US state law · Sources checked November 7, 2026
Colorado AI Act: What SB 26-189 Requires in 2027
Many pages about the “Colorado AI Act” still describe SB 24-205, the 2024 law. On May 14, 2026, before its delayed June 30 start date, Colorado signed SB 26-189, which repeals and re-enacts it as rules for automated decision-making technology. For decisions made on or after January 1, 2027, an organization doing business in Colorado that uses such technology to materially influence a decision about a person’s education, employment, housing, financial or lending services, insurance, health care, or government services and benefits must tell them first, explain an adverse outcome within 30 days, and, on request, give data correction instructions and human review to the extent commercially reasonable. Developers owe those organizations documentation. Some health-care, insurance, and FDA-regulated uses are exempt. Only the Attorney General enforces it, and its rules are due by January 1.
What changed
SB 24-205 next to SB 26-189
The duty of care is gone. Notice, explanation, and review replace it.
The left column is the 2024 law as the General Assembly summarized it when enacted. The right column is the signed text of SB 26-189, with the section of the Colorado Revised Statutes where each rule now sits.
| Topic | SB 24-205 (2024) | SB 26-189 (from January 1, 2027) | Source |
|---|---|---|---|
| When it starts | February 1, 2026, later moved to June 30, 2026 by SB 25B-004. | Consequential decisions made on or after January 1, 2027 (Section 5). | SB 24-205, bill summarySB 25B-004SB 26-189, signed act |
| What it covers | High-risk artificial intelligence systems used in consequential decisions. | Automated decision-making technology (ADMT) that materially influences a consequential decision, called covered ADMT (6-1-1701(2), (5), (13)). | SB 24-205, bill summarySB 26-189, signed act |
| The core duty | Developers and deployers use reasonable care to protect consumers from known or reasonably foreseeable risks of algorithmic discrimination. | No general duty of care. Disclosure duties and consumer rights instead; discrimination claims stay under existing law, with fault split by relative fault (6-1-1707). | SB 24-205, bill summarySB 26-189, signed act |
| Risk program and impact assessment | Deployers implement a risk management policy and program, complete an impact assessment, and review each system yearly. | Not required anywhere in the act. | SB 24-205, bill summarySB 26-189, signed act |
| Telling the Attorney General | Report discovered algorithmic discrimination within 90 days. | No reporting duty for businesses. The Attorney General reports enforcement and cure numbers to lawmakers in January from 2028 until that subsection is repealed on January 1, 2030 (6-1-1706(3)(e), (f)). | SB 24-205, bill summarySB 26-189, signed act |
| Notice to the person | Notify the consumer when a high-risk system makes, or is a substantial factor in making, a consequential decision about them. | Before using covered ADMT to materially influence a consequential decision, a clear and conspicuous notice that covered ADMT was or will be used in a consequential decision affecting the consumer, with instructions for getting more information. A prominent public notice reasonably accessible at points of consumer interaction, including through a link or posting reasonably near the interaction or transaction, satisfies it (6-1-1704(1), (2)). | SB 24-205, bill summarySB 26-189, signed act |
| After an adverse decision | A chance to correct incorrect personal data, and to appeal through human review if technically feasible. | Within 30 days: what was decided and the ADMT’s role, how to get more information, and the person’s rights. On request: instructions for requesting personal data and correcting factually incorrect or materially inaccurate personal data, and an opportunity for meaningful human review and reconsideration to the extent commercially reasonable (6-1-1704(3), 6-1-1705). | SB 24-205, bill summarySB 26-189, signed act |
| Defense or cure | An affirmative defense for following a recognized AI risk management framework and finding and fixing violations. | A notice of violation and 60 days to cure where the Attorney General deems a cure possible, until January 1, 2030. No cure period if the Attorney General finds and can demonstrate a knowing or repeated violation (6-1-1706(3)). | SB 24-205, bill summarySB 26-189, signed act |
| Chatbots | Tell consumers they are interacting with an AI system. | Not in SB 26-189. Technology that communicates with consumers in natural language or other means readily understood by an average consumer is not ADMT if it is not contracted, advertised, marketed, configured, or intended for use in a consequential decision and is subject to an acceptable use policy that prohibits using its generated content in one (6-1-1701(2)(b)(III)). HB 26-1263 sets chatbot duties from January 1, 2027. | SB 24-205, bill summarySB 26-189, signed actHB 26-1263 |
| Who enforces it | The Attorney General only; a violation is a deceptive trade practice. | The Attorney General only, through the Colorado Consumer Protection Act. The act states that it creates no new private right of action (6-1-1706, 6-1-1709). | SB 24-205, bill summarySB 26-189, signed act |
The left column is the legislature’s summary of SB 24-205; its bill page has the full text. Everything in the right column is in the signed act, which also appropriates $46,190 and 0.4 of a full-time position to the Department of Law for 2026-27 (Section 4).
