What Colorado’s AI Notices Actually Have to Say

Two notices carry most of the compliance weight under SB 26-189. One goes out before you use the technology. One goes out within 30 days of an adverse outcome. Neither is long, and both are easy to get wrong in ways that matter.

A caveat worth stating up front. The Colorado Attorney General must adopt implementing rules on or before January 1, 2027, and those rules are where formatting and delivery specifics are likely to land. What follows is what the statute requires. Build to it, and expect to adjust once the rules issue.

Notice one: before you use the technology

You owe clear and conspicuous notice before covered ADMT is used to materially influence a consequential decision, including instructions for obtaining additional information.

The Act gives you a route to satisfying this that is more workable than it first sounds. Clear and conspicuous notice may be satisfied through a prominent public notice that is reasonably accessible at points of consumer interaction, including through a link or posting reasonably proximate to the interaction or transaction in which a consequential decision may occur.

You are not required to hand every applicant an individualized disclosure. A well-placed, plainly written notice at the point where the interaction happens can do the work. What will not do the work is a paragraph buried in a terms of service update, or a link nowhere near the transaction. The word doing the most here is proximate.

The Attorney General has asked for comment on what should count as clear and conspicuous, including what level of detail is most useful and how to handle accessibility for consumers with disabilities or limited English proficiency. Expect the rules to say more about form than the statute does.

Timing is the part businesses miss. Before means before the technology influences the decision, not before the decision is announced. In hiring, the software usually screens at application, so the notice belongs at or before the application, not in the rejection email. In lending, it belongs at application, not at denial. If your notice shows up after the tool has already narrowed the field, it is late no matter how well written it is.

The instructions for obtaining additional information are a live obligation, not a formality. Whatever channel you name has to work and someone has to monitor it.

What counts as an adverse outcome

The 30-day clock only starts on an adverse outcome, and that is a defined term worth reading before you build anything.

An adverse outcome is a decision that denies, terminates, revokes, or materially reduces or restricts a consumer’s access to, eligibility for, selection for, compensation for, or the provision of an opportunity or service. It also covers a decision producing materially less favorable differentiated price, cost, compensation, or other material terms that are reasonably likely to materially limit, delay, effectively deny, or otherwise fundamentally alter those same things compared to terms offered to similarly situated consumers.

That comparison clause matters. The question is not whether a consumer got a worse deal than they hoped for. It is whether they got materially less favorable terms than similarly situated consumers did. The Act adds that where a decision imposes materially less favorable differentiated pricing or terms, the outcome does materially influence price, cost sharing, compensation, or material terms.

The Attorney General has asked whether the definition of adverse outcome is sufficiently clear or needs additional guidance, so this is one to watch.

Notice two: within 30 days of an adverse outcome

If covered ADMT materially influenced an adverse outcome, you owe a notice within 30 days containing a plain-language description of the role the technology played, instructions for requesting additional information, and an explanation of the consumer’s rights.

Plain language description of the role it played. Not that AI was involved. What it actually did. "Our applicant tracking system scored your application against the posted requirements and ranked it outside the range we advanced for interview" is a description. "Automated tools were used in processing your application" is not.

This is the requirement most dependent on your vendor. You cannot describe what the system did if the vendor will not tell you.

Instructions for requesting additional information. Same standard as above, and now under a clock, because a request that arrives on day 28 still needs somewhere to go.

An explanation of the consumer’s rights. Specifically the right to request correction of personal data that is factually incorrect or materially inaccurate, and the right to request meaningful human review and reconsideration where commercially reasonable. Telling someone they have those rights is what triggers people to use them, which is the point.

Thirty days is shorter than it sounds

Adverse outcomes tend to come in batches. A hiring round closes and forty rejections go out at once. Each one starts its own 30-day clock, and each triggers a right to ask for human review.

The failure mode is predictable. The notices go out, requests come back, and nobody owns responding. Before January, decide who receives these requests, who performs the review, and where the records go. For a small business that is one named person with calendar time, not a policy paragraph.

What "meaningful human review" requires

This one is not left to interpretation. The Act defines meaningful human review as review by an individual designated by the deployer who has authority to approve, modify, or override a consequential decision. That individual must consider available relevant primary evidence, must be trained, must not default to the system output, and must have access to sufficient information to understand the relevant aspects of the ADMT.

Read those elements as a checklist, because that is how they will be read against you:

• Designated. A specific person, identified in advance. Not whoever is available.
• Authority to approve, modify, or override. If your reviewer cannot overturn the outcome, you do not have a reviewer.
• Considers available relevant primary evidence. The underlying material, not just the score.
• Trained. Which implies training you can show you provided.
• Does not default to the system output. Agreeing with the tool every time is evidence, not a defense.
• Has access to sufficient information to understand the relevant aspects of the ADMT. Which loops straight back to what your vendor will tell you.

Four of those six are things you can put in place before January regardless of what the rules say. The last one depends on somebody else, which is why it should be the first one you start on.

The statute qualifies this with "where commercially reasonable," which gives smaller businesses some room. It is not a general exemption, and a business that never built any capacity to review will have a hard time arguing that review was not commercially reasonable.

Records

Keep documentation of compliance for at least three years after the consequential decision. Practically, that means the notices you sent, when they went out, requests you received, what you did about them, and the outcome.

Three years after the decision, not three years from now. A December 2027 hiring decision has to be documented into 2030.

Where to start

To that end, write both notices for one system first, the one touching the most people, usually hiring. Getting one right teaches you what you are missing, generally that your vendor will not tell you enough to write the adverse outcome notice honestly. That discovery is why this work should start well before December, and it feeds directly into what you need from your vendor agreements.

The SB 26-189 compliance checklist covers whether you are in scope, and the hiring article works through the employment case in detail. If you would like help drafting your own notices, I am glad to walk through them with you.