Does Colorado’s AI Law Apply to My Small Business?

Short answer: quite possibly, and there is no size threshold that gets you out of it. Colorado SB 26-189 contains no small business exemption and no employee-count carve-out. A four-person company in Longmont running applicants through an AI screening tool is covered on the same terms as a company with four thousand employees.

That surprises people, so it is worth walking through how coverage actually works.

What the law is

Governor Polis signed SB 26-189 on May 14, 2026. It repealed the 2024 Colorado Artificial Intelligence Act, SB 24-205, and replaced it with the Automated Decision-Making Technology in Consequential Decisions Act. It takes effect January 1, 2027, and the Colorado Attorney General has to issue implementing rules by that same date.

If you read about the 2024 law, decided it did not reach you, and stopped paying attention, that conclusion deserves another look. The rewrite reduced what the law demands, and the relief it offers is narrower and more specific than the exemptions people remember.

The three-part coverage test

You are covered if you are a person doing business in Colorado who deploys covered ADMT to materially influence a consequential decision. Each term does work.

1. Covered ADMT

Covered automated decision-making technology is technology that processes personal data and uses computation to generate output, including predictions, recommendations, classifications, rankings, scores, or other information that is used to make, guide, or assist a decision, judgment, or determination concerning an individual.

Notice what that definition does not require. It does not require the vendor to call the product artificial intelligence. It does not require a large language model or a neural network or anything anyone would describe as advanced. A scoring rule that ranks applicants by keyword match processes personal data and produces a ranking used to guide a decision. The marketing language on the product page is not the test.

2. Consequential decision

A consequential decision is a decision, determination, or action made about a consumer relating to the provision of, or the consumer’s access to, eligibility for, selection for, or compensation for, a covered domain. It also reaches decisions about differentiated price, cost sharing, compensation, or other material terms, but only where those terms are reasonably likely to materially limit, delay, effectively deny, or otherwise fundamentally alter the consumer’s access, eligibility, or opportunity for a covered domain.

Employment catches the most Colorado small businesses, because hiring software is now standard inside products bought for other reasons. Real estate catches property managers screening tenants. Financial services catches lenders and anyone extending credit terms.

3. Materially influence

Materially influence is a two-part test, and both parts must be met. The ADMT output must be a non-de minimis factor used in making the consequential decision, and it must affect the outcome, including by constraining, ranking, scoring, recommending, classifying, or otherwise meaningfully altering how the decision is made. The Act adds that materially influence does not include incidental, trivial, or clerical uses.

Your calendar software is not covered. Spell check is not covered. A tool that sorts fifty applicants into a ranked list, where you interview the top eight, is covered. The question is whether the software narrowed the field before a human looked at it.

Why size does not save you

Nothing in SB 26-189 keys to headcount or revenue. The Act does contain exemptions, and they are worth knowing, but every one of them is about what kind of entity you are rather than how big you are. They live in section 6-1-1708.

A HIPAA covered entity or business associate falls outside sections 6-1-1701 through 6-1-1706, except for consequential decisions about employment. An insurer subject to section 10-3-1104.9 is deemed in compliance in the practice of insurance, with the same employment carve-back. FDA-regulated medical devices, and FDA-supervised pharmaceutical and device research, sit outside the operative sections entirely.

Note what the employment carve-back does. A Colorado hospital may be outside the Act for clinical decisions and squarely inside it for hiring. Being an exempt entity is not the same as being an exempt business.

One more provision gets mistaken for an exemption. A creditor that provides the notice the Equal Credit Opportunity Act or the Fair Credit Reporting Act already requires is treated as satisfying section 6-1-1704's notice requirements for that same decision. That credits a notice you were giving anyway. It does not put the creditor outside the Act.

For a small Colorado business, the practical effect of the 2026 rewrite was probably to bring you in rather than let you out. The obligations got lighter. The door got wider.

Software you did not think of as AI

The most common way a small business ends up covered is through a feature inside a product bought for a different purpose. Some places to look:

• Applicant tracking systems that rank or score resumes, or auto-reject on criteria
• Job posting platforms with candidate matching or recommended-applicant features
• Assessment platforms that return a numeric or banded score on candidates
• Property management software that screens tenants or scores rental applications
• Lending, factoring, or credit decisioning tools, including those built into accounting software
• Insurance underwriting, pricing, coverage, or claims adjudication tools
• Background check services that return a risk score rather than a records report

Most businesses cannot produce this list from memory. Building it is the first real task, and it usually takes longer than owners expect, because the features sit inside subscriptions nobody thinks of as AI purchases.

