What a Colorado business has to have in writing
Colorado has no state OSHA plan, so safety enforcement stays federal, but it more than makes up for that on the paperwork side.
The Colorado Privacy Act brings privacy notices, universal opt-out handling and data protection assessments, and a 2024 amendment adds a genuinely unusual duty: anyone collecting biometric identifiers must publish a written retention and destruction policy.
Employers face pay transparency in every job posting plus internal promotional opportunity notices, 48 hours of paid sick leave under the Healthy Families and Workplaces Act, FAMLI paid leave premiums and notices, and a five-year record retention rule under the POWR Act. A rewritten algorithmic transparency law takes over from the 2024 AI Act in 2027.
Colorado has a rule of its own in 13 of the 14 areas, listed below. In 1 more we searched the state's own site and found nothing beyond the federal rule, but we have not finished writing up where we looked, so that one is not shown yet.
Headcount
Industry General is always on
Share
Ad from the publisher
Policy Acknowledgment Proof
ColoradoHandbook 2026acknowledged by name
Colorado on Recordwith AllyMatter
Cover Colorado the Modern WayEvery policy Colorado makes you write, acknowledged by name
01
Approve it, lock the version
Non-author approval, obsolete copies blocked
02
Every employee in Colorado on record
Who read which version, and when
03
Walk into any state inspection with the trail
From $29/mo, 20 editors, unlimited staff (published)
Colorado rules for a 15–19 person general business
We check the same 14 areas of state law on every state page: breach notification, data security program, consumer privacy law, biometric and health data, harassment prevention, workplace safety programs, workplace violence prevention, insurance data security, state vendor security program, paid leave policies, required postings, pay transparency, licensing and certifications, and other written policies. Federal rules apply in most of these already. What this page adds is whether Colorado has a rule of its own on top. The federal rules every employer carries follow the Colorado rules. Each row names what you must write, post, file or certify, who enforces it, and links to the authority.
Breach Notification 1Who you must tell after a data breach, and how fast
LawProduceWhat it requiresTriggerEnforced by
Colorado data breach notification lawC.R.S. § 6-1-716 #Any commercial entity that maintains, owns or licenses computerized personal information about Colorado residentsDistribute
Notice
Investigate promptly and notify affected Colorado residents no later than 30 days after determining a breach occurred, covering the date of the breach, the types of information involved, contact details and credit reporting guidance. When 500 or more Colorado residents are affected, notify the Attorney General within the same 30 days; when more than 1,000 are affected, also notify the nationwide consumer reporting agencies.
From the first employee
Colorado Attorney General
Data Security Program 1A written safeguards program the state requires before anything goes wrong
LawProduceWhat it requiresTriggerEnforced by
Duty to protect personal identifying information and written disposal policyC.R.S. §§ 6-1-713, 6-1-713.5, 6-1-714 #Any covered entity that maintains, owns or licenses paper or electronic documents containing personal identifying information about Colorado residentsWrite
Written policy
Write and follow a document destruction policy that says how paper and electronic records holding personal identifying information are destroyed or made unreadable once they are no longer needed. Separately, keep reasonable security procedures and practices appropriate to the size of the business and the sensitivity of the data, and require third-party service providers by contract to do the same.
From the first employee
Colorado Attorney General
Consumer Privacy Law 1Rights, notices and assessments for consumer data
LawProduceWhat it requiresTriggerEnforced by
Colorado Privacy ActC.R.S. §§ 6-1-1301 to 6-1-1313; 4 CCR 904-3 (Attorney General rules) #Businesses that conduct business in Colorado or target Colorado residents and either control or process personal data of 100,000 or more consumers a year, or derive revenue or a discount from selling personal data and process data of 25,000 or more consumersWrite
Written policy
Publish a privacy notice listing the categories of personal data collected and shared, the purposes, how consumers exercise rights and appeal a refusal, and whether you sell data or use it for targeted advertising. Recognize universal opt-out signals from the Attorney General's approved list, get opt-in consent before processing sensitive data or a minor's data, put data processing agreements in place with processors, and document a data protection assessment for targeted advertising, data sales, sensitive data and profiling that presents heightened risk.
