Colorado's New AI Accountability Law: What SB 26-189 Requires

This post is informational and reflects the state of the law as of August 2026. For how this law applies to a specific system, consult a licensed attorney.

Colorado was first to pass a comprehensive state AI law, and then it changed its mind about what that law should be. In May 2026, Governor Polis signed SB 26-189, the Automated Decision-Making Technology Act, which replaced the 2024 Colorado AI Act (SB 24-205) before the earlier law ever took effect. The new statute takes effect January 1, 2027.

The shift matters. The 2024 law was built around risk assessments and algorithmic-discrimination governance. The replacement drops most of that and reorganizes around three things: transparency, notice, and consumer recourse. It is narrower, but it still reaches a lot of ordinary business software, and the compliance clock is running toward a hard date.

What the law regulates

The statute deliberately avoids the term “artificial intelligence.” It regulates “automated decision-making technology,” or ADMT: technology that processes personal data and uses computation to produce outputs, such as predictions, recommendations, classifications, rankings, or scores, that are used to make, guide, or assist decisions about people. Basic non-machine-learning infrastructure and purely administrative tools, like summarizing or routing something for human review, are excluded.

Obligations attach when ADMT materially influences a “consequential decision,” meaning one affecting access, eligibility, or pricing in a covered area: education enrollment, employment, residential real estate in Colorado, financial and lending services, insurance, healthcare, and essential government services. Two points make the scope wider than it first looks. There is no small-business exemption. And the safe harbor from the earlier law for following recognized frameworks like NIST AI 100-1 or ISO/IEC 42001 is gone.

What it requires

The duties split between the company that builds the technology and the company that uses it.

Developers must give deployers technical documentation, including intended uses, categories of training data, known limitations, and instructions for human review, and must notify deployers of material updates.

Deployers carry the consumer-facing obligations. Before the technology is used, the deployer must give the consumer clear, conspicuous notice that an automated system is involved; a prominent public disclosure at the point of interaction can satisfy this. Deployers must also retain records for at least three years.

The requirement with the most operational bite is the adverse-outcome duty. When ADMT contributes to a denial, a termination, a material reduction in a benefit, or materially worse pricing, the deployer has 30 days to give the affected person a plain-language explanation: what the decision was, the role the technology played, and the personal data involved, along with a path to correct the data or contest the outcome.

Why this matters outside Colorado

If you only operate in Colorado, January 1, 2027 is a firm deadline to build toward. If you operate nationally, the law still matters, for two reasons. Your Colorado users are covered regardless of where you sit. And Colorado tends to set a template other states borrow from, so the notice-and-explanation model here is worth understanding as a preview, not a one-state exception.

What to do before January 1, 2027

Start with an inventory: where in your business does software help decide who gets hired, admitted, approved, insured, treated, or priced, and how? That inventory is the foundation for everything else, because you cannot give notice or explanations for systems you have not mapped. From there, sort out which side of the developer/deployer line you are on for each system (you may be both), build the pre-use notice into the relevant flows, and design the 30-day adverse-outcome explanation process before you need it rather than after the first request arrives.

(For how this fits with AI use policies, vendor contracting, and privacy compliance, see the firm’s AI Governance and Privacy & Data Security practices.)

If automated tools factor into consequential decisions in your business, talk to MB Legal about getting ready before the effective date.

This post is informational and does not constitute legal advice. The application of SB 26-189 depends on your systems and how they are used. For guidance on a specific situation, consult a licensed attorney.