAC) | Algorithm Recommendation Regulation (in force March 2022): transparency in how algorithms process and recommend decisions. Mandatory labelling rules for AI-generated content. Security assessments required for publicly deployed AI models. Strictest active enforcement regime in APAC.
Multiple binding instruments; enforcement is active and penalties are meaningful |
 Japan |
Promotional | AI Strategic Headquarters | AI Promotion Act (in force June 2025): a promotional framework encouraging responsible AI use; no penalties for non-compliance. Sector-specific guidelines expected throughout 2026. Existing Labour Standards Act and Personal Information Protection Act (APPI) continue to apply to AI-assisted employment decisions.
Innovation-first approach; penalties deliberately excluded from the framework |
 Singapore |
Voluntary + pending | PDPC / Ministry of Manpower | AI Verify toolkit and Model AI Governance Framework: voluntary testing and accountability standards widely adopted. Workplace Fairness Act (passed 2025): Singapore’s first statutory anti-discrimination law; prohibits adverse employment decisions based on protected characteristics; mandatory grievance procedures required.
Workplace Fairness Act expected in force end-2027; AI Verify framework voluntary |
 Australia |
Emerging | OAIC / Fair Work Commission | Mandatory AI guardrails for high-risk uses including employment are proposed but currently recommendatory only. Privacy Act amendment (in force December 2026): individuals gain the right to request information about substantially automated decisions affecting them. Existing anti-discrimination law already applies to AI-assisted hiring decisions.
Binding guardrails under development; watch for December 2026 Privacy Act changes |
| Latin America | |||
 Peru |
Binding | Secretariat for Government & Digital Transformation (SGTD) | Law 31814 and Supreme Decree 115-2025-PCM (in force January 2026): AI used in recruitment, evaluation, hiring and dismissal is classified as high-risk; requires human oversight, algorithmic transparency and documented risk assessments before deployment. Sectoral compliance deadlines phase in from September 2026 (health, education, finance) to September 2029 (other sectors).
First binding AI framework in Latin America; modelled on OECD and EU principles |
 Chile |
Partial / pending | Financial Market Commission / CMF | Personal Data Protection Law No. 21,719 (in force December 2026): individuals have the right to object to decisions based solely on automated processing, including employment decisions — closely aligned with GDPR Article 22. Separate comprehensive AI legislation under discussion.
Data protection rights binding from December 2026; broader AI law pending |
 Brazil /  Colombia /  Mexico |
Draft | TBD | All three countries have AI legislation under active discussion. Brazil’s draft proposes a risk-based framework modelled on the EU AI Act, including the right to an explanation for AI-driven hiring decisions. Colombia and Mexico are at earlier stages of legislative development.
None yet enacted; watch for 2026–2027 developments in Brazil |
