Colorado · Law · Colorado General Assembly (enforced by the Colorado Attorney General)
Senate Bill 26-189, Automated Decision-Making Technology (repealing and reenacting the consumer-protection provisions of SB 24-205, 'Colorado AI Act')
Colorado's original AI Act (SB 24-205, signed May 17, 2024) was delayed to June 30, 2026 by SB 25B-004 and then, before ever taking effect, repealed and reenacted by SB 26-189 (signed May 14, 2026). The replacement is a narrower transparency law for automated decision-making technology used in consequential decisions (education, employment, housing, financial services, insurance, health care, essential government services): developers must give deployers technical documentation, deployers must give notice at the point of interaction and a plain-language explanation after an adverse outcome, both must keep records for three years, and consumers can access and correct their data and request meaningful human review. Obligations start January 1, 2027; the Attorney General enforces under the Colorado Consumer Protection Act with a 60-day cure right until January 1, 2030.
Applies to: Developers and deployers of 'covered ADMT' that materially influences consequential decisions about Colorado consumers (education, employment, housing, financial or lending services, insurance, health care, essential government services and public benefits); specified entities exempt to the extent they comply with other legal obligations.
4 structured provisions
Developer: technical documentation and update notices to deployers SB 26-189 (developer duties)from 2027-01-01
From January 1, 2027, developers of covered ADMT must provide deployers with technical documentation covering intended uses, categories of training data, known limitations and instructions for appropriate use and human review, and must notify deployers of material updates.
Evidence commonly relevant: Deployer documentation package; Update notification log
source ↗Deployer: point-of-interaction notice and post-adverse-outcome explanation SB 26-189 (deployer duties)from 2027-01-01
Deployers must give clear and conspicuous notice at the point of interaction with covered ADMT and, within 30 days after an adverse consequential decision, a plain-language description of the ADMT's role in the decision.
Evidence commonly relevant: Notice text and placement; Adverse-decision explanation template; 30-day SLA tracking
source ↗Consumer data access, correction and meaningful human review SB 26-189 (consumer rights)from 2027-01-01
Consumers may request the personal data used by covered ADMT and correction of factually incorrect data, and after an adverse consequential decision may request meaningful human review and reconsideration.
Evidence commonly relevant: Request-handling workflow; Human-review records
source ↗Record retention and AG enforcement SB 26-189 (records; enforcement)from 2027-01-01
Developers and deployers must retain records needed to demonstrate compliance for at least three years; violations are deceptive trade practices enforced exclusively by the Attorney General (no private right of action), with a 60-day notice-and-cure before actions filed before January 1, 2030.
Evidence commonly relevant: Compliance record set (3-year retention)
source ↗
Verified 2026-10-14. All three bill pages (SB24-205, SB25B-004, SB26-189) fetched from leg.colorado.gov on 2026-10-14. The bill summary page does not mention impact assessments or the original small-deployer exemption; enacted text not read in full. Reports of the April 2026 xAI/DOJ litigation and a stipulated non-enforcement order come from secondary sources and are not recorded as verified. Official source ↗