G.4 Colorado AI Act and the US state patchwork
Colorado’s 2026 ADMT law, consequential-decision disclosures, consumer rights, and the emerging multi-state AI regulation picture.
Last reviewed: August 18, 2026
Colorado SB26-189 repeals and reenacts the provisions created by SB24-205. The current law focuses on automated decision-making technology that materially influences consequential decisions. It requires technical documentation, consumer notices, data-correction and human-review rights, and record retention. The Attorney General is developing rules before the January 1, 2027 effective date.
Use this page for security and evidence planning. Legal should confirm scope, exemptions, and the final rules for each use case.
Start with the current definitions
The law defines automated decision-making technology, or ADMT, as technology that processes personal data and uses computation to generate output used to make, guide, or assist a decision about an individual.
A covered ADMT materially influences a consequential decision. The covered domains are:
Education enrollment or opportunity.
Employment or an employment opportunity that may create an employer-employee relationship.
The lease or purchase of residential real estate in Colorado.
Financial or lending services.
Insurance, including underwriting, pricing, coverage, claims, and access to benefits.
Healthcare services.
Essential government services and public benefits.
The statute excludes several routine technologies and uses. Examples include specified cybersecurity and infrastructure tools, low-stakes administrative processes, and tools used only to summarize, organize, translate, draft, route, or present information for human review. A natural-language tool can also fall outside the ADMT definition when it is not intended for consequential decisions and is governed by an acceptable use policy that prohibits that use.
Classification depends on actual design, marketing, configuration, contracts, and use. A general drafting assistant should not be treated as covered merely because it uses AI. The same tool needs a new review if a team begins using its scores, rankings, recommendations, classifications, predictions, or other inferences to influence a consequential decision.
Developer duties
Starting January 1, 2027, a developer of covered ADMT must give deployers understandable technical documentation that includes:
Intended uses and known harmful or inappropriate uses.
Categories of data, including personal data, used to train the system, to the extent known.
Known limitations, risks, and circumstances in which the system should not be used.
Instructions for appropriate use, monitoring, and meaningful human review where applicable.
Information reasonably necessary for deployer notices and disclosures.
Notice of material updates, substantial modifications, and relevant changes to intended use, limitations, or risk mitigation.
Developers must keep records reasonably necessary to show compliance for at least three years. The records include system version identifiers, change logs, documentation, and material-update notices.
Deployer duties and consumer rights
Before using covered ADMT to materially influence a consequential decision, a deployer must provide clear and conspicuous notice to the affected consumer. A prominent public notice can satisfy this requirement when it is reasonably accessible at the point of interaction.
If the decision produces an adverse outcome, the deployer must provide a plain-language disclosure within 30 days. The disclosure must describe the decision and the ADMT's role, explain how to request additional information, and explain the consumer's rights.
After an adverse outcome, a consumer may request:
The personal data used in the decision and correction of factually incorrect or materially inaccurate personal data.
Meaningful human review and reconsideration, to the extent commercially reasonable.
The statute defines meaningful human review as review by a trained person who can approve, modify, or override the decision, considers relevant primary evidence, does not default to the system output, and has enough information to understand the output and its principal factors.
Deployers must keep records reasonably necessary to show compliance for at least three years after the consequential decision. The law also contains sector-specific provisions and exemptions, including provisions for credit, education, insurance, healthcare, and systems regulated by the FDA. Legal should map those provisions before the team builds a separate notice or appeal process.
Enforcement and rulemaking
The Colorado Attorney General has exclusive authority to enforce the new disclosure and consumer-rights provisions through the Colorado Consumer Protection Act. The law creates no new private right of action. It does not make compliance a defense to other state or federal law.
The Attorney General must clarify post-adverse-outcome disclosures and consumer-rights procedures by rule before January 1, 2027. The rulemaking was in a pre-rulemaking stage in July 2026. Treat templates and workflows as provisional until the final rules are published.
Colorado also enacted HB26-1263, Conversational Artificial Intelligence Service Operator Requirements, signed May 29, 2026 and effective January 1, 2027. It applies to covered conversational AI service operators and includes protections for minors, interaction disclosures, account and privacy tools, and response protocols for self-harm content. Do not combine those duties with the ADMT checklist without first determining which law applies.
What security teams should prepare
For each potentially covered workflow, keep:
The business process and covered domain.
