On this page · 14 sections
- The dates that matter
- What SB 26-189 dropped and what it kept
- Who is covered: ADMT, consequential decisions and material influence
- Developer duties under section 6-1-1702
- Deployer duties: notice, 30-day disclosure and records
- Consumer rights: correction and meaningful human review
- Exemptions and partial carve-outs
- Enforcement, penalties and the X.AI v. Weiser order
- Colorado vs California: two ADMT rules on the same day
- Decision table: does SB 26-189 apply to you?
- Worked example: a hiring tool across 3 months
- The ADMT notice checklist for 1 January 2027
- How eCorpIT can help
- References
Summary. The Colorado law that governs AI in hiring, lending, housing and similar decisions from 1 January 2027 is SB 26-189, not the 2024 Colorado AI Act (SB 24-205). Signed on 14 May 2026, it repeals and re-enacts part 17 of article 1, title 6 of the Colorado Revised Statutes as an automated decision-making technology (ADMT) law for consequential decisions made on or after 1 January 2027. The 2024 duty of reasonable care, risk management programme, impact assessments, 90-day report to the attorney general and framework defence are gone. Developers must document covered ADMT for deployers. Deployers owe notice before use, a plain-language disclosure within 30 days of an adverse outcome, data correction and meaningful human review on request, and 3 years of records. The attorney general enforces it as a deceptive trade practice, with a 60-day cure notice and penalties of up to $20,000 per violation; there is no new private right of action. Still open on 12 November 2026: the attorney general's rules (4 CCR 904-6), heard on 26 October and not yet adopted, and a federal order in X.AI v. Weiser that bars enforcement until 14 days after a ruling on an injunction motion xAI has not yet filed.
About this article. For product, engineering, HR, credit and compliance teams that use AI scores, rankings or recommendations in decisions about people in Colorado. On 12 November 2026 we checked the statute against the signed act, bill history and fiscal note; the rulemaking against the Department of Law's draft rules and the Secretary of State's eDocket; and the court position against the filings in X.AI v. Weiser. Some official pages block automated access, so we read them through archived copies, marked in the references. This is general information, not legal advice; confirm your obligations with counsel. Researched with AI assistance and reviewed by our editorial team.
The dates that matter
Many guides still describe SB 24-205 and its 2026 start dates. The primary record gives this timeline.
| Date | What happened or happens | Instrument |
|---|---|---|
| 28 August 2025 | SB 25B-004 signed, moving SB 24-205's duties to 30 June 2026 | SB 25B-004 |
| 9 April 2026 | xAI sues the attorney general in federal court | X.AI v. Weiser, D. Colo. |
| 24 April 2026 | United States joins the case as plaintiff-intervenor | Complaint in intervention |
| 27 April 2026 | Minute order bars the attorney general from starting enforcement, including investigations | ECF 24 |
| 14 May 2026 | SB 26-189 signed; rulemaking mandates and appropriation take effect | Signed act, section 5(2) |
| 30 June 2026 | Date SB 24-205's duties were due to start; never enforced | SB 25B-004 |
| 11 August 2026 | Proposed rules, 4 CCR 904-6, filed with the Secretary of State | eDocket 2026-00360 |
| 6 October 2026 | Interim draft rules released as a redline | Department of Law |
| 26 October 2026 | Rulemaking hearing; written comments close | Department of Law |
| 1 January 2027 | Duties apply to decisions made on or after this date; statutory deadline for the attorney general's disclosure and consumer rights rules | Sections 5(1) and 5(3); 6-1-1704(4) and 6-1-1705(3) |
| January 2028 | First annual enforcement and cure report to the legislature | 6-1-1706(3)(e) |
| 1 January 2030 | Cure-period subsection repealed | 6-1-1706(3)(f) |
Section 5(3) draws the line by decision date: a loan declined on 31 December 2026 is outside the law, the same decision on 4 January 2027 is inside. The two rulemaking mandates and a $46,190 general fund appropriation for 0.4 FTE at the Department of Law took effect on signature.
One wrinkle for counsel: the act's effective-date clause dates the repeal of the 2024 text to 1 January 2027, after SB 24-205's 30 June 2026 start. Commentators treat SB 24-205 as never having taken effect, and the attorney general told the court it would not enforce SB 24-205 or its replacement until rulemaking ends. If a decision made in the second half of 2026 matters to you, ask your lawyer.