Coverage check
Six questions, one tool at a time, nothing collected
Is this tool covered ADMT?
Covered means four things are all true: it is ADMT, the decision is a consequential decision in one of seven areas, the output materially influences it, and the decision is about a consumer as the act defines one. Answer for one tool and one kind of decision. The result quotes the duties that follow and the sector rules that change them.
0 of 6 answered
Answer for one tool and one kind of decision at a time. Nothing you select is stored or sent anywhere. The result restates the sections of SB 26-189 that apply; it is not legal advice.
What is covered
Seven decision areas, and the long list of what does not count
The law follows the decision, not the technology label.
ADMT is a technology that processes personal data and uses computation to generate output, including predictions, recommendations, classifications, rankings, scores, or other information, that is used to make, guide, or assist a decision, judgment, or determination concerning an individual (6-1-1701(2)). It becomes covered ADMT when it is used to materially influence a consequential decision: its output is a non-de minimis factor used in making the decision, and it affects the outcome, including by constraining, ranking, scoring, recommending, classifying, or otherwise meaningfully altering how the decision is made (6-1-1701(5), (13)). Incidental, trivial, or clerical uses do not count.
A consequential decision is a decision, determination, or action about a consumer that relates to the provision of, or the consumer’s access to, eligibility for, selection for, or compensation for, a covered domain; or that relates to a differentiated price, cost sharing, compensation, or other material terms in a manner reasonably likely to materially limit, delay, effectively deny, or otherwise fundamentally alter the consumer’s access, eligibility, or opportunity for a covered domain (6-1-1701(3)(a)).
An adverse outcome is a decision that denies, terminates, revokes, or materially reduces or restricts a consumer’s access to, eligibility for, selection for, compensation for, or the provision of an opportunity or service; or a decision that results in a materially less favorable differentiated price, cost, compensation, or other material terms, compared to terms offered to similarly situated consumers, that are reasonably likely to materially limit, delay, or effectively deny, or otherwise fundamentally alter, the consumer’s access to, eligibility for, selection for, compensation for, or the provision of an opportunity or service (6-1-1701(1)).
Covered domains, 6-1-1701(6)
The seven covered domains
- Education enrollment or an education opportunity.
- Employment, or an employment opportunity that creates or may create an employer-employee relationship.
- The lease or purchase of residential real estate in Colorado.
- A financial or lending service.
- Insurance, including underwriting, pricing, coverage, claims adjudication, or other determinations that materially affect access to benefits.
- Health-care services.
- Essential government services and public benefits, including eligibility and renewal determinations.
Not covered, 6-1-1701(2)(b) and (3)(b)
Three exclusions from ADMT and nine from “consequential decision”
- Not ADMT, (2)(b)(I): anti-malware; anti-virus; calculators; databases; data storage; firewalls; internet domain registration; internet website loading; networking; spam- and robocall-filtering; spell-checking; spreadsheets that require human analysis and do not use machine learning, foundation models, or large language models; web caching; or web hosting.
- Not ADMT, (2)(b)(II): a tool used by an individual solely to summarize, organize, translate, draft, route, or present information for human review of administrative processing.
- Not ADMT, (2)(b)(III): technology that communicates with consumers in natural language or other means readily understood by an average consumer to provide information, make referrals or recommendations, answer questions, or generate other content, if it is not contracted, advertised, marketed, configured, or intended by a person to be used in a consequential decision, and it is subject to an acceptable use policy that prohibits its generated content from being used in a consequential decision.
