CO, US · AI law tracker
SB26-189 — CO, US
SB26-189 is an AI governance legislation from CO, currently in committee. Colorado SB26-189, concerning automated decision-making technology, was introduced and assigned to committee [2]. AIGI tracks 2 primary-source updates on this bill; the most recent was published on 2026-05-01.
Status & timeline
- Regulatory stage
- in committee
- Bill status
- in committee
- Authority / governing body
- Colorado General Assembly
- Chamber
- senate
- Document type
- legislation
Next deadline: No fixed deadline — currently under consideration.
Subscriber only
Full obligation matrix
| Actor | Obligation | Deadline | Source |
|---|---|---|---|
| developer | Provide deployers of covered ADMT with technical documentation describing intended uses, categories of training data, known limitations, and instructions for appropriate use and human review. | 2027-01-01 | — |
| developer | Notify deployers of material updates or modifications to the covered ADMT. | — | — |
| developer | Retain records necessary to demonstrate compliance with the bill for at least 3 years. | — | — |
| deployer | Provide clear and conspicuous notice to consumers at the point of interaction with a covered ADMT. | — | — |
| deployer | Provide a consumer with a plain language description of a covered ADMT's role within 30 days after the covered ADMT makes a consequential decision that results in an adverse outcome for the consumer. | 30 days after adverse outcome | — |
| deployer | Allow consumers the right to request personal data used by a covered ADMT. | — | — |
| deployer | Allow consumers the right to request correction of factually incorrect personal data used by a covered ADMT. | — | — |
| deployer | Grant consumers the right to request meaningful human review and reconsideration following a covered ADMT making a consequential decision resulting in an adverse outcome. | — | — |
| deployer | Retain records necessary to demonstrate compliance with the bill for at least 3 years. | — | — |
| agency | Adopt rules to clarify post-adverse outcome disclosure requirements. | 2027-01-01 | — |
| agency | Enforce the bill through the 'Colorado Consumer Protection Act'. | — | — |
| agency | Provide developer or deployer with a 60-day notice and opportunity to cure alleged violations before initiating an action, if a cure is deemed possible. | — | — |
Subscriber only
Enforcement risk score
Announced regulation; enforcement footprint still forming.
Subscriber only
Role-based compliance checklist
- data_scientist Prepare technical documentation for all ADMTs used in consequential decisions, detailing intended uses, training data, limitations, and instructions for human review. (2027-01-01)
- product_manager Establish processes to notify deployers of material updates or modifications to ADMTs.
- compliance_officer Implement clear and conspicuous consumer notice mechanisms for interaction with covered ADMTs.
- compliance_officer Develop a process to provide consumers with plain language descriptions of ADMT's role within 30 days of an adverse outcome.
- general_counsel Establish procedures for consumers to request personal data and correction of factually incorrect personal data used by ADMTs.
- hr_director Implement a process for meaningful human review and reconsideration of ADMT consequential decisions leading to adverse outcomes.
- compliance_officer Ensure records necessary to demonstrate compliance with the bill are retained for at least 3 years.
- general_counsel Review existing anti-discrimination policies and processes in light of ADMT fault allocation provisions.
Subscriber only
Vendor impact assessment
- Vendor risk class
- high
- Procurement categories
- hr_tech, customer_service_ai, fraud_detection, financial_decisions, healthcare_ai, other
Vendors providing automated decision-making technology (ADMT) to Colorado-based deployers will need to supply extensive technical documentation and ensure their systems facilitate consumer rights regarding transparency, data access, correction, and human review. Deployers must scrutinize vendor offerings for alignment with these obligations.
Sample vendor questions
- Can the vendor provide technical documentation detailing the ADMT's intended uses, training data, known limitations, and instructions for appropriate use and human review, as required by CO SB26-189?
- Does the vendor have a process to notify us of material updates or modifications to their ADMTs that might impact our compliance?
- How does the vendor's ADMT support our ability to provide clear and conspicuous consumer notices and plain language descriptions after adverse outcomes?
- What mechanisms does the vendor offer to facilitate consumer requests for data access, correction, and meaningful human review of ADMT decisions?
- What record-keeping capabilities does the vendor's system provide to help us demonstrate compliance for at least 3 years?
- How does the vendor's ADMT integrate with our existing processes for human oversight and intervention in consequential decisions?
Intelligence briefs (2)
Colorado SB26-189 Introduced: Automated Decision-Making Technology
Colorado SB26-189, concerning automated decision-making technology, was introduced and assigned to committee [2].
This signals emerging legislative intent in Colorado to regulate AI systems involved in consequential decisions.
Deadline: No fixed deadline — currently under consideration.
Primary source →Colorado Bill Enhances ADMT Developer/Deployer Obligations in Consequential Decisions
The bill adds developer technical documentation and deployer consumer notice requirements for ADMTs used in consequential decisions, effective January 1, 2027 [2].
This legislation expands Colorado's AI consumer protection framework, establishing specific compliance obligations for both developers and deployers of ADMTs in sensitive contexts.
Deadline: January 1, 2027, for developer technical documentation and deployer notice requirements to take effect; Attorney General rules for post-adverse outcome disclosures by January 1, 2027.
Primary source →Frequently asked questions
- What is SB26-189?
- Colorado Senate Bill 26-189, titled 'Automated Decision-Making Technology,' has been introduced, addressing the use of automated decision-making technology in consequential decisions [1]. The bill was introduced on May 1, 2026, and subsequently assigned to the Senate Business, Labor, & Technology Committee for consideration [2]. This development marks an early legislative step in regulating AI within the state. Primary source →
- Why does SB26-189 matter?
- This signals emerging legislative intent in Colorado to regulate AI systems involved in consequential decisions. Primary source →
- Who does SB26-189 affect?
- Organizations deploying automated decision-making technology in Colorado, particularly those making 'consequential decisions,' are within the potential scope. This includes entities operating in sectors such as labor and employment or telecommunications and information technology, where AI systems might influence significant individual outcomes. Primary source →
- What are the key dates for SB26-189?
- No fixed deadline — currently under consideration. Primary source →
- What is the current status of SB26-189?
- As of the last published update, SB26-189 is at the "in committee" stage, with bill status "in committee". Primary source →
- Where can I find the primary source for SB26-189?
- The primary source for the most recent update is at https://leg.colorado.gov/bills/sb26-189. AIGI publishes the full citation chain plus every approved brief on this bill. Primary source →
Related
Stay informed