From the first employee
Colorado Attorney General; district attorneys
Biometric and Health Data 1Consent and retention rules for fingerprints, faces and health data
LawProduceWhat it requiresTriggerEnforced by
Biometric identifier provisions of the Colorado Privacy Act (HB 24-1130)C.R.S. § 6-1-1314 #Any controller that collects or processes biometric identifiers of Colorado residents, with no revenue or volume threshold; employers are covered when they collect employee biometricsWrite
Written policy
Adopt a written policy, made available to the public, that sets a retention schedule for biometric identifiers and a protocol for deleting them when the purpose ends, the employment relationship ends, or within 24 months of the person's last interaction, whichever comes first. Get consent before collecting, selling or disclosing biometric identifiers, and do not condition employment on consent except for a short list of purposes such as secure access, timekeeping and workplace safety.
From the first employee
Colorado Attorney General; district attorneys
Harassment Prevention 1A written policy, and in some states annual training, on harassment
LawProduceWhat it requiresTriggerEnforced by
Protecting Opportunities and Workers' Rights (POWR) ActC.R.S. §§ 24-34-402, 24-34-407 (SB 23-172) #Every employer covered by the Colorado Anti-Discrimination Act, including employers with a single employeeWrite + ack
Written program
Keep every personnel and employment record, including each written or oral complaint of discrimination, harassment or retaliation, for at least five years, and hold complaint records in a designated repository separate from personnel files. An employer that wants to rely on its own prevention program as a defense needs a written harassment prevention and complaint program that employees know about. Nondisclosure clauses in agreements with employees and applicants are void unless they carry the statutory mutual-confidentiality terms, an addendum signed by both sides and the specific carve-outs the Act requires.
From the first employee
Colorado Civil Rights Division; Colorado Civil Rights Commission
State Vendor Security Program 1Certification a vendor needs before selling cloud services to the state
LawProduceWhat it requiresTriggerEnforced by
Colorado OIT Vendor Security Validation standardGovernor's Office of Information Technology, Office of Information Security - Vendor Security Validation; Colorado Information Security Policies #Cloud and software vendors supplying Colorado state agenciesCertify
Certification
Show third-party assurance for the vendor's security program, ranked by completeness. GovRAMP authorization sits at the top and is what the state looks for where cloud risk and the sensitivity of government data are highest, evidenced by authorized status, listing verification and the authorization package. FedRAMP authorization is treated as equivalent. SOC 2 Type II, HITRUST or ISO 27001 are accepted as strong alternatives where a government authorization is not needed, and security questionnaires or an agency risk assessment are the fallback only when nothing more mature exists. Colorado is a GovRAMP participating government organization.
From the first employee
Colorado Governor's Office of Information Technology, Office of Information Security
Paid Leave Policies 2Sick and family leave laws that come with a written policy or notice
LawProduceWhat it requiresTriggerEnforced by
Healthy Families and Workplaces Act (paid sick leave)C.R.S. §§ 8-13.3-401 to 8-13.3-419; 7 CCR 1103-7 #Every Colorado employer of any size, public or private, other than the federal governmentWrite
Written policy
Accrue at least one hour of paid leave per 30 hours worked, up to 48 hours a year, and add up to 80 hours of public health emergency leave when one is declared. Give employees written notice of their rights, display the state's paid leave poster where employees can see it (or send it electronically to remote staff), and keep two years of records showing hours worked, leave accrued and leave taken. Most employers set the accrual, carryover and request rules out in a written sick leave policy.
From the first employee
Colorado Department of Labor and Employment, Division of Labor Standards and Statistics
Paid Family and Medical Leave Insurance (FAMLI)C.R.S. §§ 8-13.3-501 to 8-13.3-524; 7 CCR 1107-1 to 1107-5 #Every Colorado employer; employers with nine or fewer employees remit only the employee share of the premiumDistribute
Notice
Register with the FAMLI Division, withhold and remit quarterly premiums (or get approval for an equivalent private plan), display the FAMLI program notice at the workplace and give it to each new hire and to any employee who asks about leave, and keep the accompanying written policy on job protection and benefit continuation while an employee is on leave.
