New AI Admissions Laws: Colorado, California, EU (2027)

New AI Admissions Laws: Colorado, California, EU (2027)

For years, using AI to screen applicants or detect AI in essays was governed by nothing but institutional discretion. That's ending. Here's what's actually enacted, what's still a bill, and what schools will have to do — with the dates that changed in 2026.

The regulatory picture shifted materially this year, and a lot of the commentary online is now wrong because the laws moved underneath it. Colorado gutted and rewrote the first-in-nation AI Act. California locked in automated-decision rules with staged 2027 compliance. The EU formally pushed back its high-risk education deadline. And a federal executive order is now trying to preempt state AI laws altogether. There is still no admissions-specific federal statute in the US.

If your institution uses AI to rank applicants, allocate aid, score exams, or run AI-detection during assessments, the same handful of duties are converging on you regardless of jurisdiction. Below, the honest version — enacted vs. proposed, with the corrections.

Enacted vs. proposed — the honest split

On the books:

• Colorado SB 26-189 ("ADMTA") — signed May 14, 2026; obligations begin Jan 1, 2027.
• California CPPA ADMT regulations — finalized Sept 23, 2025; compliance for automated "significant decisions" phases in through 2027.
• California AB 2013 (generative-AI training-data transparency) — effective Jan 1, 2026.
• EU AI Act (education = high-risk) — enacted, but the high-risk deadline is now deferred to Dec 2, 2027.
• NYC Local Law 144 (automated hiring bias audits) — in force since 2023; the bias-audit template, not education law.

Not yet law (don't treat these as requirements):

• Most 2026 state AI-in-education bills — dozens are tracked, but the majority are task forces and study commissions, not binding admissions mandates.
• Any federal AI moratorium — Congress stripped it out; the December 2025 executive order is not legislation.

The laws, by jurisdiction

What schools using AI will actually have to do

Strip away the jurisdictional detail and the same four duties recur across Colorado, California, and the EU. Any institution using AI to screen applicants or flag AI in student work should plan for:

1. Notice / transparency — tell the applicant or student, up front, that an automated system will make or materially shape a decision about them.
2. Human review and appeal — provide a meaningful path to a human after an adverse automated decision. For an AI-detection workflow this is the single most important build: a flagged student must be able to reach a person who can override the score.
3. Explanation — give a plain-language account of the decision and the AI's role (Colorado: within 30 days). "The model is too complex to explain" is not accepted under ECOA-style logic.
4. Bias / impact testing — check for disparate impact. NYC's Local Law 144 is the template; California requires risk assessments; the EU requires risk management. And note: the US Department of Education's civil-rights office has warned that a detection tool which disproportionately flags non-native English speakers can trigger a Title VI investigation — a live federal risk regardless of any state statute.

If that list looks familiar, it should: it is essentially the AI-detection due-process ladder — notice, human review, contestability, bias audit — written into law. The regulation is catching up to the standard that courts and ombudsmen were already enforcing case by case, and that many schools adopted voluntarily when they turned their detectors off.

The corrections everyone's getting wrong

Precision matters here, because a lot of 2025 commentary is now out of date:

• Colorado's original AI Act (SB 24-205) is repealed. It never took effect. The widely described "duty of care / algorithmic-discrimination / mandatory impact assessment" framework was replaced by the lighter, disclosure-and-rights SB 26-189. Don't cite the old version as current law.
• The EU's "August 2026" education deadline is gone. The finalized Digital Omnibus (adopted June 29, 2026) moved high-risk Annex III obligations to December 2, 2027. The duties are deferred, not deleted.
• No private right of action. Colorado's law is enforced only by the Attorney General; California's by the CPPA/AG. A student generally can't sue directly under these AI statutes — the leverage is regulatory, plus the existing civil-rights and due-process routes.
• A federal preemption fight is live. A December 2025 executive order created a DOJ task force to challenge state AI laws and conditions some grant funding on states not enacting "onerous" AI rules. It doesn't invalidate Colorado's or California's laws today, but it adds real uncertainty.
• Employment laws aren't education laws. NYC Local Law 144 and Illinois's HB 3773 cover hiring, not admissions — useful as the bias-audit template, not as a mandate on schools.

What it means

For applicants and students, the direction is good: notice, a human in the loop, an explanation, and a check on bias are becoming legal defaults rather than favors. In the meantime, a student flagged today still relies on the practical steps for clearing a false accusation. For institutions, the compliance build is the same whether the driver is Colorado, California, Brussels, or a lawsuit — which is why the smart move is to hold every AI-detection or AI-screening workflow to the due-process standard now, instead of rebuilding it under each new deadline. The enforcement gap between AI rules and reality is exactly what these laws are trying to close.

---

This is a plain-language explainer, not legal advice; institutions should consult counsel, and effective dates and rulemaking are still moving. Statuses and dates are current as of July 2026 and sourced below. GradPilot is an independent essay-review platform.

Sources

• Colorado General Assembly, SB 26-189 (ADMTA) bill page; Skadden and Lathrop GPM client alerts on the repeal-and-replace (May–Jun 2026).
• California Privacy Protection Agency — final ADMT regulations announcement (Sept 23, 2025); AB 2013 (training-data transparency).
• EU Artificial Intelligence Act, Annex III (education as high-risk); Council of the EU press release on the Digital Omnibus (Jun 29, 2026); Gibson Dunn on the Dec 2, 2027 deadline.
• US Department of Education, Office for Civil Rights — "Avoiding the Discriminatory Use of Artificial Intelligence."
• NYC DCWP — Automated Employment Decision Tools (Local Law 144).
• White House executive order, "Ensuring a National Policy Framework for AI" (Dec 11, 2025); FutureEd 2026 state AI-in-education bill tracker.