SB 26-189, the Automated Decision-Making Technology in Consequential Decisions Act, reaches businesses that use software to score, rank, or classify people in hiring, lending, housing, insurance, healthcare, and education decisions. There is no small business exemption.
Schedule a ConsultationColorado passed the country’s first comprehensive AI law in 2024, then repealed and replaced it in 2026 after a federal court stayed enforcement. What replaced it is narrower in what it demands and broader in who it reaches. If you concluded the 2024 law did not apply to you, that conclusion is worth revisiting.
You are covered if you do business in Colorado and deploy covered ADMT to materially influence a consequential decision. In practice that means software that processes personal data and uses computation to generate output used to make, guide, or assist a decision about someone’s employment, education, housing, financial services, or healthcare.
The tool does not have to make the decision, and the vendor does not have to call it artificial intelligence. If software narrowed the field before a person looked, it counts.
Enforcement runs through the Colorado Attorney General as a deceptive trade practice under the Colorado Consumer Protection Act. There is no private right of action. A 60-day opportunity to cure applies where a cure is possible, and it sunsets January 1, 2030.
The Colorado Attorney General has filed proposed rules under SB 26-189. They are not final.
The Colorado Department of Law filed proposed Automated Decision-Making Technology and Chatbot Safety rules, 4 CCR 904-6, with the Secretary of State on August 11, 2026. Written comment is open through October 26, 2026, and comment received by September 4, 2026 will be considered for a revised draft the Department expects to publish on September 23. A rulemaking hearing is set for October 26, 2026. The rules are scheduled to take effect January 1, 2027, alongside the statutes.
The proposed rules add obligations the statute alone does not state, particularly around what an adverse outcome notice must contain and what meaningful human review requires. They also leave “materially influence,” the term that decides who is covered, undefined. Treat this page as the current baseline rather than a final answer, and see Colorado’s proposed ADMT rules.
General information, not legal advice. No attorney-client relationship is created by reading this page.
This page is for general informational purposes only and does not constitute legal advice. The discussion above is a simplified summary of Colorado SB 26-189 and is not a substitute for a complete legal analysis of your specific situation. Laws and regulations change, and key terms under SB 26-189 remain subject to Attorney General rulemaking. To understand your actual compliance obligations, consult with qualified legal counsel. Nothing on this page creates an attorney-client relationship between you and Hoog Law or Michael Hoog.
Most businesses cannot name every tool in their operation that scores or ranks people, because those features arrived inside products bought for other reasons. Building that list is the first real task, and everything else follows from it.
There is no small business exemption and no employee threshold. The three-part coverage test, and the software small businesses do not realize is covered.
A step-by-step decision tree for working out whether the statute reaches your business and what attaches if it does.
Hiring is where this bites first. What is already in your stack, the two notices you owe applicants, and the human review step most workflows do not have.
Obligations split by role. Most Colorado businesses are deployers. Some are quietly both, usually the ones who have customized a tool.
The pre-use notice and the 30-day adverse outcome notice, what each has to contain, when it has to go out, and what meaningful human review requires.
Your notices have to describe what the software did, and that information sits with your vendor. What to ask for, and why standard terms do not provide it.
Proposed rules landed August 11. What the draft adds beyond the statute, what it still leaves undefined, and why the comment window closes September 4.
How Colorado got from SB 24-205 to SB 26-189, the constitutional challenges, the federal picture, and an honest read on where this is heading.
Some days the water is clear and some days it is not. On making decisions while the Attorney General’s rules are still being written.
Colorado SB 26-189 is the Automated Decision-Making Technology in Consequential Decisions Act. Signed May 14, 2026, it repealed and reenacted the 2024 Colorado Artificial Intelligence Act (SB 24-205) and takes effect January 1, 2027. It imposes notice, human review, and recordkeeping obligations on businesses that deploy covered automated decision-making technology to materially influence consequential decisions.
Any person doing business in Colorado that deploys covered automated decision-making technology to materially influence a consequential decision in education enrollment or an education opportunity; employment or an employment opportunity that creates or may create an employer-employee relationship; the lease or purchase of residential real estate in Colorado; a financial or lending service; insurance, including underwriting, pricing, coverage, and claims adjudication; health-care services; and essential government services and public benefits, including eligibility and renewal determinations. There is no small business exemption and no employee-count threshold. Section 6-1-1708 does contain exemptions, but they are entity-based rather than size-based: HIPAA covered entities, insurers subject to section 10-3-1104.9 in the practice of insurance, and FDA-regulated medical devices. The first two carve employment decisions back in.
SB 26-189 takes effect January 1, 2027. The Colorado Attorney General must adopt implementing rules on or before that same date. The 60-day right to cure available in Attorney General enforcement actions sunsets January 1, 2030.
The work generally starts with an inventory of tools that score, rank, or classify people, followed by a coverage analysis under the statute, drafting the required pre-use and adverse outcome notices, designing a meaningful human review process, reviewing vendor agreements to secure the information the notices require, and setting up three-year recordkeeping.
No. An executive order signed December 11, 2025 directed the Department of Justice to establish an AI Litigation Task Force to challenge state AI laws and named Colorado's SB 24-205 specifically, which led to the xAI constitutional challenge and a stay of that earlier statute. But an executive order cannot preempt state law on its own; preemption requires congressional action. The Great American AI Act, released June 2026 as a discussion draft, would pause state laws regulating AI model development and as drafted does not reach laws regulating use or deployment. SB 26-189 regulates deployment.
Hoog Law works with Longmont and Boulder County businesses on AI compliance, so you know where you stand and have something in place before it matters. I would welcome the chance to talk through your situation.
Schedule a Consultation