What SB 26-189 dropped and what it kept
SB 24-205 asked companies to show governance around a system. SB 26-189 asks whether the person affected by one decision was told, can see what data was used, and can get a human to look again.
| Obligation | Position from 1 January 2027 |
|---|---|
| Duty of reasonable care against algorithmic discrimination | Not carried forward |
| Deployer risk management programme | Not carried forward |
| Annual impact assessment | Not carried forward |
| 90-day report to the attorney general on discovered discrimination | Not carried forward |
| Affirmative defence for following NIST AI RMF or ISO/IEC 42001 | Not carried forward |
| Developer documentation to deployers | Kept and narrowed (6-1-1702) |
| Notice before a covered ADMT is used | Kept; a public posting near the point of interaction suffices (6-1-1704(1) and (2)) |
| Statement after an adverse decision | Reworked: fixed 30-day deadline and set content (6-1-1704(3)) |
| Correction of personal data | Reworked: on request, tied to the Colorado Privacy Act process (6-1-1705(1)(a)(I)) |
| Human review | Reworked: meaningful review and reconsideration to the extent commercially reasonable (6-1-1705(1)(a)(II)) |
| Record retention | 3 years for developers and deployers (6-1-1702(4), 6-1-1703) |
| Fault allocation and void indemnities | New (6-1-1707) |
The 2024 text already required an adverse decision statement, data correction and an appeal with human review where technically feasible, so these duties are reworked, not new. Keep any 2026 impact assessment work as internal governance; its system inventory is what the new duties need.
Who is covered: ADMT, consequential decisions and material influence
The definitions do most of the work. Section 6-1-1701(2) defines ADMT broadly: technology that processes personal data and computes an output, such as a prediction, score, ranking or recommendation, used to make, guide or assist a decision about an individual. The duties attach only to covered ADMT, meaning ADMT used to materially influence a consequential decision.
Consequential decision. A decision about access to, eligibility for, selection for or compensation for a covered domain, or about differentiated price or terms that materially limit access. The seven domains are education enrolment or opportunity; employment; the lease or purchase of residential real estate in Colorado; financial or lending services; insurance, including underwriting, pricing and claims; health-care services; and essential government services and public benefits.
Material influence. The output is a non-de minimis factor used in the decision and it affects the outcome, including by constraining, ranking, scoring, recommending or classifying. Incidental, trivial or clerical uses do not count.
The interim draft rules go further. Draft Rule 6.1 presumes material influence when an output constrains an option set, sets a threshold, or produces a rank, score or recommendation about the individual that the decision maker reviewed before or during the decision and that matches the outcome. The deployer can rebut it, for example with evidence of an independent review of other substantial information by someone with authority. The August proposal had no such presumption, and the Department of Law has asked commenters for alternatives, so it may change. Under the draft, a recruiter who saw a candidate score and rejected that candidate starts on the wrong side of it.
What is excluded. Infrastructure such as firewalls, databases and spreadsheets that use no machine learning; tools an individual uses only to summarise, organise, translate, draft, route or present information for human review; low-stakes decisions such as routine scheduling and customer service triage; advertising, product recommendations, search and content moderation; and cybersecurity, fraud, anti-money laundering and sanctions tools.
General-purpose chatbots fall outside ADMT only if nobody contracts, markets, configures or intends them for consequential decisions and an acceptable use policy forbids that use. Consumer and companion chatbots face a separate Colorado law from the same date, covered in our AI chatbot laws 2027 guide.
Who carries duties. A developer does business in Colorado and makes a covered ADMT commercially available, builds a component designed for one, or intentionally and substantially modifies an ADMT so it becomes covered. A model vendor is generally not the developer when an unaffiliated company changes its product's intended use, so a company that turns a foundation model into a resume screener takes on that role. A deployer does business in Colorado and deploys a covered ADMT. The Department of Law reads the law as not applying to governments, though it encourages bodies running services such as Medicaid to comply.
Who is protected. Colorado residents acting in an individual or household context (the Colorado Privacy Act definition), plus employees, Colorado-resident job applicants, and anyone whose access to or opportunity in Colorado is evaluated by a person doing business there. The act sets no headcount or revenue threshold, so a 40-person lender is covered on the same terms as a national bank.
Developer duties under section 6-1-1702
From 1 January 2027 a developer must give each deployer, in a form that protects trade secrets: intended uses and known harmful or inappropriate uses; categories of training data, to the extent known; known limitations, risks and situations where the ADMT should not be used; instructions for use, monitoring and meaningful human review; and the information the deployer needs for its own disclosures, with notice if anything is withheld.
Developers must also notify deployers of material updates, substantial modifications and changes to intended use, limitations or risk mitigation within a reasonable time; public release notes count if each deployer gets direct notice. Version identifiers, changelogs and update notices must be kept for at least 3 years. These duties apply only where the ADMT was marketed, configured, contracted, sold or licensed for consequential decisions.
Deployer duties: notice, 30-day disclosure and records
Before use. A deployer must give clear and conspicuous notice that it uses a covered ADMT in a consequential decision, with instructions for getting more information. A prominent public notice at points of interaction, such as a link beside the application form, satisfies this.