- Not a consequential decision, (3)(b)(I): low-stakes or routine decisions, actions, and business processes that do not materially influence eligibility for, selection for, denial of, compensation for, pricing of, or access to an opportunity or service for a covered domain, including routine scheduling, classroom personalization, administrative routing, customer service triage, communication of decisions, or workflow management.
- Not a consequential decision, (3)(b)(II): advertising, marketing, differentiated product recommendations, search, or content moderation.
- Not a consequential decision, (3)(b)(III): spreadsheets that require manual human analysis and do not use machine learning, foundation models, or large language models.
- Not a consequential decision, (3)(b)(IV): actions in which ADMT is used to summarize, organize, or present information for human review and the system does not produce a score, ranking, recommendation, classification, prediction, or other inference that materially influences an outcome or a decision.
- Not a consequential decision, (3)(b)(V): narrow procedural tasks or data-processing functions that do not generate a prediction or inference about a consumer or materially influence a consequential decision or consequential decision process.
- Not a consequential decision, (3)(b)(VI): activities relating to technologies used for cybersecurity, spam- and robocall-filtering, system reliability, and anti-money laundering and counter-terrorist financing controls.
- Not a consequential decision, (3)(b)(VII): activities relating to technologies used for economic sanctions compliance, including under the federal Bank Secrecy Act, the USA PATRIOT Act, the Federal Trade Commission’s Red Flags Rule, and sanctions programs administered by the U.S. Department of the Treasury, excluding facial recognition unless its sole purpose is to confirm an individual’s identity.
- Not a consequential decision, (3)(b)(VIII): activities relating to technologies used for fraud prevention, including identity verification, consumer identification, monitoring, and reporting controls required under state or federal law.
- Not a consequential decision, (3)(b)(IX): routine academic administration and student support processes that do not materially influence a consequential decision.
Deployer duties
If your organization uses covered ADMT
Four moments where the law asks something of you.
A deployer is a person doing business in Colorado that deploys covered ADMT (6-1-1701(7)). An organization that uses bought screening, scoring, or eligibility software to materially influence these decisions is a deployer of it.
Before the decision
- Give a clear and conspicuous notice that you used or will use covered ADMT in a consequential decision affecting the person, with instructions for getting more information (6-1-1704(1)).
- A prominent public notice, reasonably accessible at the points of consumer interaction, including through a link or posting reasonably near the interaction or transaction, satisfies this (6-1-1704(2)).
Within 30 days of an adverse outcome
- A plain-language description of the decision and the role the covered ADMT played.
- Instructions and a simple-to-follow process to request more information about the covered ADMT and its inputs, including the ADMT’s name, version number if applicable, its developer, and the types, categories, and sources of personal data used, to the extent the deployer receives that information from the developer under 6-1-1702.
- An explanation of the person’s rights under 6-1-1705 and how to use them (6-1-1704(3)).
When the person asks, after an adverse outcome
- Instructions for requesting their personal data and correcting factually incorrect or materially inaccurate personal data used in the decision, consistent with section 6-1-1306 of the Colorado Privacy Act (6-1-1705(1)(a)(I)).
- An opportunity for meaningful human review and reconsideration, to the extent commercially reasonable (6-1-1705(1)(a)(II)).
- You do not have to correct opinions, predictions, scores, or protected evaluations (6-1-1705(1)(c)).
Throughout
- Keep records reasonably necessary to show compliance for at least three years after each decision, or longer if other law requires; as applicable, these may include version identifiers, changelogs, and documentation of material mitigation changes (6-1-1703).
- Make notices reasonably accessible to people with disabilities and people with limited English proficiency, consistent with state and federal law (6-1-1704(8)).
- If you withhold a trade secret or legally protected information, tell the person you did (6-1-1704(5)).
Meaningful human review has a definition: review by someone the deployer designates, with authority to approve, modify, or override the decision, who considers relevant, available primary evidence, is trained to conduct the review, does not default to the system output, and has access to enough information to understand the output’s intended use, material limitations, and categories of inputs, and the principal factors used to generate it, without requiring disclosure of proprietary source code, model weights, or other trade secrets (6-1-1701(15)). The human-centered AI framework shows how to build that step into a workflow.
Developer duties
If you develop, sell, license, or substantially modify covered ADMT
Five things every deployer customer must receive.
