Colorado SB 26-189, the Automated Decision-Making Technology in Consequential Decisions Act, takes effect January 1, 2027. There is no small business exemption. Hoog Law helps Colorado businesses determine whether they are covered and build what the law requires.
Schedule a ConsultationGovernor Polis signed SB 26-189 on May 14, 2026. It repealed the Colorado Artificial Intelligence Act, the 2024 law known as SB 24-205, and replaced it with the Automated Decision-Making Technology in Consequential Decisions Act. The new law takes effect January 1, 2027. The Colorado Attorney General must adopt implementing rules on or before that same date.
The short version: Colorado narrowed what the law regulates and widened who it reaches. If you looked at the 2024 version, decided it did not apply to you, and moved on, that conclusion is worth revisiting.
The law reaches any person doing business in Colorado that deploys covered automated decision-making technology to materially influence a consequential decision. Three terms carry the weight.
Covered ADMT is technology that processes personal data and uses computation to generate output, including predictions, recommendations, classifications, rankings, scores, or other information that is used to make, guide, or assist a decision, judgment, or determination concerning an individual. That definition is written around what the software does, not what it is called. A vendor does not have to market a product as artificial intelligence for the product to be covered.
A consequential decision is a decision, determination, or action about a consumer relating to the provision of, or the consumer's access to, eligibility for, selection for, or compensation for, a covered domain. It also reaches decisions about differentiated price, cost sharing, compensation, or other material terms, but only where those are reasonably likely to materially limit, delay, effectively deny, or otherwise fundamentally alter the consumer's access, eligibility, or opportunity for a covered domain. That qualifier does real work. Ordinary price variation is not enough.
Covered domain is itself defined, and it is a closed list of seven: education enrollment or an education opportunity; employment or an employment opportunity that creates or may create an employer-employee relationship; the lease or purchase of residential real estate in Colorado; a financial or lending service; insurance, including underwriting, pricing, coverage, and claims adjudication; health-care services; and essential government services and public benefits, including eligibility and renewal determinations. If your decision is not about one of those seven, it is not a consequential decision.
The Act then carves out a good deal more. Consequential decision expressly does not include low-stakes or routine decisions such as routine scheduling, classroom personalization, administrative routing, customer service triage, communication of decisions, or workflow management. It does not include advertising, marketing, differentiated product recommendations, search, or content moderation. It does not include using an ADMT solely to summarize, organize, or present information for human review where the system produces no score, ranking, recommendation, classification, prediction, or other inference that materially influences the outcome.
Materially influence is a two-part test, and both parts must be met. The output must be a non-de minimis factor used in making the decision, and it must affect the outcome, including by constraining, ranking, scoring, recommending, classifying, or otherwise meaningfully altering how the decision is made. The Act adds that the term does not include incidental, trivial, or clerical uses. Your calendar software is not covered. A tool that ranks applicants and decides who gets a callback is.
This is the part that surprises people. SB 26-189 contains no small business carve-out and no employee-count threshold. It does contain exemptions in section 6-1-1708, but they turn on what kind of entity you are, not your size: HIPAA covered entities and their business associates, insurers subject to section 10-3-1104.9 in the practice of insurance, and FDA-regulated medical devices. The first two carve employment decisions back in, so an exempt entity is still answerable for its own hiring.
A four-person Longmont company running resumes through an AI screening tool is covered on the same terms as a company with four thousand employees. The obligations scale with what you deploy, not with how big you are.
If you screen job applicants, price services differently by customer, evaluate tenants or borrowers, or route patients using software that scores or ranks people, assume you need to look closely.
Three core obligations attach to deployers.
Consumers also gain rights that you need a working process to honor. After an adverse outcome, a consumer may ask for instructions on correcting personal data that is factually incorrect or materially inaccurate, and may request meaningful human review and reconsideration where that is commercially reasonable. A policy stating that you will provide human review is not the same as having someone who can actually perform it inside the window.
The deployer obligations run to the business deploying the technology, not only to the developer that built it. A hiring platform, a CRM with lead scoring, a tenant screening service, an underwriting engine: if the tool materially influences a consequential decision about a Colorado consumer, the duty is yours.
Buying software does not transfer the duty. It does make your vendor agreement considerably more important, because you now need contractual access to the information your own notices have to contain. Most standard vendor terms were not drafted with that in mind. Reviewing those agreements is part of the work, and it connects directly to commercial contract review.
The Colorado Attorney General enforces SB 26-189 as a deceptive trade practice under the Colorado Consumer Protection Act. There is no private right of action, which means you are not facing a class action risk from this statute directly.