From the first employee
Colorado Department of Labor and Employment, Family and Medical Leave Insurance Division
Required Postings 1The notices every workplace in the state must display
LawProduceWhat it requiresTriggerEnforced by
Required workplace posters and noticesC.R.S. §§ 8-4-107, 8-13.3-408, 8-5-201; 7 CCR 1103-1 (COMPS Order) #Every Colorado employerPost + ack
Posting
Display the current CDLE poster set - the COMPS Order poster covering wages, hours, breaks and overtime, the paid leave and whistleblower notice, the FAMLI notice, unemployment insurance, workers' compensation, pregnancy accommodation and discrimination notices - where employees can see it, and send the same notices to remote employees. The COMPS Order poster must be given to each employee and, if you publish a handbook, the COMPS Order or poster must be included in it with a signed acknowledgment.
From the first employee
Colorado Department of Labor and Employment; Colorado Civil Rights Division
Pay Transparency 1Salary ranges in job posts and pay disclosure on request
LawProduceWhat it requiresTriggerEnforced by
Equal Pay for Equal Work Act, as amended by the Ensure Equal Pay for Equal Work ActC.R.S. §§ 8-5-201, 8-5-202, 8-5-203 (SB 19-085; SB 23-105); 7 CCR 1103-18 (POST Rules) #Every employer with at least one employee in Colorado, including out-of-state employers hiring for remote roles that can be performed in ColoradoDistribute
Notice
Put the pay or pay range, a general description of bonuses and benefits, and the application deadline in every job posting. Tell all employees who might be eligible about each job opportunity before making a selection, and within 30 days of filling it tell the people who work with the role who got it and how to express interest in similar openings in future. Keep job description and wage rate records for each employee for the length of employment plus two years.
From the first employee
Colorado Department of Labor and Employment, Division of Labor Standards and Statistics
Licensing and Certifications 1Registrations, licenses and certifications a business or its staff must hold
LawProduceWhat it requiresTriggerEnforced by
Business entity registration and periodic report (Secretary of State)C.R.S. Title 7 (Colorado Corporations and Associations Act); C.R.S. § 7-71-103 (trade names) #Corporations, LLCs, partnerships, nonprofits and out-of-state entities transacting business in Colorado; anyone trading under a name other than their ownFile
Filing / record
File formation or foreign-authority documents online with the Secretary of State, appoint a registered agent with a Colorado address, register any trade name, and file the periodic report each year in the anniversary month to keep the entity in good standing. Local business and sales tax licenses apply separately.
From the first employee
Colorado Secretary of State, Business and Licensing Division
Other Written Policies 3Any other document the state makes an employer write or hand out
LawProduceWhat it requiresTriggerEnforced by
Colorado SecureSavings retirement programC.R.S. §§ 24-54.3-101 et seq. #Employers that have been in business at least two years, have five or more employees, and do not offer a qualified retirement planDistribute + ack
Filing / record
Either certify an exemption because you already sponsor a qualified plan, or register with Colorado SecureSavings, upload the employee roster, distribute the program packet so employees have 30 days to opt out or change their contribution rate, and send payroll deductions each pay period. Registration and roster updates repeat as the workforce changes.
5+ employees
Colorado SecureSavings Program Board (Office of the State Treasurer)
Algorithmic systems transparency law (SB 26-189), replacing the 2024 Colorado AI ActSB 26-189, effective January 1, 2027; replaces SB 24-205 (C.R.S. §§ 6-1-1701 et seq.) #Developers and deployers of algorithmic systems used in consequential decisions about Colorado residents, including hiring, lending, housing, insurance and health careDistribute
Notice
Disclose to the people affected when an algorithmic system plays a role in a consequential decision about them, publish information about the systems in use, and keep the documentation needed to answer the Attorney General. The 2024 version of the law, which would have required a formal risk management program and algorithmic impact assessments, was replaced before it took effect, so the current obligation is centred on transparency and disclosure rather than a certified program.
From the first employee
Colorado Attorney General
Job Application Fairness Act and Chance to Compete Act (application content limits)C.R.S. § 8-2-131 (SB 23-058); C.R.S. § 8-2-130 (HB 19-1025) #Every Colorado employerDistribute
Notice
Strip age, date of birth and school attendance or graduation dates out of the initial job application, and remove any statement that people with criminal histories may not apply. You may still ask for material that happens to contain those dates if you tell the applicant they can redact them. Keep application forms and postings consistent with these limits, since complaints go to the Division of Labor Standards and Statistics.