The system's intended, marketed, configured, contracted, and actual use.
The model, system version, and material-update history.
The personal data and other inputs used.
The decision path and the role of the ADMT output.
The point-of-interaction notice and adverse-outcome disclosure workflow.
The personal-data request and correction workflow.
The human reviewer, training record, authority, and reconsideration procedure.
The developer documentation and any withheld-information notice.
Compliance records and retention dates.
The legal owner and date of the latest rulemaking review.
The wider US state patchwork
State AI requirements now span several kinds of law. Track at least:
Automated or AI-assisted consequential decisions.
Employment and hiring tools.
Insurance and financial-services models.
Privacy, profiling, and automated-decision rights.
Chatbots and protections for minors.
Deepfakes and synthetic media.
Healthcare and licensed professional services.
Frontier-model reporting and safety requirements.
State consumer-protection enforcement and rulemaking.
Maintain one internal system of record for systems, use cases, decisions, data, owners, notices, rights requests, and evidence. Add a jurisdiction table to each covered workflow instead of creating a separate inventory for every law.
Common Colorado AI Act and the US state patchwork security failures
The compliance plan still follows SB24-205 after SB26-189 replaced it.
The inventory records the vendor but not the system version or decision use.
A drafting tool is repurposed for ranking or recommendation without reclassification.
The notice appears only after an adverse outcome instead of at the point of interaction.
Human review exists on paper, but the reviewer cannot change the decision.
The team keeps model documentation but cannot reproduce which version influenced a decision.
Legal and security build workflows before checking the Attorney General's final rules.
Colorado AI Act and the US state patchwork security controls checklist
Identify ADMT used in a covered domain.
Decide whether the output materially influences a consequential decision.
Record exclusions and the facts supporting them.
Obtain developer documentation before production use.
Prepare point-of-interaction and adverse-outcome notices.
Build personal-data access, correction, human-review, and reconsideration workflows.
Retain required records for at least three years.
Reclassify after material updates or changes in use.
Track Colorado rulemaking through the January 1, 2027 effective date.
Frequently asked questions about Colorado AI Act and the US state patchwork
Does ordinary employee use of a chatbot fall under this law?
Usually not when the tool only drafts, summarizes, organizes, translates, routes, or presents information for human review. Review again if the tool begins producing an inference that materially influences a covered consequential decision.
Does the law require an impact assessment and annual review?
Those were prominent features of the superseded SB24-205 structure. SB26-189 replaced that framework with documentation, notice, consumer-rights, and record-retention requirements. Other laws or internal risk policy may still require an impact assessment or periodic review.
Can a framework such as NIST AI RMF satisfy the law?
A framework can help organize controls and evidence, but SB26-189 does not make framework compliance a legal defense. The statute expressly says compliance does not excuse noncompliance with other applicable law.
What should the team do first?
Find systems that influence covered decisions, record their versions and data, and determine whether the influence is material. Then obtain developer documentation and design the notice, correction, and human-review workflows with counsel.
Applicable handbook articles
This table applies only when the system is covered ADMT used for a consequential decision under the Colorado requirements described on this page.
This mapping is limited to duties in the enacted Colorado law discussed on this page. It does not add controls based on possible future Attorney General rules.
1. Identity & access
1.7 Human-in-the-loop and approval policies
Meaningful human review.
2. Connectors, extensions & supply chain
2.7 The supply-chain review workflow
Developer documentation, intended use, system-version intake, and material-update handling.
3. Runtime, sandboxing & autonomy
3.2 Approval policies and least-privilege autonomy
Human reconsideration and override authority.
4. Data protection
4.2 Data classification for AI prompts and outputs 4.4 Retention and Zero Data Retention 4.6 Cross-app data flow and live artifacts
Personal-data accuracy, decision-path explanation, and three-year record retention.
6. Observability, audit & evidence
6.6 Evidence by surface and investigation paths
Evidence needed to demonstrate compliance with the enacted duties.
7. Rollout & operations
7.4 The vendor-neutral control matrix
The use-case inventory and technical control record.
Further reading
The links below are the primary framework, law, regulator, standards-body, or official maintainer sources used for this page.
Colorado SB26-189, Automated Decision-Making Technology, including the enacted bill summary and signed act
Related handbook guidance
Was this helpful?