Can one privacy policy cover the point-of-interaction notice?

Only if it is prominent and reasonably accessible at the point of interaction, not three clicks into a general privacy policy. 6-1-1704(2) talks about a link or posting reasonably proximate to the interaction or transaction.

Do we send the 30-day letter when we reject a job applicant?

If a covered ADMT materially influenced that employment decision and the outcome is adverse, 6-1-1704(3) applies from 1 January 2027. Confirm the AG rules for the exact contents of that letter.

Colorado SB26-189 notice requirements for deployers

C.R.S. § 6-1-1704 is the deployer-notice section of SB26-189. There are two notices: a clear and conspicuous pre-use notice (which a prominent public posting at the point of interaction can satisfy), and a 30-day post-adverse-outcome package. Both apply to consequential decisions made on or after 1 January 2027.

Educational resource only — not legal advice. scm.cc publishes a readiness report and engineering gap analysis for AI features. It does not give legal advice, represent you before a regulator, or state that a product is ready to ship under any law. This page is educational product guidance, not legal advice. It is not a readiness report, not an engineering gap analysis of your systems, and not a determination that any product meets a legal duty. Confirm current official text before you ship.

Last checked against official sources: 2026-10-11.

Point-of-interaction notice

Before using a covered ADMT to materially influence a consequential decision, tell the consumer that you used or will use it, and how to obtain the additional information the section describes. A prominent public notice that is reasonably accessible at the points of consumer interaction — including a link reasonably proximate to the transaction — satisfies 6-1-1704(1) via (2).

Thirty-day adverse-outcome letter

If the decision is adverse, within thirty days provide: (a) a plain-language description of the decision and the ADMT’s role; (b) a simple process to request more information (name, version, developer, types / categories / sources of personal data, to the extent you received them from the developer under 6-1-1702); and (c) an explanation of the § 6-1-1705 rights and how to exercise them. The Attorney General must adopt rules that clarify this letter by 1 January 2027. Freeze copy after those rules, not before.

Trade secrets, credit, FERPA, accessibility

You may withhold a trade secret or information protected from disclosure by other law; if you withhold, you must tell the consumer that you did. Creditors who already send ECOA / Regulation B (and where applicable FCRA) notices can satisfy overlapping duties if those notices also meet this section. Education deployers subject to FERPA may use existing FERPA channels. All notices must be reasonably accessible to consumers with disabilities and limited English proficiency.

Questions teams ask

Can one privacy policy cover the point-of-interaction notice?: Only if it is prominent and reasonably accessible at the point of interaction, not three clicks into a general privacy policy. 6-1-1704(2) talks about a link or posting reasonably proximate to the interaction or transaction.
Do we send the 30-day letter when we reject a job applicant?: If a covered ADMT materially influenced that employment decision and the outcome is adverse, 6-1-1704(3) applies from 1 January 2027. Confirm the AG rules for the exact contents of that letter.

Back to the AI law hub

Primary sources

Official text wins. Last checked 2026-10-11. This page is educational product guidance, not legal advice. It is not a readiness report, not an engineering gap analysis of your systems, and not a determination that any product meets a legal duty. Confirm current official text before you ship.