From the first employee
Colorado Department of Labor and Employment, Division of Labor Standards and Statistics
Because You Are in Construction 1Industry layer
LawProduceWhat it requiresTriggerEnforced by
Electrical and plumbing trade licensingC.R.S. §§ 12-115-101 et seq. (electricians); §§ 12-155-101 et seq. (plumbers) #Electrical and plumbing contractors and the individual tradespeople who work for them; Colorado has no statewide general contractor license, which local jurisdictions handle insteadCertify
Certification
Register the contracting business with the State Electrical Board or State Plumbing Board, keep a licensed master on staff, make sure each worker holds the right apprentice, journeyman or master license and completes required continuing education, and pull permits and arrange inspections for regulated work. Apprentices must be registered and supervised at the ratios the board sets.
From the first employee
Colorado Department of Regulatory Agencies, Division of Professions and Occupations
Because You Are in Healthcare 1Industry layer
LawProduceWhat it requiresTriggerEnforced by
Health-Care Workplace Violence Incentive Payments (SB25-166) and the Hospital Quality Incentive Payment workplace violence measureSB 25-166 (2025 Colo. Sess. Laws ch. 169) #Colorado hospitals participating in the Hospital Quality Incentive Payment program; hospitals with fewer than 100 beds are exempt from the reporting requirementWrite
Written policy
Adopt a formal written workplace violence policy and file the required reporting with the Department of Public Health and Environment. From July 2026 the Department of Health Care Policy and Financing checks each July whether the hospital has done so. The 2027 measure adds a workplace violence prevention committee with a named lead and at least annual meetings, an annual worksite risk analysis reviewing the past year's incidents, staff training at hire and annually on definitions, roles, de-escalation and reporting, and a system to track, investigate and follow up incidents. Hospitals upload the policy itself as evidence.
From the first employee
Colorado Department of Health Care Policy and Financing; Colorado Department of Public Health and Environment
AuthorityColorado General Assembly - SB25-166 Health-Care Workplace Violence Incentive PaymentsColorado Department of Health Care Policy and Financing - 2027 Hospital Quality Incentive Payment Program Measure DetailsColorado Department of Health Care Policy and Financing - Hospital Quality Incentive Payment ProgramReport an error
Because You Are in Food & Beverage 1Industry layer
LawProduceWhat it requiresTriggerEnforced by
Retail food establishment license and certified food protection managerC.R.S. §§ 25-4-1601 et seq.; 6 CCR 1010-2 (Colorado Retail Food Establishment Rules) #Restaurants, grocery and convenience stores, caterers, mobile units and push cartsCertify
Certification
Hold a retail food license from the state or the local public health agency before opening and renew it each year, submit plans for new or remodeled facilities, and keep at least one certified food protection manager on staff with a current accredited certificate available for inspectors. Facilities also keep written employee health reporting agreements and, where required, a HACCP or variance plan.
From the first employee
Colorado Department of Public Health and Environment with local public health agencies
Because You Are in Financial & Tax 1Industry layer
LawProduceWhat it requiresTriggerEnforced by
Governance and risk management framework for external consumer data in insuranceC.R.S. § 10-3-1104.9 (SB 21-169); Insurance Regulation 10-1-1, 3 CCR 702-10 #Insurers licensed in Colorado that use external consumer data and information sources, algorithms or predictive models; the first regulation applies to life insurersWrite
Written program
Adopt a written governance and risk management framework covering how external data sources, algorithms and predictive models are chosen, tested for unfair discrimination, documented, approved by senior management and monitored over time, with named accountable roles and a remediation process. Report the framework and supporting testing results to the Division of Insurance on the schedule the regulation sets, and keep the underlying documentation available for examination.
From the first employee
Colorado Division of Insurance (Department of Regulatory Agencies)
Federal rules for a 15–19 person general business
Federal rules apply in every state, on top of the Colorado rules above.
From the publisher
Keep Your Written Policies in One Place
Whatever you are working toward, AllyMatter gets your policies approved, keeps every version and records who has read each one.