From January 1, 2027, a developer makes these available to each deployer of covered ADMT it developed, in a form and manner reasonably understandable to the deployer that protects trade secrets and information protected from disclosure by state or federal law (6-1-1702(1)). These duties and the update notices below apply only to a deployer’s use of covered ADMT where the ADMT was marketed, advertised, configured, contracted, sold, or licensed to be used to materially influence a consequential decision (6-1-1702(3)).
- a
A general statement of the intended uses and the known harmful or inappropriate uses.
- b
The categories of data, including personal data, used to train it, to the extent known.
- c
Known limitations, including known risks and the circumstances in which it should not be used.
- d
Instructions for the deployer’s appropriate use, monitoring, and meaningful human review, where applicable.
- e
Information reasonably necessary for the deployer to comply with its disclosure duties in 6-1-1704. If information is withheld, the developer notifies the deployer.
Developers also notify each deployer of material updates, intentional and substantial modifications, and changes to intended use, limitations, or risk mitigation within a reasonable time; public release notes containing that information count if the developer gives each deployer direct notice of the release (6-1-1702(2)). Records reasonably necessary to show compliance, including version identifiers, changelogs, and the update notices sent, are kept at least three years after each record is created, or longer if other law requires (6-1-1702(4)). You are not a developer if you develop and use ADMT solely for research and do not use it in a consequential decision in the research, or for internal purposes, such as use and development by affiliates and commercial support functions, without making it available to another person for use in a consequential decision; if you are a preceding developer that made an ADMT commercially available and an unaffiliated person modifies the covered ADMT in a way that changes its intended, documented, marketed, advertised, configured, or contracted use; or if you designed, marketed, intended, documented, advertised, configured, or contracted a component used as part of an ADMT and it is integrated into covered ADMT without your actual knowledge (6-1-1701(8)(b)).
Sector rules
Health care, insurance, credit, and education
Who is exempt, and what the exempt still owe.
The exemptions are narrower than they look. A hospital’s hiring tools are still covered, a health-care provider not operating from a location within Colorado does not get the HIPAA exemption, and covered entities still owe patients a general notice.
| Who | What the act says | Section |
|---|---|---|
| HIPAA covered entities and their business associates | Sections 6-1-1701 to 6-1-1706 do not apply to a covered entity doing business in Colorado, or to its business associates for services rendered to it, except to decisions about employment or an employment opportunity. | 6-1-1708(3)(a) |
| Health-care providers | The HIPAA exemption applies to a provider only if it operates from a location within Colorado. | 6-1-1708(3)(b) |
| HIPAA covered entities using the exemption | Must give patients a general notice of its use of advanced technologies, including covered ADMT. It can sit with the other patient-rights notices. | 6-1-1708(3)(c) |
| Covered entities deciding financial assistance | When a covered entity uses covered ADMT to determine a patient’s eligibility for financial assistance, including discounted care: a plain-language description of the decision and the ADMT’s role, the types of information about the person relied on (except trade secrets and other confidential or legally protected information), how to request correction of materially inaccurate personal data, and how to request meaningful human review or reconsideration where applicable, given in advance or within 30 calendar days after an adverse outcome. | 6-1-1708(3)(d), (e) |
| FDA-regulated medical devices | Sections 6-1-1701 to 6-1-1706 do not apply to a medical device subject to FDA oversight, or to a pharmaceutical or medical device manufacturer’s FDA-overseen research and development, including clinical investigations. | 6-1-1708(4) |
| HIPAA covered entities and business associates, federal privacy conflicts | Nothing in the act requires disclosing protected health information or other information in a way that would violate federal law. Where 6-1-1704 or 6-1-1705 would conflict with federal health privacy requirements, the deployer follows federal law and gives disclosures and access consistent with it. | 6-1-1708(5) |
| Nonpublic personal information under the Gramm-Leach-Bliley Act | The act does not require anyone to disclose nonpublic personal information in a way that would violate the Gramm-Leach-Bliley Act or its implementing regulations. | 6-1-1708(6) |
