Skip to content
AI Policy Generator

ESWhat applies

Colorado · Law

Colorado SB 26-189 on automated decision-making technology

Adopted, applies laterColorado SB 26-189

Summary

Colorado replaced its 2024 AI law, which never took effect, with a narrower law on automated decision-making technology (ADMT) used in consequential decisions about consumers: employment, housing, health care, education, financial services and insurance. From January 1, 2027 it requires consumer notice, an explanation within 30 days after an adverse outcome, data correction, human review and three-year records. It no longer requires impact assessments or a risk management program. The Attorney General must adopt rules before that date.

Who it applies to

Developers and deployers of ADMT that materially influences consequential decisions about Colorado consumers. Sources do not describe a small-business exemption.

Penalties

Deceptive trade practice under the Colorado Consumer Protection Act (up to $20,000 per violation per secondary sources). Until January 1, 2030, the Attorney General must give 60 days to cure. No new private right of action.

Official name
Senate Bill 26-189, Automated Decision-Making Technology (Session Laws of Colorado 2026, Chapter 131)
Official reference
SB 26-189, firmada el 14 de mayo de 2026 (cap. 131); deroga y sustituye la SB 24-205
Regulator
Colorado Attorney General
Official source
Check the sourceHow we verify sources

Key dates

Obligations and dates

Obligations table
ObligationArticle or citationStatusDateWho it applies toVerification
Clear consumer notice of ADMT useSB 26-189 (C.R.S. 6-1-17xx), obligaciones del deployerAdopted, applies laterJanuary 1, 2027Applies if you use ADMT that materially influences decisions on employment, housing, health care, education, lending or insurance for Colorado consumers.Verified in the official source on November 2, 2026
Explanation within 30 days after an adverse decisionSB 26-189, obligaciones del deployerAdopted, applies laterJanuary 1, 2027Applies to ADMT deployers in consequential decisions about Colorado consumers.Verified in the official source on November 2, 2026
Data correction and human reviewSB 26-189, derechos del consumidorAdopted, applies laterJanuary 1, 2027Applies to ADMT deployers in consequential decisions about Colorado consumers.Verified in the official source on November 2, 2026
Developer technical documentation for deployersSB 26-189, obligaciones del desarrolladorAdopted, applies laterJanuary 1, 2027Applies to those who develop or sell ADMT used in consequential decisions about Colorado consumers. Selling an AI product is not enough: in the assessment, select the type of decision your product supports.Verified in the official source on November 2, 2026
Keep compliance records for three yearsSB 26-189, conservación de registrosAdopted, applies laterJanuary 1, 2027Applies to developers and deployers covered by the law.Verified in the official source on November 2, 2026

Clear consumer notice of ADMT use

SB 26-189 (C.R.S. 6-1-17xx), obligaciones del deployerAdopted, applies later

Applies from January 1, 2027

When it relates
Applies if you use ADMT that materially influences decisions on employment, housing, health care, education, lending or insurance for Colorado consumers.
What the rule provides
  • Give a clear and conspicuous notice at the point of interaction that ADMT is used.
Typical evidence
  • Published notice and screenshots of interaction points
Verification
Verified in the official source on November 2, 2026Signing, dates and obligations checked on leg.colorado.gov on Nov 2, 2026. Exact content will depend on the Attorney General's rules, still pending.

Explanation within 30 days after an adverse decision

SB 26-189, obligaciones del deployerAdopted, applies later

Applies from January 1, 2027

When it relates
Applies to ADMT deployers in consequential decisions about Colorado consumers.
What the rule provides
  • Within 30 days of an adverse outcome, explain in plain language the decision and the role of ADMT.
  • Explain how to request information about the system, its data and the rights of correction and review.
Typical evidence
  • Explanation template and delivery log
Verification
Verified in the official source on November 2, 202630-day period checked on leg.colorado.gov; details subject to Attorney General rules.

Data correction and human review

SB 26-189, derechos del consumidorAdopted, applies later

Applies from January 1, 2027

When it relates
Applies to ADMT deployers in consequential decisions about Colorado consumers.
What the rule provides
  • Let consumers access their personal data and correct inaccurate data.
  • Offer meaningful human review and reconsideration after an adverse outcome, by a trained person with authority to change it.
Typical evidence
  • Review procedure and log of requests and outcomes
Verification
Verified in the official source on November 2, 2026Checked on leg.colorado.gov.

Developer technical documentation for deployers

SB 26-189, obligaciones del desarrolladorAdopted, applies later

Applies from January 1, 2027

When it relates
Applies to those who develop or sell ADMT used in consequential decisions about Colorado consumers. Selling an AI product is not enough: in the assessment, select the type of decision your product supports.
What the rule provides
  • Give each deployer documentation on intended uses, training data categories, known limitations and instructions for use and human review.
  • Notify deployers of material updates.
Typical evidence
  • Delivered technical documentation and version log
Related base documents
Verification
Verified in the official source on November 2, 2026Checked on leg.colorado.gov.

Keep compliance records for three years

SB 26-189, conservación de registrosAdopted, applies later

Applies from January 1, 2027

When it relates
Applies to developers and deployers covered by the law.
What the rule provides
  • Keep records showing compliance for at least three years, with version identifiers.
Typical evidence
  • Decision log and system version log
Related base documents
Verification
Verified in the official source on November 2, 2026Three-year period checked on leg.colorado.gov.

Related rules

Regulatory change alerts by country

Pick the countries you care about and we will email you when we change a rule or an application date for those countries in our registry.

  • Changes to the rules of the countries you pick, when we add them to the registry.
  • New application dates.
  • No more than one email a week. Unsubscribe at any time.

It is a free, informational notice, not a legal monitoring service: it does not necessarily catch every change or within a set time.

Countries · Pick one or more.
US states
Email language
Manage my alerts

Find out what applies to you (free)