See how AllyMatter works ↗From $29/mo, 20 editors, unlimited staff
Your business type, with Colorado on top
Small businessFederal + industry, with Colorado on topConstruction contractorsFederal + industry, with Colorado on topHealthcare practicesFederal + industry, with Colorado on topFood and beverage businessesFederal + industry, with Colorado on topTax and accounting firmsFederal + industry, with Colorado on topRegistered investment advisersFederal + industry, with Colorado on topInsurance agenciesFederal + industry, with Colorado on topRetail and e-commerceFederal + industry, with Colorado on topTrucking and logistics carriersFederal + industry, with Colorado on topNonprofitsFederal + industry, with Colorado on topFederal contractorsFederal + industry, with Colorado on top
For another state
Alabama12Alaska12Arizona11Arkansas14California24Connecticut17Delaware17District of Columbia12Florida15Georgia13Hawaii16Idaho13Illinois19Indiana16Iowa13Kansas11Kentucky14Louisiana13Maine15Maryland19Massachusetts16Michigan15Minnesota19Mississippi11Missouri12Montana15Nebraska13Nevada18New Hampshire13New Jersey19New Mexico13New York17North Carolina12North Dakota13Ohio13Oklahoma11Oregon19Pennsylvania12Rhode Island13South Carolina12South Dakota11Tennessee14Texas15Utah13Vermont17Virginia17Washington21West Virginia14Wisconsin15Wyoming13
Need a hand implementing it?
Find a Consultant Who Does This Work
Tell us what you need done and we will point you to firms that do this work. Your details go to a firm only when you choose it.
Sources
Colorado Attorney General - Data Protection LawsColorado Attorney General - Data PrivacyColorado General Assembly - SB 21-190 Colorado Privacy ActColorado General Assembly - HB 24-1130 Privacy of Biometric IdentifiersColorado General Assembly - HB 18-1128 Protections for Consumer Data PrivacyColorado Attorney General - Consumer ProtectionColorado General Assembly - SB 23-172 Protecting Opportunities and Workers' Rights ActColorado Civil Rights DivisionColorado Department of Labor and Employment - Labor Law GuidanceColorado Division of Insurance - Insurance RegulationsColorado General Assembly - SB 21-169 Restrict Insurers' Use of External Consumer DataColorado Division of InsuranceColorado Department of Labor and Employment - Equal Pay for Equal Work ActColorado General Assembly - SB 23-105 Ensure Equal Pay for Equal WorkColorado Department of Labor and Employment - Wage and Hour Laws including Paid Sick LeaveColorado Department of Labor and Employment - INFO #6B Healthy Families and Workplaces ActColorado Department of Labor and Employment - PostersColorado FAMLI - EmployersColorado FAMLI - Employer ToolkitColorado General Assembly - Proposition 118 implementing statutesColorado Department of Labor and Employment - INFO #1 COMPS OrderColorado Secretary of State - Business and LicensingColorado Secretary of State - Business Database SearchColorado Department of Revenue - TaxationColorado Department of Public Health and Environment - Retail FoodCDPHE - Retail Food LicensingCDPHE - Retail Food ResourcesColorado Division of Professions and Occupations - ElectricalColorado Division of Professions and Occupations - PlumbingColorado Department of Regulatory AgenciesColorado SecureSavingsColorado General Assembly - SB 20-200 Implement CO Secure Savings ProgramColorado State TreasurerColorado General Assembly - SB 26-189Colorado General Assembly - SB 24-205 Consumer Protections for Artificial IntelligenceColorado General Assembly - SB 25B-004 Increase Transparency for Algorithmic SystemsColorado General Assembly - SB 23-058 Job Application Fairness ActColorado General Assembly - HB 19-1025 Limits on Job Applicant Criminal History InquiriesColorado General Assembly - SB25-166 Health-Care Workplace Violence Incentive PaymentsColorado Department of Health Care Policy and Financing - 2027 Hospital Quality Incentive Payment Program Measure DetailsColorado Department of Health Care Policy and Financing - Hospital Quality Incentive Payment ProgramColorado OIT - Vendor Security ValidationColorado OIT - Information Security Office (policies and technical standards)