Before bringing an action, the Attorney General must issue a notice of violation and allow 60 days to cure, where a cure is possible. That cure period sunsets January 1, 2030, and it does not apply to knowing or repeated violations. The practical read is that the first few years carry a meaningful grace period for businesses acting in good faith, and none for businesses that were told and did nothing.
SB 26-189 dropped several of the 2024 law's heaviest requirements: the duty of care to avoid algorithmic discrimination, mandatory risk management programs, impact assessments, annual reviews, and reporting to the Attorney General. Compliance is lighter in substance than what was originally on the books.
The exemptions that remain are entity-based and narrow, and none of them is a size threshold. For an ordinary small Colorado company that is not a HIPAA covered entity, an insurer, or an FDA-regulated device maker, the net effect of the rewrite was probably to bring you in rather than let you out.
Two federal efforts are aimed at state AI laws. Both seek to limit them. Neither has actually preempted anything, and whether either one could reach SB 26-189 is a live question rather than a settled answer.
The executive branch. On December 11, 2025, the President signed an executive order establishing a national policy framework for AI and directing the Attorney General to stand up a DOJ AI Litigation Task Force to challenge state AI laws. Colorado's SB 24-205 was the only state law named in the order. The task force acted: xAI filed a constitutional challenge to SB 24-205 in the U.S. District Court for Colorado on April 9, 2026, the Department of Justice intervened on April 24, and the court stayed enforcement on April 27.
That sequence is what pushed the legislature to rewrite the statute. It is also where the limits show. An executive order cannot preempt state law on its own. Preemption runs through the Supremacy Clause and requires congressional action, and courts are more reluctant to find preemption by executive decree than by statute. The order's real effect has been litigation pressure, not legal preemption.
It is worth noting what the stay actually covers. The xAI case challenged SB 24-205, which no longer exists. Whether those constitutional theories get re-aimed at SB 26-189, and whether they fare any better against a disclosure-based deployment statute than they did against an algorithmic discrimination statute, has not been tested.
Congress. In June 2026, Representatives Obernolte and Trahan released the Great American AI Act as a bipartisan discussion draft. It has not been introduced or voted on. Its preemption provision would pause state laws specifically regulating the development of AI models for three years, and as drafted it does not cover regulation of use or deployment. Colorado SB 26-189 regulates deployment, so on the current draft language it would likely survive. Congress has already rejected preemption provisions twice this session, and 36 state attorneys general have formally opposed this one.
The practical read: federal pressure is real and the litigation risk to state AI laws is not imaginary, but nothing has displaced SB 26-189, and the preemption vehicle most likely to move is aimed at a different layer of the stack. The January 1, 2027 date does not pause while this plays out. For a fuller treatment of the constitutional questions and where this is heading, see the full analysis.
The work starts with an inventory. Most businesses do not have a clear list of the tools in their operation that score, rank, or classify people, because those features arrived inside products bought for other reasons. Once the list exists, the questions get concrete: which of these touch a consequential decision, what notices do they trigger, who inside the company performs human review, what does the vendor contract say, and what records are being kept.
The SB 26-189 compliance checklist walks through the coverage question step by step. For the background on how Colorado got here and what the two-year rewrite means, see the full analysis of SB 26-189 and Diving Blind, on making decisions while the rules are still being written.
Colorado SB 26-189 applies to any person doing business in Colorado that deploys covered automated decision-making technology to materially influence a consequential decision. Covered ADMT is technology that processes personal data and uses computation to generate output, including predictions, recommendations, classifications, rankings, scores, or other information that is used to make, guide, or assist a decision, judgment, or determination concerning an individual. A consequential decision is a decision, determination, or action about a consumer relating to the provision of, or the consumer’s access to, eligibility for, selection for, or compensation for, a covered domain. Covered domain is a closed list of seven: education enrollment or an education opportunity; employment or an employment opportunity that creates or may create an employer-employee relationship; the lease or purchase of residential real estate in Colorado; a financial or lending service; insurance including underwriting, pricing, coverage, and claims adjudication; health-care services; and essential government services and public benefits. The Act expressly excludes low-stakes and routine decisions such as routine scheduling, administrative routing, customer service triage, communication of decisions, and workflow management, along with advertising, marketing, differentiated product recommendations, search, and content moderation. If you screen job applicants, evaluate tenants or borrowers, or make underwriting or coverage determinations using software that scores or ranks people, you should assume you need to look closely.
No. SB 26-189 contains no small business exemption and no employee-count threshold. A two-person Longmont company using an AI resume screener is covered on the same terms as a large employer. The Act does contain real exemptions in section 6-1-1708, but they are entity-based rather than size-based: HIPAA covered entities and their business associates, insurers subject to section 10-3-1104.9 in the practice of insurance, and FDA-regulated medical devices. The first two carve employment decisions back in, so a covered hospital or insurer still answers for its own hiring.
