Does Colorado's AI law apply to your business? Work through three questions to find out, then see exactly what your compliance obligations are before the January 1, 2027 deadline.
Schedule a ConsultationTechnology that processes personal data and uses computation to generate output, including predictions, recommendations, classifications, rankings, scores, or other information that is used to make, guide, or assist a decision, judgment, or determination concerning an individual.
Examples: applicant tracking systems that rank resumes, credit and lending decisioning tools, insurance underwriting and claims models, tenant screening software, clinical decision support, benefits eligibility systems.
The definition turns on what the software does, not what it is called. A vendor does not have to market a product as artificial intelligence for it to be covered. Two elements have to be present: it processes personal data, and it uses computation to generate output that is used to make, guide, or assist a decision about an individual.
The Act lists technologies that are not ADMT: anti-malware, anti-virus, calculators, databases, data storage, firewalls, internet domain registration, website loading, networking, spam and robocall filtering, spell-checking, spreadsheets that require human analysis and do not use machine learning or large language models, web caching, and web hosting. Also excluded is a tool used solely to summarize, organize, translate, draft, route, or present information for human review, and natural-language technology that is neither intended for use in a consequential decision nor permitted to be so used under an acceptable use policy.
Not covered ADMT. Aggregate analysis, infrastructure operations, and the listed technologies fall outside the definition.
The tool meets the definition. Next, test whether it materially influences the decision.
This is a two-part test and both parts have to be met. The output must be a non-de minimis factor used in making the consequential decision, and it must affect the outcome, including by constraining, ranking, scoring, recommending, classifying, or otherwise meaningfully altering how the decision is made.
Material influence does not include incidental, trivial, or clerical uses. The practical question is whether the software narrowed the field before a person looked at it.
Out of scope for this use. An incidental or clerical role does not trigger the Act.
The tool influences the outcome. Next, test whether the decision itself is consequential.
A consequential decision is one relating to the provision of, or a consumer's access to, eligibility for, selection for, or compensation for, a covered domain. It also reaches differentiated price, cost sharing, compensation, or other material terms, but only where those are reasonably likely to materially limit, delay, effectively deny, or otherwise fundamentally alter access, eligibility, or opportunity. Covered domain is a closed list of seven.
Education enrollment or an education opportunity
Employment or an employment opportunity that creates or may create an employer-employee relationship
The lease or purchase of residential real estate in Colorado
A financial or lending service
Underwriting, pricing, coverage, claims adjudication, and other determinations that materially affect access to benefits
Health-care services
Essential government services and public benefits, including eligibility and renewal determinations
What the Act expressly excludes. Low-stakes and routine decisions are not consequential decisions, including routine scheduling, classroom personalization, administrative routing, customer service triage, communication of decisions, and workflow management. Neither are advertising, marketing, differentiated product recommendations, search, or content moderation. Nor is using an ADMT solely to summarize, organize, or present information for human review where the system produces no score, ranking, recommendation, classification, prediction, or other inference that materially influences the outcome. Utilities such as electricity, gas, water, and broadband are not named in the Act.
Out of scope. If the decision is not about one of the seven domains, it is not a consequential decision.
The decision is consequential. Last, check whether an entity-based exemption applies.
Section 6-1-1708 contains real exemptions, but they turn on what kind of entity you are, not how large you are. There is no small business exemption and no employee-count threshold. Two of the three carve employment decisions back in, so an exempt entity is still answerable for its own hiring.
HIPAA covered entity or business associate. Outside sections 6-1-1701 through 6-1-1706, except for a consequential decision related to employment or an employment opportunity. For health-care providers, this applies only if operating from a location within Colorado.
Insurer subject to section 10-3-1104.9. Deemed in compliance in the practice of insurance. Employment decisions by insurers remain covered.
FDA-regulated medical device. Sections 6-1-1701 through 6-1-1706 do not apply to a medical device under FDA oversight, or to FDA-supervised pharmaceutical and medical device research and development.
One provision that is often mistaken for an exemption. A creditor that provides the notice already required by the Equal Credit Opportunity Act, and where applicable the Fair Credit Reporting Act, is treated as satisfying section 6-1-1704's notice requirements for that same decision or adverse outcome. That credits a notice you were already giving. It does not put the creditor outside the Act.
Out of scope for that use. Document the basis and retain it. Remember that employment decisions are carved back in for HIPAA covered entities and insurers.
Compliance obligations apply. See below for what you are required to do before January 1, 2027.
If you reached this point, you are a covered deployer. Your obligations depend on whether you license the system from a vendor or built it yourself.
