What is the 'Excel Problem' in AI compliance?

The 'Excel Problem' refers to the use of spreadsheets or simple automated tools that use formulas or logic to rank, filter, or score individuals (like job applicants). Under the Colorado AI Act (SB 24-205), these can be classified as high-risk AI systems if they are a substantial factor in consequential decisions.

Is my hiring spreadsheet considered a high-risk AI system?

If your spreadsheet uses automated logic to filter or rank candidates before a human reviews them, it may be considered a high-risk system under SB 24-205, as it makes a 'consequential decision' regarding employment.

What are the penalties for non-compliant high-risk AI in Colorado?

Non-compliance can lead to liability for algorithmic discrimination and failure to meet audit requirements, including documented risk management programs and annual impact assessments required by the Colorado Attorney General.

How can I build an affirmative defense for my hiring process?

To build an affirmative defense, you must implement a formal AI Risk Management Program (aligned with NIST AI RMF), conduct annual impact assessments, and ensure all automated decisions have a clear, citable audit trail (provenance).

The Hidden Danger in Your "Simple" Spreadsheet

jasonpellerinfreel
2 days ago
3 min read

Most hiring managers in Denver think they are safe from the Colorado AI Act (SB24-205) because they haven't deployed a complex "AI Agent" or a humanoid robot to conduct interviews. They rely on what they consider a "neutral" tool: a spreadsheet.

But here is the $10,000 question: Does that spreadsheet use a formula to rank candidates? Does it sort resumes based on keywords? Does it assign a "score" that determines who gets an interview and who gets a rejection?

If the answer is yes, you may have just discovered the "Excel Problem." Under Colorado law, your "simple" spreadsheet might officially be a High-Risk AI System.

What Defines a "High-Risk" System in Colorado?

Under SB 24-205, an AI system is classified as "High-Risk" if it is a substantial factor in making a consequential decision.

A "consequential decision" includes any decision that has a material legal or similarly significant effect on a consumer (or job seeker) in areas like:

*Employment & Hiring**

* Education & Admissions

* Financial & Banking Services

* Housing

* Healthcare

If your spreadsheet—or the third-party tool you use to manage it—uses any form of automated logic to filter or rank applicants, it is no longer just a document. It is a decision-making engine subject to state oversight.

---

The "Substantial Factor" Trap

Many firms believe that because a human makes the final hire, the tool isn't "high-risk." This is a dangerous misunderstanding.

The law applies to any system that is a "substantial factor" in the process. If your automated ranking tool (even a basic Excel macro) causes a qualified candidate to be filtered out before a human ever sees their name, that tool has made a consequential decision.

In the eyes of the Colorado Attorney General, you are now a "deployer" of high-risk AI.

---

The Cost of the "Excel Problem"

If your hiring process is found to be using an un-governed high-risk system, the consequences are more than just a slap on the wrist:

1. Algorithmic Discrimination Liability: If your formulas inadvertently favor one demographic over another, you are liable for discrimination.

2. Audit Failures: SB 24-205 requires a documented Risk Management Program and annual Impact Assessments. A spreadsheet with no audit trail is a compliance nightmare.

3. The June 30, 2026 Deadline: The "Compliance Reprieve" is ticking away. By mid-2026, "I didn't know it was AI" will not be a valid legal defense.

---

How to Solve the Excel Problem

You don't have to stop using data to hire, but you must stop using data blindly. To build an Affirmative Defense, you need to move from "Shadow AI" (untracked spreadsheets) to Grounded Infrastructure.

1. Inventory Your Tools: Audit every spreadsheet and SaaS tool used in your hiring, banking, or legal intake processes.

2. Implement Runtime Governance: Ensure every automated decision is logged, citable, and reversible. (See our Sovereign Runtime Framework).

3. Use Grounded Intelligence: If you use AI to summarize resumes or research candidates, use tools like Compliance Web Intel that provide source citations and audit trails for every claim.

---

Are You Ready for the Audit?

The difference between a "data-driven firm" and a "non-compliant deployer" is Provenance. If you can't show the Attorney General exactly why your system ranked Candidate A over Candidate B, you are at risk.

Don't let a spreadsheet sink your practice.

*Conduct a Vulnerability Audit:** Book a Free Bottleneck & AI Risk Audit.

*Build Your Defense:** Learn how to implement NIST-aligned AI Risk Management.

*Get Grounded:** Deploy Hyper-Reader to ensure your AI only acts on verified, citable data.

---

Jason Pellerin is a Denver-based AI Solutionist and the creator of the Guild of 9 Apify Actors. He helps firms navigate the intersection of high-performance automation and regulatory architecture.