Overview of Colorado SB 26-189
Colorado SB 26-189 represents a revised legal framework for regulating automated decision-making technology (ADMT) following the repeal of its predecessor, SB 24-205. Enacted in May 2026, this legislation establishes a narrower but structured approach to transparency and consumer protections in the use of ADMT for consequential decisions. The law is set to take effect on January 1, 2027, marking a significant step in the U.S. toward addressing risks associated with AI-driven decision-making processes.
Unlike its predecessor, SB 26-189 focuses specifically on ADMT used in consequential decisions, such as those affecting education, employment, housing, financial services, healthcare, and government benefits. This targeted approach reflects a deliberate shift toward balancing innovation with consumer safeguards.
The legislation was passed through multiple stages in the Colorado General Assembly, including committee reviews and votes in both the Senate and House. Key amendments were adopted, and the bill ultimately received final approval, demonstrating broad legislative support for regulating ADMT while avoiding overly broad restrictions that could hinder technological progress.
Definitions and Scope of Regulation
SB 26-189 defines 'automated decision-making technology' (ADMT) as any technology that processes personal data and uses computational methods to generate outputs such as predictions, recommendations, classifications, rankings, scores, or other information. These outputs must be used to make, guide, or assist in decisions concerning an individual.
A 'consequential decision' is narrowly defined as one that impacts an individual’s access to, eligibility for, or compensation related to education, employment, housing, financial or lending services, insurance, healthcare services, or essential government services and public benefits.
The law applies to both developers and deployers of ADMT. Developers are entities that create or modify ADMT systems, while deployers are those who integrate or use these systems in their operations. The distinction is critical, as it assigns specific responsibilities to each party in ensuring compliance with transparency, documentation, and consumer notice requirements.
Key Requirements for Developers and Deployers
Developers of ADMT used in consequential decisions must provide deployers with technical documentation outlining the system’s intended uses, categories of training data, known limitations, and instructions for appropriate use and human review. This documentation is intended to ensure that deployers understand the capabilities and constraints of the ADMT before implementation. Developers are also required to notify deployers of any material updates or modifications to the system, maintaining transparency throughout the ADMT’s lifecycle.
Deployers must retain records demonstrating compliance with the act for at least three years. The retention period ensures that evidence of compliance is available for audits or legal proceedings, reducing the risk of non-compliance going unchecked.
Consumer Protections and Enforcement Mechanisms
The law mandates that deployers provide consumers with clear and conspicuous notice at the point of interaction with a covered ADMT. If an ADMT results in an adverse outcome for a consumer—such as denial of a loan, rejection from a job, or loss of benefits—the deployer must offer a plain-language explanation of the ADMT’s role within 30 days. The attorney general is tasked with adopting rules to clarify these disclosure requirements by January 1, 2027, ensuring consistency and enforceability.
Consumers are granted the right to request their personal data used by a covered ADMT and to correct any factually inaccurate information. Additionally, individuals affected by an adverse decision have the right to request meaningful human review and reconsideration of the decision.
Enforcement of SB 26-189 falls under the Colorado Consumer Protection Act, with violations classified as deceptive trade practices. The attorney general is responsible for enforcement but must provide a 60-day notice and opportunity to cure alleged violations before taking legal action, provided a cure is deemed possible. This enforcement mechanism applies until January 1, 2030, after which the attorney general may proceed directly to legal action if necessary.
The law does not create a private right of action, meaning consumers cannot sue directly under this legislation. However, it establishes fault allocation between developers and deployers in civil actions alleging unlawful discrimination under existing law.
Exemptions and Compliance Considerations
Certain entities are exempt from the requirements of SB 26-189 to the extent they comply with other legal obligations.
The law’s effective date of January 1, 2027, provides a transition period for developers and deployers to align their systems with the new requirements. During this period, stakeholders should review their ADMT systems to ensure compliance with documentation, notice, and consumer protection obligations. Failure to comply may result in enforcement actions under the Colorado Consumer Protection Act, highlighting the importance of proactive adherence to the law.
Required actions
- Developers provide deployers documentation on the intended use, known limitations and evaluations of covered automated decision-making technology - Deployers notify consumers when ADMT is used in a consequential decision and provide adverse-outcome notices with the reasons and a way to correct data or appeal - Keep records of ADMT use; the broad duty of care, risk-management programme and impact assessment of the 2024 Act were removed