After an adverse outcome. An adverse outcome denies, terminates, revokes or materially reduces access, or imposes materially worse price or terms than similar consumers get. Within 30 days of the decision the deployer must provide:
- a plain-language description of the decision and the role the covered ADMT played;
- a simple way to request more information, including the ADMT's name, version number, developer, and the types, categories and sources of personal data used; and
- an explanation of the consumer's rights and how to use them.
The interim draft rules would require a reply to that follow-up request within 15 days, through the channel the consumer used where feasible; the August proposal had asked for immediate online availability or 10 business days by mail or email. Notices must be accessible to people with disabilities and people with limited English proficiency.
Overlaps. A creditor's ECOA and Regulation B adverse action notice (with FCRA where relevant) satisfies Colorado for that decision if it also carries Colorado's content. FERPA schools can use their FERPA channels. Trade secrets may be withheld, but the consumer must be told. Deployers keep records for at least 3 years after each decision.
Consumer rights: correction and meaningful human review
After an adverse outcome a consumer may ask for, and the deployer must provide, instructions for getting and correcting factually incorrect or materially inaccurate personal data used in the decision, through the Colorado Privacy Act process, and a chance at meaningful human review and reconsideration, to the extent commercially reasonable. Opinions, predictions, scores and protected evaluations are not open to correction.
The reviewer must be designated by the deployer, hold authority to approve, modify or override the decision, consider relevant primary evidence, be trained, not default to the system output, and have enough information to understand the output's intended use, limitations, input categories and principal factors. Source code and model weights need not be disclosed.
The interim draft rules weigh commercial reasonableness by factors including the size and reversibility of the harm and the deployer's capacity. They presume review is reasonable when the harm is a severe, irreversible denial of a basic need such as shelter, put the burden on the deployer, bar ADMT from assisting, and require acknowledgement within 10 days and a decision within 45. All of this is draft.
Exemptions and partial carve-outs
Under section 6-1-1708, insurers subject to C.R.S. 10-3-1104.9 are treated as compliant for the practice of insurance, but not for their own hiring. HIPAA covered entities and business associates are exempt except for employment decisions, though they owe patients a general notice of advanced technologies and specific disclosures when ADMT decides financial assistance. FDA-regulated medical devices are out, and nothing requires a disclosure Gramm-Leach-Bliley forbids.
Enforcement, penalties and the X.AI v. Weiser order
Who enforces. The attorney general, exclusively for the disclosure and consumer rights duties, through the Colorado Consumer Protection Act. SB 26-189 adds a violation of part 17 to the deceptive trade practices in C.R.S. 6-1-105. Before acting, the attorney general must send a notice of violation and allow 60 days to cure where a cure is possible. No cure period is owed for knowing or repeated violations, and the cure subsection is repealed on 1 January 2030. The Department of Law has said it will focus on egregious and intentional violations while organisations come into compliance.
Penalties. Section 6-1-112 sets civil penalties of up to $20,000 per violation, counted separately for each consumer or transaction, and up to $50,000 per violation against an elderly person. There is no new private right of action, but section 6-1-1707 confirms that developers and deployers can be liable under the Colorado Anti-Discrimination Act for decisions a covered ADMT materially influenced, allocates fault by relative responsibility, and voids contract terms that indemnify a party for its own discriminatory use of ADMT.
The federal order. xAI sued Attorney General Weiser on 9 April 2026 (No. 1:26-cv-01515, D. Colo.), and the United States joined on 24 April with an equal protection claim. On 27 April Magistrate Judge Cyrus Y. Chung granted the parties' revised joint motion. The order bars the attorney general from starting enforcement, including investigations, for violations of SB 24-205 or any replacement enacted that session that occur up to 14 days after the court rules on xAI's preliminary injunction motion. xAI must file that motion within 28 days after the implementing rules are finally adopted; other deadlines are stayed.
Status on 12 November 2026. The Secretary of State's eDocket records no adopted rule, so xAI's 28-day clock has not started. Read literally, the order shields conduct up to the cut-off, not only the timing of enforcement, though the court can modify it. It does not move the 1 January date, block discrimination claims, or stop customers asking for compliance. The intervention fits the AI Litigation Task Force created by Executive Order 14365, which cites Colorado's algorithmic discrimination law as an example of state overreach.
