Privacy Law Library

Automated Decision-Making Technology in Consequential Decisions

Colorado ADMT Act (SB 26-189)

Artificial intelligence · Employees · Comprehensive privacy

SB 26-189, signed May 14, 2026, repeals and replaces the 2024 Colorado AI Act starting January 1, 2027. It drops the duty of care, risk-management programs, and impact assessments and instead requires developer documentation, deployer notice at the point of interaction, a plain-language explanation after an adverse outcome, and consumer rights to correct inaccurate personal data and get meaningful human review. The Attorney General must adopt rules by January 1, 2027.

Where
Colorado
Citation
C.R.S. 6-1-1701 to 6-1-1709 (Part 17 as repealed and reenacted by SB 26-189); 6-1-105(1)(uuuu)
Status
Enacted, not yet in force
In force since
2027-01-01
Enforced by
Colorado Attorney General (exclusive for the disclosure and consumer-rights duties; 6-1-1706)
People can sue
No
Penalties
A violation is a deceptive trade practice under the Colorado Consumer Protection Act (up to $20,000 per violation, 6-1-112). Until January 1, 2030 the Attorney General must give a 60-day notice and opportunity to cure when a cure is possible, except for knowing or repeated violations (6-1-1706(3)). No new private right of action (6-1-1709).
Applies to
  • Developers doing business in Colorado that make available covered automated decision-making technology (ADMT), or components of it, used to materially influence consequential decisions (6-1-1701(8))
  • Deployers doing business in Colorado that use covered ADMT for consequential decisions in education, employment, residential housing, financial or lending services, insurance, health care, or essential government services and benefits (6-1-1701(6)-(7))
  • Insurers subject to C.R.S. 10-3-1104.9 are deemed compliant for insurance practice; HIPAA covered entities are largely exempt except for employment decisions but must give patients a general notice; creditors may satisfy notice through ECOA and FCRA adverse action notices (6-1-1704(6); 6-1-1708)
  • Applies to consequential decisions made on or after January 1, 2027 (SB 26-189, section 5(3))

What a privacy notice must say

  • Within 30 days after an adverse outcome, give a plain-language description of the decision and the ADMT's role, how to request more information (including the types and sources of personal data used), and the consumer's rights.C.R.S. 6-1-1704(3) · From 2027-01-01
  • Before using covered ADMT to materially influence a consequential decision, give consumers clear and conspicuous notice, which a prominent public notice at points of interaction can satisfy.C.R.S. 6-1-1704(1)-(2) · From 2027-01-01
  • Notices must be accessible to consumers with disabilities and limited English proficiency.C.R.S. 6-1-1704(8) · From 2027-01-01
  • HIPAA covered entities must give patients a general notice of use of advanced technologies including covered ADMT, and specific disclosures when ADMT decides financial-assistance eligibility.C.R.S. 6-1-1708(3)(c)-(d) · From 2027-01-01

Rights it gives people

  • After an adverse outcome, consumers may request their personal data, correct factually incorrect or materially inaccurate personal data (including employees and job applicants), and obtain meaningful human review and reconsideration where commercially reasonable.C.R.S. 6-1-1705(1) · From 2027-01-01

Practices it requires

  • Developers and deployers must keep records showing compliance for at least three years.C.R.S. 6-1-1702(4); 6-1-1703 · From 2027-01-01

Other duties

  • Developers must give deployers documentation on intended and harmful uses, categories of training data, known limitations, and instructions for appropriate use and human review, and notify them of material updates.C.R.S. 6-1-1702(1)-(2) · From 2027-01-01

Sources

Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.

Unverified: Attorney General rules (filed August 11, 2026; comments through October 26, 2026 per coag.gov/ai) were not yet adopted when checked. | The April 27, 2026 stipulated order in X.AI LLC v. Weiser (D. Colo. No. 1:26-cv-01515) also bars enforcement of 'any legislation replacing or amending SB24-205 enacted during this legislative session' for conduct through 14 days after a preliminary-injunction ruling; xAI must move for a preliminary injunction within 28 days after final rules are adopted. Enforcement of SB 26-189 may therefore be delayed past January 1, 2027.

Research reference, not legal advice.