AI Regulation Guide · Colorado
Colorado ADMT Law (SB 26-189): who's covered, what it requires
Colorado ADMT Law (SB 26-189) carries 6 tracked obligations for companies in scope. This guide lists who is covered, the duty tiers, and every obligation with its deadline and statutory citation — all from Shieldra's versioned regulation pack, verified 2026-07-29.
By the Shieldra Compliance Team · Last updated 2026-07-29
Who does Colorado ADMT Law (SB 26-189) apply to?
Out of scope only if: No Colorado consumers reported. SB 26-189 protects Colorado residents and individuals evaluated for access, eligibility, or opportunities in Colorado by a business doing business in Colorado.
SB 26-189 repealed and replaced SB 24-205, which never took effect. The replacement drops the duty-of-care and impact-assessment regime in favour of disclosure and record-keeping duties.
- What is your role for this system?
- Does the system make or influence decisions about Colorado residents, or evaluate individuals for access, eligibility, or opportunities in Colorado?
- Does it process personal data and materially influence a consequential decision about a consumer?
- Is the ADMT used for employment or employment-opportunity decisions?
- Can it contribute to adverse outcomes for a consumer — denial, termination, revocation, material reduction or restriction, or materially less favourable pricing or terms compared to similarly situated consumers?
- Are you an insurer subject to C.R.S. 10-3-1104.9, a HIPAA covered entity or business associate, or FDA-regulated for this system?
What are the duty tiers under Colorado ADMT Law (SB 26-189)?
Exempt / deemed compliant (regulated entity) (SB 26-189, C.R.S. 6-1-1708)
Citation: SB 26-189, C.R.S. 6-1-1708 — https://leg.colorado.gov/bills/sb26-189
Insurers subject to 10-3-1104.9 are deemed compliant in the practice of insurance (6-1-1708(1)); HIPAA covered entities and business associates are exempt from 6-1-1701–1706 but owe a general patient notice of advanced-technology use and specific financial-assistance/discounted-care disclosures instead (6-1-1708(3)); FDA-regulated devices and FDA-overseen R&D are exempt (6-1-1708(4)). Employment-related ADMT is carved OUT of the insurer and HIPAA exemptions — those uses route to the covered tier. The FDA exemption has no express employment carve-out; if you selected FDA and also use the system in employment decisions, confirm treatment with counsel.
Covered ADMT (SB 26-189, C.R.S. 6-1-1701–1706)
Citation: SB 26-189, C.R.S. 6-1-1701–1706 — https://leg.colorado.gov/bills/sb26-189
Not a covered ADMT (SB 26-189)
Citation: SB 26-189 — https://leg.colorado.gov/bills/sb26-189
What are the obligations and deadlines under Colorado ADMT Law (SB 26-189)?
| Obligation | Who | Deadline | Citation |
|---|
| Developer: provide deployers with technical documentation | developer | applies from 1 January 2027 | SB 26-189, C.R.S. 6-1-1702(1) — https://leg.colorado.gov/bills/sb26-189 |
| Developer: notify deployers of material updates and modifications | developer | applies from 1 January 2027 | SB 26-189, C.R.S. 6-1-1702(2) — https://leg.colorado.gov/bills/sb26-189 |
| Deployer: give consumers clear notice before ADMT use | deployer | applies from 1 January 2027 | SB 26-189, C.R.S. 6-1-1704(1)–(2) — https://leg.colorado.gov/bills/sb26-189 |
| Deployer: explain adverse decisions within 30 days | deployer | applies from 1 January 2027 | SB 26-189, C.R.S. 6-1-1704(3) — https://leg.colorado.gov/bills/sb26-189 |
| Deployer: honour correction and human-review requests after adverse outcomes | deployer | applies from 1 January 2027 | SB 26-189, C.R.S. 6-1-1705 — https://leg.colorado.gov/bills/sb26-189 |
| Keep compliance records and be ready for the AG cure window | developer, deployer | applies from 1 January 2027 | SB 26-189, C.R.S. 6-1-1702(4), 6-1-1703, 6-1-1706 — https://leg.colorado.gov/bills/sb26-189 |
What should you do about each obligation?
Developer: provide deployers with technical documentation (SB 26-189, C.R.S. 6-1-1702(1))
Give each deployer documentation covering the full 6-1-1702(1) list: (a) intended uses AND known harmful or inappropriate uses; (b) categories of data — including personal data — used to train, to the extent known; (c) known limitations, including known risks and circumstances in which the ADMT should not be used; (d) instructions for appropriate use, monitoring, and meaningful human review where applicable; and (e) information reasonably necessary for the deployer to meet its own notice and disclosure duties under 6-1-1704 — with a duty to notify the deployer if information is withheld.