A deployer has three core obligations. First, provide clear and conspicuous notice before covered ADMT is used to materially influence a consequential decision, including instructions for obtaining more information. Second, if the technology materially influences an adverse outcome, provide notice within 30 days describing in plain language the role the technology played, how to request further information, and the consumer’s rights. Third, retain records documenting compliance for at least three years after the consequential decision.
After an adverse outcome, a consumer may request instructions for correcting personal data that is factually incorrect or materially inaccurate, and may request meaningful human review and reconsideration of the decision where that is commercially reasonable. Deployers need a process capable of receiving and acting on those requests, not just a policy that says they will.
Yes. The deployer obligations run to the business deploying the technology, not only to the developer that built it. If you use a hiring platform, a CRM with scoring features, a tenant screening service, or an underwriting tool, and that tool materially influences a consequential decision about a Colorado consumer, the obligation is yours. Buying the software does not transfer the duty. It does make your vendor contract and the representations in it a great deal more important.
An ADMT is used to materially influence a consequential decision when its output is a non-de minimis factor that affects the outcome. The Act also names categories of technology that are not ADMTs. Spell check and calendar scheduling are not covered. A tool that ranks applicants and determines who gets an interview is.
The Colorado Attorney General enforces SB 26-189 as a deceptive trade practice under the Colorado Consumer Protection Act. There is no private right of action. Before bringing an enforcement action the Attorney General must issue a notice of violation and allow 60 days to cure, where a cure is possible. That cure period sunsets January 1, 2030 and does not apply to knowing or repeated violations.
SB 26-189 was signed May 14, 2026 and takes effect January 1, 2027. The Colorado Attorney General must adopt implementing rules on or before that same date, which means some operational detail will arrive close to the deadline. Businesses that identify their covered systems early will be positioned to absorb the rules rather than start from zero once they issue.
Nothing has preempted SB 26-189, and whether federal action could is unsettled. Two efforts seek to limit state AI laws. First, the executive order signed December 11, 2025 directed the Department of Justice to establish an AI Litigation Task Force to challenge state AI laws, and named Colorado’s SB 24-205 specifically. That produced the xAI constitutional challenge filed April 9, 2026, DOJ intervention on April 24, and a stay of enforcement on April 27. But an executive order cannot preempt state law by itself. Preemption requires congressional action, and courts are more reluctant to find preemption by executive order than by statute. Second, the Great American AI Act, released June 2026 as a discussion draft and not yet introduced, would pause state laws specifically regulating the development of AI models for three years. As drafted it does not reach regulation of use or deployment. SB 26-189 regulates deployment, so it would likely survive that provision. The January 1, 2027 effective date does not pause while these questions are resolved.
SB 26-189 repealed and reenacted the Colorado Artificial Intelligence Act, formerly SB 24-205, as the Automated Decision-Making Technology in Consequential Decisions Act. It replaced the high-risk AI system and algorithmic discrimination framework with a narrower focus on automated decision-making technology. It removed the duty of care to avoid algorithmic discrimination, mandatory risk management programs, impact assessments, annual reviews, and Attorney General reporting. In exchange it eliminated the prior exemptions, so the obligations that remain reach more businesses.
This describes what the statute says. The Colorado Attorney General has not yet promulgated rules under SB 26-189, and the rules will matter.
The statute requires the Attorney General to adopt rules clarifying the post-adverse-outcome disclosure requirements on or before January 1, 2027, the same day the law takes effect. The Attorney General’s office published a pre-rulemaking considerations paper in June 2026 and accepted informal public comment through July 13, 2026. That paper asked broader questions than the statutory mandate requires, including whether the regulations should further clarify what counts as automated decision-making technology, what “materially influence” means, and which decisions are “consequential.” Formal notice-and-comment rulemaking, with draft regulations and at least one public hearing, is expected to begin in late summer 2026.
Those are the definitions this page relies on. Expect the rules to add specificity, and in some areas to change how these terms apply in practice. Anything here should be treated as the statutory baseline rather than a final answer, and revisited once the rules issue.
General information, not legal advice. No attorney-client relationship is created by reading this page.
This page is for general informational purposes only and does not constitute legal advice. The discussion above is a simplified summary of Colorado SB 26-189 and is not a substitute for a complete legal analysis of your specific situation. Laws and regulations change, and key terms under SB 26-189 remain subject to Attorney General rulemaking. To understand your actual compliance obligations, consult with qualified legal counsel. Nothing on this page creates an attorney-client relationship between you and Hoog Law or Michael Hoog.
Hoog Law works with Longmont and Boulder County businesses on AI compliance, so you know where you stand and have something in place before it matters.
Schedule a Consultation