Two States Just Passed AI Laws That Apply to Your Missouri Business. Here Is the 5-Question Scope Test.

Missouri has no omnibus AI statute. Governor Keyhoe’s Executive Order 26-02 (January 2026) directed state agencies to study AI, with reports due November 30, 2026. It created no private-sector compliance mandates.

That does not mean Missouri founders are unregulated.

On May 14, 2026 — the same day — Colorado and Connecticut each enacted laws that apply to businesses "doing business" in those states. If you hire a remote employee in Denver, serve a customer in Hartford, or accept an application from someone in Colorado Springs, these laws may apply to you regardless of where your business is headquartered.

Here is what changed, how to find out if it applies to you, and what to do this week.

What Changed on May 14

Colorado SB 26-189 was signed into law on May 14, 2026, and takes effect January 1, 2027. It applies to "deployers" — businesses that use automated decision-making technology (ADMT) that is a "substantial factor" in consequential decisions about employment, housing, lending, insurance, healthcare, or education. The previous 50-employee exemption was removed. Businesses of any size that "do business" in Colorado must comply.

Key requirements for deployers:

• Provide consumers a notice before ADMT is used to make a consequential decision about them

• disclose adverse outcomes caused by ADMT within 30 days

• Enable meaningful human review for consequential decisions

• Maintain records for three years

• Complete an annual impact assessment

Connecticut SB 5 (Public Act 26-15) was also enacted on May 14, 2026. Its Automated Employment-Related Decision Technology (AERDT) provisions take effect October 1, 2027. It applies to employers using AERDT that is a "material" factor in employment decisions — hiring, promotion, discipline, termination, or training — affecting employees or applicants in Connecticut.

Key requirements for employers:

• Provide pre-decision written notice before AERDT is used

• disclose adverse outcomes from AERDT-assisted decisions

• Maintain anti-discrimination policies covering AERDT use

• A 60-day cure period runs through December 31, 2027 (the Connecticut Attorney General enforces under CUTPA)

The 5-Question Scope Test

Answer these for your business this week:

1. Do you use AI tools that score, rank, classify, or recommend people? This includes resume screeners, credit-scoring models, tenant-screening tools, AI-assisted hiring platforms, and any chatbot that filters or prioritizes applicants. If a tool influences a consequential decision about a person, it probably counts.

2. Do you use AI tools for hiring, promotion, discipline, termination, or training? Connecticut's AERDT scope is narrower: it covers employment decisions specifically. If you use any AI-assisted tool in your hiring or performance process — even a résumé-ranking feature in your ATS — you should assume it is in scope.

3. Do you have Colorado customers, employees, or applicants? If yes, Colorado SB 26-189 likely applies to you. Colorado's "doing business" standard is broad. The Attorney General is expected to issue rulemaking that clarifies the threshold, but for now, a conservative approach is to assume that one Colorado customer, one remote employee, or one applicant from Colorado triggers deployer obligations.

4. Do you have Connecticut employees or applicants? If yes, Connecticut's AERDT provisions likely apply. The same nexus logic applies — one employee or one applicant in Connecticut is enough.

5. If yes to any combination — start a compliance file now. Do not wait for rulemaking. Do not wait for court interpretations. The laws are enacted. The deadlines are set. Build your compliance file with an AI tool inventory, pre-decision notice language, and a process for adverse-outcome disclosure.

What Each Law Requires — Founder Translation

The Cross-State Compliance Timeline

• Now: Run the 5-question scope test. Start your AI tool inventory.

• Summer 2026: Watch for Colorado AG proposed rulemaking on the "doing business" threshold.

• January 1, 2027: Colorado SB 26-189 takes effect. If you are in scope, you must have consumer notice, adverse-outcome disclosure, meaningful human review, and record retention in place.

• October 1, 2027: Connecticut AERDT employer obligations take effect. If you are in scope, you must have pre-decision written notice, adverse-outcome disclosure, and anti-discrimination policies in place.

• Through 2027–2030: Both states have cure periods that allow the Attorney General to give businesses 60 days to fix violations before enforcement action.

What to Do This Week

1. List every AI-driven tool in your stack. Use the framework from our SaaS Stack Audit. Identify which ones touch consequential or employment-related decisions about people.

2. Run the 5-question scope test above. If you answer yes to any combination, create a compliance file with: your AI tool inventory, which tools touch which states, and a calendar with both deadlines (January 1, 2027 and October 1, 2027).

3. Draft pre-decision notice language. Colorado requires consumer notice before ADMT use. Connecticut requires written notice with six specific elements before AERDT-assisted employment decisions. A single template can cover most of both, with state-specific addenda for timing and content differences.

4. Set adverse-outcome disclosure processes. Both laws require disclosure when AI-influenced decisions produce adverse outcomes. Build a simple process: who identifies the decision, who discloses it, and how the disclosure is delivered.

5. Document meaningful human review. Colorado requires that a human reviews consequential decisions made or influenced by ADMT. Document who reviews, what they review, and how they can override the AI.

6. Connect shadow AI to liability. Our Shadow AI Leadership Audit showed that 67–93% of decision-makers use unapproved AI tools. Under these new laws, unapproved tools that influence consequential decisions create compliance liability — you cannot disclose tools you do not know about. Map your shadow AI first using our Shadow AI Discovery Audit.

7. Calendar the deadlines. January 1, 2027 is 222 days from May 14, 2026. October 1, 2027 is 505 days. Both are closer than they look.

Why Compliance Is Also a Growth Move

Grant Thornton's data tells a story that reframes compliance from cost to advantage. Organizations with governed, integrated AI are nearly 4x more likely to report AI-driven revenue growth (58%) compared to organizations still piloting without governance (15%). The 78% who cannot pass an AI governance audit are not just exposed to legal risk — they are leaving revenue on the table.

The same gap appears in small businesses. Goldman Sachs' 10,000 Small Businesses survey found that 76% of small businesses use AI, but only 14% have it integrated into core operations. 73% say they need more training.

Compliance is not just about avoiding fines. It is about building the inventory, documentation, and human oversight that turn AI tools from shadow risks into governed assets. Start with Map First, Automate Second — before you add another tool, know which ones you already have and what they do.

Not Legal Advice

This post is operational guidance, not legal advice. The "doing business in Colorado" threshold is subject to Attorney General rulemaking. Connecticut's AERDT provisions are 17 months from effect and may be clarified by rulemaking before October 2027. No court has interpreted either law yet. Talk to a lawyer licensed in the relevant state before making compliance decisions.