Developer: notify deployers of material updates and modifications (SB 26-189, C.R.S. 6-1-1702(2))
Notify each deployer, within a reasonable time, of material updates, intentional and substantial modifications, and changes to the intended use, known limitations, or risk mitigation of the covered ADMT ('material update' is defined at 6-1-1701(14)). Publishing public release notes satisfies this where deployers are directly notified of the release.
Deployer: give consumers clear notice before ADMT use (SB 26-189, C.R.S. 6-1-1704(1)–(2))
Before using a covered ADMT to materially influence a consequential decision, provide clear and conspicuous notice stating that you use or will use a covered ADMT in a consequential decision affecting the consumer, with instructions for obtaining the additional information described in 6-1-1704. A prominent public notice reasonably accessible at points of consumer interaction (a link or posting reasonably proximate to the interaction) is a compliance path. Notices must be reasonably accessible to consumers with disabilities and limited English proficiency (6-1-1704(8)); trade secrets may be withheld but the consumer must be told something was withheld (6-1-1704(5)). Creditors already giving ECOA/Reg B and FCRA adverse-action notices are deemed compliant for the same decision (6-1-1704(6)).
Deployer: explain adverse decisions within 30 days (SB 26-189, C.R.S. 6-1-1704(3))
When a covered decision produces an adverse outcome, deliver within 30 days a plain-language disclosure explaining the decision, the role the ADMT played, a simple-to-follow process for requesting additional information about the ADMT and its inputs — including the ADMT's name, version number where applicable, the developer's identity, and the types, categories, and sources of personal data used, to the extent received from the developer (6-1-1704(3)(b)) — and how the consumer can exercise their rights. The AG must adopt rules fleshing out disclosure content by 1 January 2027; ECOA/FCRA adverse-action notices are deemed compliant for the same decision. Disclosures must be accessible to consumers with disabilities and limited English proficiency.
Deployer: honour correction and human-review requests after adverse outcomes (SB 26-189, C.R.S. 6-1-1705)
After an adverse outcome, on the consumer's request you must provide (1) instructions for requesting correction of factually incorrect or materially inaccurate personal data used in the decision, and (2) an opportunity for meaningful human review and reconsideration of the decision to the extent commercially reasonable. 'Meaningful human review' means a reviewer with authority to approve, modify, or override the decision, who is trained, considers the primary evidence, and does not default to the system's output (6-1-1701(15)). Correction of opinions, predictions, scores, or protected evaluations is not required (6-1-1705(1)(c)). Build the request intake and review workflow before the AG's implementing rules land (due 1 January 2027).
Keep compliance records and be ready for the AG cure window (SB 26-189, C.R.S. 6-1-1702(4), 6-1-1703, 6-1-1706)
Retain records demonstrating compliance for at least three years — developers from the creation of the record (6-1-1702(4)), deployers from the date of the consequential decision (6-1-1703), or longer where other law requires; keep version identifiers, changelogs, and material-update notices. Enforcement is by the Colorado Attorney General. The 60-day cure window is conditional: it applies only where the AG deems a cure possible, and is unavailable for knowing or repeated violations (6-1-1706(3)). The act does NOT sunset — only the cure subsection is repealed effective 1 January 2030, after which the AG may proceed directly to enforcement.
Disclaimer
Compliance guidance, not legal advice. Confirm obligations with counsel. Content version 2026.07.29-2, verified 2026-07-29.
Frequently asked questions
Who does Colorado ADMT Law (SB 26-189) apply to?
No Colorado consumers reported. SB 26-189 protects Colorado residents and individuals evaluated for access, eligibility, or opportunities in Colorado by a business doing business in Colorado. Coverage turns on the screening questions listed on this page — each obligation then applies its own statutory gate.
When does Colorado ADMT Law (SB 26-189) take effect?
applies from 1 January 2027
What are the obligations under Colorado ADMT Law (SB 26-189)?
Developer: provide deployers with technical documentation; Developer: notify deployers of material updates and modifications; Deployer: give consumers clear notice before ADMT use; Deployer: explain adverse decisions within 30 days; Deployer: honour correction and human-review requests after adverse outcomes; Keep compliance records and be ready for the AG cure window.
