Small business owners using artificial intelligence to screen job applicants, evaluate loan candidates, or make customer decisions are now operating under live legal obligations in Colorado and Illinois — and the compliance window is narrowing fast.
Illinois’ amended Human Rights Act, updated by HB 3773, took effect January 1, 2026. Colorado’s AI Act (SB 24-205) has had its enforcement timeline extended, with a replacement bill (SB 189) now awaiting the governor’s signature and targeting a January 1, 2027 effective date. Together, these two laws represent a first wave of state-level AI regulation that directly affects SMBs using AI tools for consequential business decisions.
What These Laws Actually Cover
Illinois HB 3773: Active Now
Illinois’ amendment to the Illinois Human Rights Act (IHRA) entered force on January 1, 2026, and applies to any employer with at least one employee in the state — meaning virtually every Illinois-based SMB is covered.
The law prohibits the use of AI — including generative AI — in recruitment, hiring, promotion, renewal of employment, selection for training or apprenticeship, discharge, discipline, and terms of employment in ways that discriminate against protected classes, even if that discrimination is unintentional. Employers must also provide written notice to employees and job applicants when AI is used to influence or facilitate an employment decision.
Critically, Illinois’ law does not limit “employer” to large organizations. Any business that uses an AI-powered recruiting platform, an automated resume screener, or a performance management tool that influences employment decisions falls within scope. That includes staffing agencies and third-party recruiters acting on an employer’s behalf.
Violations are treated as civil rights violations under the IHRA and can result in actual damages, civil penalties, attorneys’ fees, and compliance reporting obligations.
Colorado AI Act (SB 24-205): Amended But Advancing
Colorado’s SB 24-205 was originally set to take effect February 1, 2026, making it the first comprehensive state AI law in the United States. Its enforcement was subsequently extended to June 30, 2026, and the Colorado legislature has now passed a replacement bill — SB 189 — that, if signed by Governor Polis, would take effect January 1, 2027.
The replacement narrows the original law’s scope considerably, shifting from an extensive risk-management-and-impact-assessment framework to a notice-and-transparency model. But the core principle survives: when AI is used in consequential decisions affecting Colorado residents — covering employment, housing, credit, insurance, education, and healthcare — disclosure obligations apply.
Under the original law’s framework (which still informs the direction of SB 189), businesses that deploy “high-risk” AI systems are required to notify consumers of AI use, allow consumers to correct inaccurate data used in AI decisions, and provide a mechanism to appeal adverse AI-influenced outcomes through human review where technically feasible.
Algorithmic discrimination — where an AI system produces outcomes that unfairly disadvantage a protected class — triggers additional reporting duties to the Colorado Attorney General.
Penalties under the original Colorado framework reach $20,000 per violation, counted individually for each affected consumer. A biased hiring algorithm that screens out 50 applicants could theoretically expose a business to $1 million in penalties.
Why This Is an SMB Problem, Not Just a Big-Business Problem
Large enterprises have legal teams and compliance budgets. Small businesses often discover they are using regulated AI tools only after they have signed a vendor contract — or received a complaint.
The risk is especially acute because AI is now embedded in products SMBs use daily:
- Hiring platforms with automated resume scoring or candidate ranking
- HR software that recommends performance ratings or flags employees at risk of leaving
- Lending and underwriting tools that assess creditworthiness or business loan eligibility
- CRM or customer-screening tools that score or segment customers by predicted value or risk
- Background check services that use algorithmic scoring in their reports
If any of these tools influence a decision covered by Illinois’ or Colorado’s law, the SMB using the tool — not just the software vendor — bears compliance responsibility as the “deployer.”
The Small Business Exemption in Colorado Is Narrow
Colorado’s original SB 24-205 included a small business exemption for companies with fewer than 50 employees. However, that exemption disappears if the business uses its own proprietary data to train or fine-tune the AI system. Any SMB that customizes an AI tool using its own customer or employee data loses that protection regardless of headcount.
5 Key Takeaways for SMB Owners
- Illinois law is already in force. If your business has any employees in Illinois and you use AI in any employment decision — hiring, discipline, promotion, termination — you must post notice of that AI use and ensure the tool does not produce discriminatory outcomes. This is not a future obligation; it applied as of January 1, 2026.
- Colorado’s final compliance shape is still forming, but the direction is clear. Whether SB 24-205 or its replacement SB 189 becomes governing law, Colorado will require disclosure when AI influences consequential decisions for Colorado residents. Businesses should not treat the legislative delay as a reason to wait.
- Audit your AI vendor stack now. Pull the contracts and terms of service for every platform your business uses for hiring, lending, or customer screening. Identify whether any of those platforms use AI-driven scoring, ranking, or filtering that influences covered decisions. Ask vendors directly whether their products are designed with Illinois and Colorado compliance in mind.
- Document everything. Both Colorado and Illinois compliance strategies benefit from written records — which AI tools your business uses, what decisions they influence, what disclosures you provide, and what bias-review steps you have taken. Documentation is the primary defense if a complaint is filed.
- Consult legal counsel before making changes to employment AI. The interplay between state AI laws, existing anti-discrimination statutes, and federal executive orders (including a December 2025 order directing the DOJ to challenge state AI laws) creates genuine legal complexity. An employment attorney familiar with your state’s obligations can help ensure compliance steps do not create new exposure.
The Broader State-Level AI Wave
Colorado and Illinois are not isolated cases. More than a dozen states have introduced or passed AI-related legislation since 2024, and the pattern that emerges from the Colorado and Illinois frameworks — disclosure obligations, anti-discrimination duties, and consumer or employee rights around AI-influenced decisions — is likely to spread.
Software Improvement Group’s overview of U.S. AI legislation notes that Colorado’s SB 24-205, inspired by the EU AI Act, represents the most ambitious state-level regulatory template to date. Even in its scaled-back form under SB 189, it establishes precedent that other states are already observing.
For SMBs that operate across multiple states, building a single compliance baseline — AI inventory, vendor documentation, employee notices, and an internal review process — is more efficient than managing state-by-state requirements separately.
Action Steps: What to Do Before Year-End
The following steps do not constitute legal advice and are not a substitute for consultation with qualified legal counsel. They represent a practical starting point for SMBs that have not yet assessed their AI compliance posture.
Inventory your AI tools. List every software platform your business uses that automates or scores decisions related to employment, lending, housing, insurance, or customer screening.
Identify covered decisions. For each tool, determine whether it influences decisions covered under Illinois HB 3773 (employment decisions affecting Illinois workers) or Colorado’s framework (high-risk decisions affecting Colorado consumers).
Review vendor agreements. Confirm whether your AI vendors provide compliance documentation, bias testing results, or contractual representations about regulatory compliance.
Draft or update employee notices. If you have Illinois employees and use any form of AI in employment decisions, create a written disclosure that clearly states the AI’s role in the process.
Engage legal counsel. Given the penalty exposure and the evolving nature of both laws, a review by an employment or technology attorney is a sound investment for any SMB using AI in covered contexts.
Building a systematic approach to AI compliance now — rather than responding to a complaint or enforcement action — positions small businesses to adapt as the regulatory landscape continues to develop. Tools built for business automation, including those used within the Automated Sales Machine ecosystem, are most valuable when the businesses deploying them operate on a compliant foundation.