Colorado SB26-189 requirements (the law that replaced the Colorado AI Act)

What SB26-189 is not

It is not SB24-205. Do not implement the February 2026 “high-risk AI system” dates from the 2024 act. Those provisions were repealed and reenacted. The live instrument is the 2026 act, approved 14 May 2026.

Covered ADMT and consequential decisions

The act defines automated decision-making technology as technology that processes personal data and uses computation to generate output — predictions, recommendations, classifications, rankings, scores, or other information — used to make, guide, or assist a decision concerning an individual. A consequential decision relates to an individual’s access to, eligibility for, or compensation related to education, employment, housing, financial or lending services, insurance, health-care services, or essential government services and public benefits. A covered ADMT is an ADMT used to materially influence such a decision.

Developer duties from 1 January 2027

A developer of a covered ADMT must give each deployer technical documentation that a deployer can reasonably understand, describing intended uses, categories of training data, known limitations, and instructions for appropriate use and human review, while protecting trade secrets. Developers must notify deployers of material updates. Developers and deployers retain records reasonably necessary to demonstrate they met the act for at least three years.

Deployer notices

Before using a covered ADMT to materially influence a consequential decision, the deployer must give the consumer a clear and conspicuous notice that the ADMT was or will be used, plus instructions for obtaining the additional information the section describes. Maintaining a prominent public notice that is reasonably accessible at the point of interaction — including a link reasonably proximate to the transaction — satisfies that pre-use duty (C.R.S. § 6-1-1704(1)–(2)).

If the decision is adverse, the deployer has thirty days to send a plain-language description of the decision and the ADMT’s role, a simple process to request more information (name, version, developer, types / categories / sources of personal data to the extent the deployer received them), and an explanation of the consumer rights in § 6-1-1705. The Attorney General must adopt rules clarifying those post-adverse disclosures by 1 January 2027.

Enforcement

The Attorney General enforces the act. Before an enforcement action, the AG issues a notice of violation if a cure is deemed possible; failure to cure within sixty days can lead to an action. This page does not predict an enforcement outcome.

Questions teams ask

Does a SaaS chatbot that answers product questions need a Colorado notice?

Only if it is a covered ADMT used to materially influence a consequential decision in a listed domain. A docs bot that does not decide employment, credit, housing, education, insurance, health care, or essential government services is outside that definition. A résumé screener is inside it.

We sell the model; the customer runs the decision. Who notices the consumer?

The deployer gives the consumer notice (6-1-1704). The developer gives the deployer the documentation (6-1-1702). Dual-role vendors do both.

When do we actually have to have this live?

Section 5: the act takes effect 1 January 2027 and applies to consequential decisions made on or after that date. Rulemaking on the post-adverse letter is also due by that day. Some administrative sections took effect on passage (14 May 2026).

Related pages

• Colorado SB26-189 notice requirements for deployers
• AI hiring tools: EU high-risk duties and Colorado SB26-189 notices
• Colorado SB26-189 notice template