Colorado ADMT Readiness
Colorado's AI Act, After the Rewrite
SB 24-205 was repealed and replaced by SB 26-189, effective January 1, 2027. Most local advice on this still refers to the old law.
This is not legal advice.It is a plain-English summary for business owners deciding whether to loop in counsel, not a substitute for counsel. Colorado Attorney General rulemaking guidance on SB 26-189 is still developing, and this page will be updated as that guidance and any amendments emerge — confirm anything decision-critical against the sources below or with a Colorado-licensed attorney before acting on it.
What Changed
SB 24-205 Is Gone. SB 26-189 Replaced It.
Colorado's original 2024 AI Act (SB 24-205) required broad risk-management and impact-assessment obligations for “high-risk artificial intelligence systems.” After a federal court injunction and extensive pushback, the general assembly repealed it and passed SB 26-189 instead.
Governor Jared Polis signed SB 26-189 into law on May 14, 2026. It takes effect January 1, 2027, and applies to consequential decisions made on or after that date. The old law's terminology (“high-risk AI system,” “significant factor”) is gone, replaced by “automated decision-making technology” (ADMT) that “materially influences” a “consequential decision.”
Does This Apply to You?
Covered Domains
The law only reaches decisions in these areas. If none of these describe what your automation touches, SB 26-189 likely is not relevant to it.
“Materially influence” means the tool's output is more than an incidental or clerical input — it has to actually affect the outcome (by ranking, scoring, recommending, or similarly shaping the decision). A spell-checker is not covered. A tool that scores loan applicants or ranks job candidates likely is.
What the Law Requires
Developers vs. Deployers
Most SMBs are deployers — you use someone else's ADMT rather than building your own. That distinction changes which obligations land on you.
If You Build or Sell an ADMT (Developer)
- Document intended uses, known limitations, and training data categories
- Give deployers instructions for appropriate use and human review
- Notify deployers of material updates or modifications
If You Use One (Deployer — most businesses)
- Notify consumers at the point of interaction
- Explain the ADMT's role in an adverse decision, within 30 days if asked
- Allow data correction and meaningful human review
Both roles must retain compliance records for at least 3 years. Enforcement runs exclusively through the Colorado Attorney General under the Colorado Consumer Protection Act — a violation is a deceptive trade practice, there is no private right of action, and a 60-day right-to-cure period applies to notices of violation issued before January 1, 2030.
Free Resource
Colorado ADMT Readiness Checklist
A starting point for a conversation with counsel — not a substitute for one.
1. Do you use any tool that scores, ranks, recommends, or classifies people as part of a decision in hiring, lending, housing, insurance, healthcare, or benefits eligibility?
2. If so, is that tool's output actually a meaningful factor in the final decision — or is its role incidental, trivial, or purely clerical?
3. If you license the tool from a vendor: has that vendor given you documentation of its intended uses, known limitations, and training data categories?
4. Do you have a way to notify affected individuals when the tool was used, and to explain an adverse outcome within 30 days if asked?
5. Can someone request human review of the decision, and correct inaccurate data the system used about them?
6. Are you keeping records that would demonstrate compliance if asked — the law requires 3 years of retention for covered systems?