Colorado vs California: two ADMT rules on the same day
California's CCPA ADMT regulations require businesses already using ADMT for significant decisions to comply by 1 January 2027; see our California ADMT rules guide. The two regimes look alike and are not.
| Point | Colorado SB 26-189 | California CCPA ADMT rules |
|---|---|---|
| Starts | 1 January 2027 | 1 January 2027 for existing uses |
| Trigger | Output materially influences a consequential decision | Technology replaces or substantially replaces human decision-making for a significant decision |
| Human in the loop | Does not by itself take you out of scope; draft rules presume influence when a reviewer saw the score | A qualified reviewer with authority can take you out of scope |
| Domains | Education, employment, housing, lending, insurance, health care, government services | Lending, housing, education, employment, health care |
| Before use | Clear notice or public posting | Pre-use notice |
| Opt-out | None | Required unless an exception applies |
| After the decision | Adverse outcome disclosure within 30 days | Access request answers |
| Correction and review | Data correction and meaningful human review on request | Human appeal is one opt-out exception route |
| Risk assessment | Not required | Required |
| Size threshold | None in the act | CCPA business thresholds |
| Enforcement | Attorney general; up to $20,000 per violation | CalPrivacy and the California attorney general |
A human-in-the-loop design that keeps a California hiring tool out of scope may still be covered in Colorado, so build one decision log that serves both. For other state privacy laws arriving in 2027, see our 2027 state privacy law comparison; for every US and UK date in one place, our 2027 compliance calendar for software teams.
Decision table: does SB 26-189 apply to you?
| If your situation is | Then |
|---|---|
| You sell a scoring tool marketed for hiring, lending, tenant screening or underwriting to firms doing business in Colorado | You are a developer: ship the 6-1-1702 documentation pack and update notices by 1 January |
| You use a vendor's ranking tool on Colorado applicants and staff see the score | Assume you deploy covered ADMT; build notice, 30-day disclosures and a review queue |
| Your AI only summarises or routes files and produces no score or recommendation | Likely excluded; document the workflow that proves it |
| You are a creditor already sending ECOA and FCRA adverse action notices | Add the Colorado content to the same notice rather than sending a second one |
| You are a HIPAA covered entity | Exempt except for employment decisions, but add the patient general notice |
| You fine-tune an open model and configure it to rank applicants | You have likely made yourself a developer through intentional and substantial modification |
Worked example: a hiring tool across 3 months
The figures are illustrative assumptions. A US HR-tech vendor sells a candidate-ranking tool to a Denver employer, which receives 6,000 applications from Colorado residents for 60 roles in one quarter. The tool ranks every applicant, recruiters see the ranks, 400 are interviewed and 5,600 rejected.
- Coverage. Recruiters saw the rank and it matches the outcome, so under draft Rule 6.1 it is presumed to materially influence all 5,600 rejections.
- Disclosures. 5,600 adverse outcome disclosures, each within 30 days of its decision: 5,600 ÷ 3 = about 1,867 a month, which only works as a template filled from the decision log.
- Information requests. If 2% ask for details, 5,600 × 0.02 = 112 requests, each answered within 15 days under the interim draft.
- Human review. If 1% ask, that is 56 reviews. At 45 minutes each, 56 × 0.75 = 42 reviewer hours a quarter, each acknowledged within 10 days and closed within 45 under the draft.
- Records. 6,000 decisions a quarter is 24,000 a year; kept for 3 years, that is 72,000 records on hand.
- Exposure. If no disclosures go out, the theoretical ceiling is 5,600 × $20,000 = $112,000,000. Courts set actual penalties and a cure notice comes first for curable violations, but per-consumer counting makes a missing template a board-level risk.
The vendor's side is smaller: a documentation pack per version, a change-notice channel to each Colorado customer, 3 years of changelogs, and no clause indemnifying the customer for its own discriminatory use.
The ADMT notice checklist for 1 January 2027
- Inventory every score, rank or recommendation used in the seven domains for anyone in Colorado, including AI inside vendor platforms.
- Where a decision maker sees the output, assume material influence until you can document otherwise.
- Decide your role per system: developer, deployer, or both.
- Developers: ship the 6-1-1702 documentation pack and direct update notices; keep changelogs for 3 years.
- Deployers: post the pre-use notice beside every application, quote or eligibility form.
- Generate the 30-day adverse outcome disclosure from the decision log, in plain language and your customers' languages.
- Log per decision: ADMT name, version, developer, data categories and sources, output, reviewer and outcome.
- Answer information requests quickly (15 days in the interim draft) and route corrections through your Colorado Privacy Act process.
- Train human reviewers with real override authority, and keep ADMT out of the review.
- Merge Colorado content into existing ECOA, FCRA or FERPA notices, re-paper vendor contracts, and revisit this list when final rules or a ruling land.
How eCorpIT can help
eCorpIT is a Gurugram-based technology organisation, founded in 2021, assessed at CMMI Level 5 and MSME certified, with senior-led engineering teams working across AWS, Microsoft and Google platforms. Our AI and machine learning services team builds the engineering side of decision-level compliance, such as per-decision logs, disclosure templates and human-review queues, while your counsel decides what the law requires of you. Talk to us at /contact-us/.
Last updated: 12 November 2026.