| Insurers under C.R.S. 10-3-1104.9 | An insurer, and affiliated entities, subject to 10-3-1104.9 is in compliance in the practice of insurance; an insurer not deemed in compliance gives the 6-1-1704(3) disclosures for its use of covered ADMT in insurance decisions, to the extent applicable. Their uses of covered ADMT for their own employment and employment opportunities are still covered. | 6-1-1708(1), (2) |
| Creditors | A notice the creditor must and does give under the Equal Credit Opportunity Act and Regulation B (and, when applicable, the Fair Credit Reporting Act) for the same credit decision satisfies these notice duties if it also meets them; no separate notice. | 6-1-1704(6) |
| Schools and colleges under FERPA | For an education decision, a deployer subject to FERPA satisfies the notice and disclosure duties through processes and channels consistent with FERPA and its FERPA notices and student record access procedures, and the correction and review rights through its existing student record inspection, review, and amendment procedures and any district complaint or appeal process, if it offers a reasonable way for a parent, guardian, or eligible student to request correction of materially inaccurate personal data and reconsideration where applicable. It need not set up a separate process if it already has one that complies with FERPA. | 6-1-1704(9), 6-1-1705(2) |
| Security and financial-crime programs | No disclosure, explanation, or information is required to the extent federal law prohibits it or it would compromise the confidentiality or integrity of cybersecurity, fraud prevention, anti-money laundering, counter-terrorist financing, or economic sanctions compliance programs required by law. | 6-1-1704(7) |
Enforcement
Penalties, the cure period, and the court order
One enforcer, a cure window, and no new private lawsuits.
- 01
Only the Attorney General enforces it
The disclosure duties and consumer rights are enforceable exclusively by the Attorney General, through the Colorado Consumer Protection Act. A violation is a deceptive trade practice.
6-1-1706(1), (2) - 02
Up to $20,000 for each violation
The legislature’s final fiscal note says a deceptive trade practice under the Colorado Consumer Protection Act may carry a civil penalty of up to $20,000 for each violation. Because the number of cases, the rules, and penalty amounts are uncertain, the note does not estimate the penalty revenue.
Final fiscal note, September 8, 2026 - 03
Notice and 60 days to cure, until 2030
Before any enforcement action, the Attorney General sends a notice of violation if it deems a cure possible, and may sue if the violation is not cured within 60 days. No cure period is owed if the Attorney General finds and can demonstrate a knowing or repeated violation. This cure rule is repealed January 1, 2030.
6-1-1706(3) - 04
No new private lawsuits under this law
The act creates no new private right of action. Existing rights stay, including under the Colorado Anti-Discrimination Act and product liability law.
6-1-1706(4), 6-1-1709 - 05
Discrimination liability is split by fault
In an action alleging unlawful discrimination under state anti-discrimination law arising from a consequential decision materially influenced by covered ADMT, fault is allocated among deployers and developers based on their relative fault. The act creates no joint and several liability beyond what existing law permits, and does not limit a deployer’s liability for its own independent acts or omissions. A developer is liable only to the extent its covered ADMT was used in a manner it intended, documented, marketed, advertised, configured, or contracted for, and materially influenced the decision. A contract clause that indemnifies, defends, or holds harmless a developer or deployer for its own acts or omissions in violation of Colorado anti-discrimination law is void, except for a developer that complied with 6-1-1702 when the use was one it did not intend, document, market, advertise, configure, or contract for.
6-1-1707 - 06
A federal court order is in place
The final fiscal note reports that on April 27, 2026, a U.S. District Court ordered the Attorney General not to start enforcing SB 24-205 or any legislation amending it until the Attorney General completes rulemaking and the court rules in “X. AI LLC v. Weiser.”
Final fiscal note, Legal Proceedings
Dates
Checked November 7, 2026
From the 2024 act to the January 2027 start.
- Old law
The Governor approves SB 24-205, the original Colorado AI Act, with duties from February 1, 2026.
SB 24-205 - Old law
SB 25B-004, passed in a special session, moves SB 24-205’s start date to June 30, 2026.
SB 25B-004 - New law
The Governor signs SB 26-189, which repeals and re-enacts the law. The sections ordering the Attorney General’s rules take effect on signing.
SB 26-189 bill history - Rules
The Department of Law files proposed rules for SB 26-189 and the chatbot law with the Secretary of State, after a public comment form that closed July 13.