What the Act expressly does not cover

This part gets skipped in most write-ups, and skipping it leads businesses to paper things they never had to paper. The Act carves out a great deal by name.

Not a consequential decision. Low-stakes and routine decisions are excluded by name, including routine scheduling, classroom personalization, administrative routing, customer service triage, communication of decisions, and workflow management. So is advertising, marketing, differentiated product recommendations, search, and content moderation. So is using an ADMT solely to summarize, organize, or present information for human review, as long as the system produces no score, ranking, recommendation, classification, prediction, or other inference that materially influences the outcome. So are narrow procedural and data-processing tasks, cybersecurity and spam filtering, anti-money-laundering controls, and sanctions compliance.

Not an ADMT at all. The Act lists these out: anti-malware, anti-virus, calculators, databases, data storage, firewalls, internet domain registration, website loading, networking, spam and robocall filtering, spell-checking, spreadsheets that require human analysis and do not use machine learning or large language models, web caching, and web hosting. Also excluded is a tool used solely to summarize, organize, translate, draft, route, or present information for human review.

There is also a carve-out for natural-language technology, the chatbot-style tools that answer questions or make referrals, but it comes with conditions. It applies only where the technology is not contracted, advertised, marketed, configured, or intended for use in a consequential decision and is subject to an acceptable use policy prohibiting its output from being used in one. Both halves have to hold.

Two practical consequences. Lead scoring that drives marketing is outside the Act. Scheduling and triage are outside it. But if a tool that started as one of those begins narrowing who gets hired, housed, or covered, the exclusion stops doing any work for you.

Using a vendor’s tool does not move the obligation

The deployer obligations attach to the business deploying the technology, not only to the developer that built it. If you license a hiring platform and it materially influences who you interview, the duty is yours. Buying the software does not transfer it.

What buying the software does do is make your vendor agreement much more important, because your notices have to describe the role the technology played, and that information lives with the vendor. Most standard terms of service were not written to give you that. Reviewing those agreements is part of the compliance work, and it is the piece most businesses have not started. This is ordinary commercial contract review pointed at a new problem.

What you owe if you are covered

Three obligations attach to deployers:

• Pre-use notice. Clear and conspicuous notice before the technology is used to materially influence a consequential decision, with instructions for getting more information.
• Adverse outcome notice within 30 days. A plain-language description of the role the technology played, how to request more information, and what rights the person has.
• Records for at least three years after the consequential decision.

Consumers also get rights you need a working process to honor. After an adverse outcome, a person can request instructions for correcting personal data that is factually incorrect or materially inaccurate, and can request meaningful human review and reconsideration where that is commercially reasonable. A written policy promising human review is not the same as having someone who can actually perform it inside the window.

What happens if you get it wrong

The Colorado Attorney General enforces the statute as a deceptive trade practice under the Colorado Consumer Protection Act. There is no private right of action, so this is not a class action exposure.

Before bringing an action, the Attorney General must issue a notice of violation and give you 60 days to cure where a cure is possible. That cure period sunsets January 1, 2030, and it does not apply to knowing or repeated violations. Read plainly: there is real grace for a business that made a good-faith effort and got a detail wrong, and none for a business that knew and did nothing.

Where to start

To that end, start with the inventory. Walk your subscriptions and list every tool that scores, ranks, classifies, or recommends people. Then, for each one, ask whether it touches education enrollment or an education opportunity; employment or an employment opportunity that creates or may create an employer-employee relationship; the lease or purchase of residential real estate in Colorado; a financial or lending service; insurance, including underwriting, pricing, coverage, and claims adjudication; health-care services; and essential government services and public benefits, including eligibility and renewal determinations, and whether it narrows the field before a human decides.

If the answer to both is yes for even one tool, you have work to do before January 1, 2027, and it is far easier now than in December. The SB 26-189 compliance checklist walks the coverage question step by step. For how Colorado arrived here after two years of rewrites, and where the federal picture actually stands, see the full analysis. For a working approach while the Attorney General’s rules are still pending, Diving Blind.

If you are not sure whether a particular tool puts you in scope, that uncertainty is the reason to find out rather than a reason to wait. AI governance and compliance is a practice area at Hoog Law, and I would welcome the chance to talk your situation through. It is usually a short conversation.