What is settled and what is not. Meaningful human review, materially influence, adverse outcome, and covered domain are all defined in the statute. What remains open is how they will be applied. The Attorney General is required to adopt rules clarifying the post-adverse-outcome disclosure requirements on or before January 1, 2027, and the June 2026 pre-rulemaking paper asked broader questions than that, including whether to further clarify what counts as ADMT, what materially influence means, and which decisions are consequential. A 60-day cure window applies before penalties attach, sunsetting January 1, 2030. There is no private right of action. Enforcement is by the Colorado Attorney General only.
Legal disclaimer. This page is for general informational purposes only and does not constitute legal advice. The decision tree above is a simplified summary of SB 26-189 and is not a substitute for a complete legal analysis of your specific situation. Laws and regulations change, and key terms under SB 26-189 remain subject to Attorney General rulemaking. To understand your actual compliance obligations, consult with qualified legal counsel. Nothing on this page creates an attorney-client relationship between you and Hoog Law or Michael Hoog.
ADMT stands for Automated Decision-Making Technology. Under SB 26-189, it means technology that processes personal data and uses computation to generate output, including predictions, recommendations, classifications, rankings, or scores, that is used to make, guide, or assist to a decision about a specific individual, including systems that substantially inform a human decision-maker. Examples include AI hiring screeners, credit scoring models, insurance underwriting tools, tenant screening algorithms, and clinical decision support software.
SB 26-189 uses a closed list of seven covered domains: education enrollment or an education opportunity; employment or an employment opportunity that creates or may create an employer-employee relationship; the lease or purchase of residential real estate in Colorado; a financial or lending service; insurance, including underwriting, pricing, coverage, and claims adjudication; health-care services; and essential government services and public benefits, including eligibility and renewal determinations. The Act expressly excludes low-stakes and routine decisions such as routine scheduling, administrative routing, customer service triage, communication of decisions, and workflow management, as well as advertising, marketing, differentiated product recommendations, search, and content moderation. Utilities such as electricity, gas, water, and broadband are not named in the Act.
A covered deployer under SB 26-189 must: (1) provide written pre-decision notice before using ADMT in any decision affecting an individual; (2) issue an adverse action disclosure after any negative decision, explaining what was decided, what personal data was used, and the basis for the outcome; (3) offer the individual a meaningful opportunity to request human review of AI-influenced decisions; (4) obtain and retain the developer’s technical documentation including intended uses, training data categories, and known inappropriate uses; (5) retain all compliance documentation, decision logs, and changelogs for a minimum of 3 years; and (6) monitor AG rulemaking and update compliance programs when rules are finalized.
Yes. If you use a third-party AI tool and your use of it influences decisions about identifiable individuals in a covered category, the deployer compliance obligations are yours regardless of where the software came from. You must also obtain and retain the vendor’s technical documentation as part of your compliance program.
Colorado SB 26-189 takes effect January 1, 2027. A 60-day cure window applies before penalties attach, through January 1, 2030. Enforcement is by the Colorado Attorney General only, there is no private right of action. Key terms including materially influence, meaningful human review, adverse outcome, and covered domain are defined in the statute. What remains open is how they will be applied. The Attorney General must adopt rules clarifying the post-adverse-outcome disclosure requirements on or before January 1, 2027.
Four exemptions apply under SB 26-189: (1) HIPAA-covered entities for non-employment uses of ADMT; (2) insurers already satisfying existing Colorado algorithmic discrimination rules; (3) creditors satisfying ECOA or FCRA adverse action notice requirements; and (4) FDA-regulated medical devices. Where an exemption applies, businesses should document the exemption basis and retain that documentation on file.
This describes what the statute says. The Colorado Attorney General has not yet promulgated rules under SB 26-189, and the rules will matter.
The statute requires the Attorney General to adopt rules clarifying the post-adverse-outcome disclosure requirements on or before January 1, 2027, the same day the law takes effect. The Attorney General’s office published a pre-rulemaking considerations paper in June 2026 and accepted informal public comment through July 13, 2026. That paper asked broader questions than the statutory mandate requires, including whether the regulations should further clarify what counts as automated decision-making technology, what “materially influence” means, and which decisions are “consequential.” Formal notice-and-comment rulemaking, with draft regulations and at least one public hearing, is expected to begin in late summer 2026.
Those are the definitions this page relies on. Expect the rules to add specificity, and in some areas to change how these terms apply in practice. Anything here should be treated as the statutory baseline rather than a final answer, and revisited once the rules issue.
General information, not legal advice. No attorney-client relationship is created by reading this page.
A single conversation is usually enough to work through the coverage questions. Hoog Law helps Colorado businesses understand what SB 26-189 requires and build programs that hold up as the rules develop.
Contact Hoog Law