Proposed rules (docx) - Rules
The Department of Law releases an interim draft of the rules.
Interim draft (PDF) - Rules
A regulatory analysis of the rules is released after a request filed October 12.
Regulatory analysis (PDF) - Rules
Formal rulemaking hearing. Written comments received by 11:59 p.m. MST that day go into the record for the final rules.
Colorado Attorney General - New law
Duties apply to consequential decisions made on or after this date. The Attorney General’s rules on the 30-day disclosures and consumer rights are due on or before it. The duties in HB 26-1263, the chatbot law, start too; its session law took effect August 12, 2026.
SB 26-189, Section 5 - Oversight
The Attorney General’s first annual report to lawmakers on enforcement actions and cure periods.
6-1-1706(3)(e) - New law
The notice-and-cure rule is repealed.
6-1-1706(3)(f)
As of November 7, 2026, the Attorney General’s rulemaking page lists the October 26 hearing as the latest step and no adopted rules. The rules will clarify the content of the 30-day disclosures and may add presumptions, illustrative examples, and objective indicators for what “materially influence” means (6-1-1706(5)(b)). Recheck before you finalize letters.
Eight weeks out
A suggested order of work for a deployer
What to finish before January 1, 2027.
This order is the Institute’s suggestion, not a legal requirement. Each step points to the section it serves and, where one exists, the free Institute document that records the decision.
- W1
List every tool that scores, ranks, screens, or recommends in the seven areas
Include features inside software you already buy: applicant screening in the hiring system, credit or pricing models, admissions scoring, claims triage, patient financial assistance checks.
Record each one with the AI risk assessment method - W2
Run each tool through the coverage check and write down why it is in or out
The exclusions are specific. A tool used solely to summarize, organize, translate, draft, route, or present information for human review is outside ADMT; once its output scores, ranks, recommends, or classifies in a way that materially influences the decision, it can be covered.
Use the coverage check - W3
Ask each vendor for the five documentation items
Request the 6-1-1702(1) package in writing, and ask how the vendor will tell you about material updates. Your own 30-day letters depend on what the vendor gives you.
- W4
Check every chat assistant against the exclusion
A chat tool fits the chatbot exclusion from ADMT only if it is not contracted, advertised, marketed, configured, or intended for use in consequential decisions and an acceptable use policy prohibits using its generated content in one. If staff could paste its output into a hiring or eligibility decision, the policy has to say no.
Adapt the AI acceptable use policy - W5
Write the notice and decide where it appears
On the application, the job posting, the portal, or a prominent public notice linked next to the step where the decision is made.
- W6
Draft the 30-day adverse-outcome letter and the correction route
Three parts: the decision and the ADMT’s role, how to request the details, and the person’s rights. Route correction requests through your Colorado Privacy Act correction process. Hold the final wording until the Attorney General adopts the rules.
- W7
Name and train the human reviewers
The law’s test: a reviewer the deployer designates, with authority to approve, modify, or override, who considers the relevant, available primary evidence, is trained to conduct the review, does not default to the system output, and has enough information to understand the output’s intended use, material limitations, and categories of inputs, and the principal factors used to generate it.
Design the review step with the human-centered framework - W8
Set three-year retention and recheck the rules
Keep version identifiers, changelogs, and mitigation changes for three years after each decision. Before January 1, check the Attorney General’s rulemaking page for the adopted rules.
If you need outside help
Know which part you are paying for
Counsel for the letters, governance help for the inventory.
Wording the notices and the 30-day letter for your sector is legal work. Building the inventory, the vendor documentation requests, the review step, and the records is AI governance work. The Institute’s AI governance consulting guide lists the engagement types, the timelines and fee ranges firms publish, and the groundwork you can finish before you pay anyone. To see where Colorado sits next to the EU AI Act, the NIST AI RMF, and ISO/IEC 42001, use the framework router.
Common questions
Colorado AI Act FAQ
Answers to the questions people search for.
Is the Colorado AI Act in effect?
Not in its new form yet. SB 26-189 applies to consequential decisions made on or after January 1, 2027; a few sections, including the ones that order the Attorney General’s rules, took effect when it was signed on May 14, 2026. The legislature’s final fiscal note also reports an April 27, 2026 federal court order barring the Attorney General from starting enforcement of SB 24-205 or any law amending it until rulemaking is complete and the court rules in X. AI LLC v. Weiser.
