Colorado SB 26-189, Automated Decision-Making Technology

What it is

Colorado Senate Bill 26-189 is Colorado’s law on automated decision-making technology (ADMT) used in consequential decisions about people. It was signed on 14 May 2026 and sits in Part 17 of Article 1, Title 6 of the Colorado Revised Statutes, inside the Colorado Consumer Protection Act. Section 5 of the Act provides that it takes effect on 1 January 2027 and applies to consequential decisions made on or after that date.

It replaces the original Colorado AI Act, SB 24-205, which was signed in 2024 and was the first comprehensive US state law on high-risk AI. That Act never took effect. SB 25B-004, signed in August 2025, delayed it to 30 June 2026, and SB 26-189 then repealed and re-enacted its provisions before that date. Much of what has been written about “the Colorado AI Act”, including the duty of reasonable care, risk management programmes, annual impact assessments and notification of algorithmic discrimination to the Attorney General, describes a law that no longer exists.

The replacement is narrower and more procedural. It focuses on documentation passing from developer to deployer, notice to the people affected, an explanation after an adverse outcome, and the right to correct data and ask for human review.

Who it applies to

The Act applies to developers and deployers doing business in Colorado.

• A developer develops, sells, licenses or otherwise makes available a covered ADMT, develops a component designed for one, or intentionally and substantially modifies one.
• A deployer uses a covered ADMT.

A covered ADMT is technology used to materially influence a consequential decision. Material influence means the output is a non-de minimis factor in the decision and affects its outcome, for example by constraining, ranking, scoring, recommending or classifying.

A consequential decision relates to a person’s access to, eligibility for, selection for or compensation for a covered domain, or to differentiated pricing or terms that materially limit or deny that access. There are seven covered domains.

• education enrolment or opportunity
• employment
• the lease or purchase of residential real estate in Colorado
• financial or lending services
• insurance, including underwriting, pricing, coverage and claims
• health-care services
• essential government services and public benefits

The definition excludes low-stakes or routine processes such as scheduling and customer service triage, advertising and product recommendations, spreadsheets without machine learning, tools that only summarise or organise information for human review, and technology used for cybersecurity, fraud prevention, anti-money laundering and sanctions screening.

What it requires

Developers. From 1 January 2027 a developer gives each deployer documentation covering intended uses and known harmful or inappropriate uses, the categories of training data, known limitations and risks, instructions for appropriate use, monitoring and meaningful human review, and anything else the deployer needs to meet its own disclosure duties. Developers notify deployers of material updates, substantial modifications and changes to intended use or risk mitigation, and keep records, including version identifiers and changelogs, for at least three years.

Deployers, before the decision. Before using a covered ADMT to materially influence a consequential decision, a deployer gives the person clear and conspicuous notice and tells them how to get more information. A prominent public notice at the points where people interact, such as a link near the application, satisfies this.

Deployers, after an adverse outcome. Within 30 days of an adverse consequential decision, the deployer provides a plain-language description of the decision and the role the ADMT played, a simple process for requesting more information (including the system’s name, version, developer and the personal data used), and an explanation of the person’s rights.

Consumer rights. A person who experiences an adverse outcome can ask the deployer for instructions to correct factually incorrect or materially inaccurate personal data, and for meaningful human review and reconsideration of the decision to the extent commercially reasonable.

Records. Deployers keep the records needed to show they meet the Act for at least three years after each consequential decision.

Creditors that give adverse action notices under the Equal Credit Opportunity Act and Fair Credit Reporting Act, and education providers following FERPA processes, can meet the notice duties through those existing channels. Insurers subject to Colorado’s existing rules on external consumer data and algorithms (C.R.S. 10-3-1104.9) are treated as complying with the Act in the practice of insurance, though not for their own employment decisions. The core duties do not apply to HIPAA covered entities and their business associates, except for employment decisions, though these entities give patients a general notice and make specific disclosures when a covered ADMT decides eligibility for financial assistance. They also do not apply to medical devices or pharmaceutical and device research overseen by the US Food and Drug Administration. Nothing requires disclosure of trade secrets, though the person must be told when information is withheld.

Key dates

• 14 May 2026. SB 26-189 signed.
• 1 January 2027. The Act takes effect and applies to consequential decisions made from that date. The Attorney General must also adopt rules on the content of post-adverse-outcome disclosures by this date.
• 1 January 2030. Until this date the Attorney General must give 60 days’ notice and an opportunity to cure before bringing an action.

How it relates to other frameworks

The Act sits on top of the Colorado Privacy Act, which already gives Colorado residents the right to opt out of profiling in furtherance of decisions with legal or similarly significant effects. The US state privacy laws on profiling page covers that layer. The closest parallel elsewhere is California’s CCPA ADMT regulations, which also start on 1 January 2027 but use a different trigger (technology that replaces or substantially replaces human decision-making) and add risk assessments.

Compared with the EU AI Act, the domains overlap with the Act’s Annex III high-risk uses, but SB 26-189 imposes no conformity assessment, quality management system or risk management system. Organisations that already run assessments against the NIST AI RMF or ISO/IEC 42001 will find the record of intended use, limitations and human review those produce is most of what a developer has to hand over.

Working with it in Aicura

US state framework content is available in Aicura on the Enterprise tier and is switched on in Settings under Frameworks. The AI Register is where you record which systems and agents touch the seven covered domains, who supplies them and which business unit runs them. Each risk and impact assessment is tied to the exact version of the register entry it read, so what was assessed is the version you actually run, and recording a developer’s material update on the entry re-runs the assessment. Vendor records track due diligence on each developer, the contract in force and when the next review is due. A register entry’s Decision Disclosure tab drafts a plain-language disclosure for review and acceptance, and the Evidence Vault, where Aicura keeps timestamped snapshots sealed so anyone can confirm they have not been changed, holds a snapshot as each one is accepted. Aicura gives guidance for your own judgement and your advisers’. It does not decide whether a system is a covered ADMT.