Was the Colorado AI Act repealed?
It was repealed and re-enacted. Section 1 of SB 26-189 repeals and reenacts, with amendments, Part 17 of Article 1 of Title 6 of the Colorado Revised Statutes, the part SB 24-205 created. The new Part 17 regulates automated decision-making technology in consequential decisions instead of high-risk AI systems.
What is the new AI law in Colorado?
SB 26-189, Automated Decision-Making Technology, signed May 14, 2026. It requires developers to give deployers documentation, requires deployers to give notice before using covered ADMT and an explanation within 30 days of an adverse outcome, and lets a person who gets an adverse outcome request data correction instructions and, to the extent commercially reasonable, meaningful human review. A separate law, HB 26-1263, sets rules for public chatbots from January 1, 2027.
Does it apply to companies outside Colorado?
It applies to a person doing business in Colorado that develops or deploys covered ADMT. The people it protects include an employee, a job applicant who is a Colorado resident, and any individual whose access to, eligibility for, or opportunity in Colorado is evaluated in a consequential decision by a person doing business in Colorado; otherwise “consumer” has the Colorado Privacy Act’s meaning (6-1-1701(4)). The test in the act is doing business in Colorado, not where you are headquartered.
Is there a small business exemption?
The act as signed has no employee-count threshold. Its exemptions depend on what the technology does and on sector rules, such as HIPAA covered entities, insurers under C.R.S. 10-3-1104.9, and FDA-regulated medical devices.
Do we still need an AI impact assessment for Colorado?
SB 26-189 does not require one. The impact assessment, risk management program, and annual review in SB 24-205 are not in the re-enacted law. Other laws, contracts, or your own governance may still call for one, and an assessment is one practical way to record which tools are covered.
What are the penalties?
A violation is a deceptive trade practice under the Colorado Consumer Protection Act, enforced only by the Attorney General. The final fiscal note says that can mean a civil penalty of up to $20,000 for each violation. Until January 1, 2030, the Attorney General must first give notice and 60 days to cure where it deems a cure possible, unless it finds and can demonstrate a knowing or repeated violation.
Can people sue us under SB 26-189?
The act creates no new private right of action. It keeps existing rights, including claims under the Colorado Anti-Discrimination Act, and sets how fault is split between developers and deployers in those cases.
Does it cover ChatGPT-style chatbots?
Technology that communicates with consumers in natural language or other means readily understood by an average consumer to provide information, make referrals or recommendations, answer questions, or generate other content is not ADMT if it is not contracted, advertised, marketed, configured, or intended by a person to be used in a consequential decision and it is subject to an acceptable use policy that prohibits its generated content from being used in a consequential decision. Chatbots offered to the public have their own duties under HB 26-1263 from January 1, 2027.
Does SB 26-189 apply to hospitals and clinics?
HIPAA covered entities doing business in Colorado, and their business associates for services rendered to them, are exempt from sections 6-1-1701 to 6-1-1706 except for employment decisions, and a health-care provider gets that exemption only if it operates from a location within Colorado. Covered entities must still give patients a general notice of their use of advanced technologies and give specific disclosures when ADMT decides financial assistance eligibility.
When will the Attorney General’s rules be final?
The act requires rules on the 30-day disclosures and on consumer rights on or before January 1, 2027. As of November 7, 2026, the Attorney General’s rulemaking page lists the October 26 hearing as the latest step and no adopted rules.
Does LA Global Institute give legal advice or certify compliance?
No. LA Global Institute publishes governance documents and explanations. It does not give legal advice, certify organizations, systems, or people, sell consulting, or operate an audit, accreditation, or regulatory program. The Colorado General Assembly and the Colorado Attorney General are cited as sources, not endorsers.
Every rule on this page was read in the signed act, the bill pages, the final fiscal note, or the Attorney General’s rulemaking page on November 7, 2026. Section numbers refer to the Colorado Revised Statutes as re-enacted. References do not imply affiliation with, or endorsement by, the Colorado General Assembly, the Colorado Attorney General, or the Department of Law.
Start with the inventory