Summary: Governor Jared Polis has signed SB 26-189 (the Automated Decision-Making Technology Act), a comprehensive rewrite of Colorado's landmark AI Act that will take effect on January 1, 2027. The new law replaces the original SB 24-205 with a more streamlined framework addressing "Automated Decision-Making Technology" in consequential decisions. Following a federal lawsuit challenging the original law, Attorney General Phillip Weiser confirmed that he would not enforce the original law this summer while the new legislation was pending implementation. A Trump administration executive order challenging state AI laws has also complicated the landscape.1 Below, we outline the current state of the law and practical steps businesses should take now.
The Automated Decision-Making Technology Act (SB 26-189)
Colorado's AI Act (SB 24-205), signed in May 2024, was a landmark consumer protection statute and one of the first comprehensive state-level artificial intelligence regulations in the United States. Originally set to take effect in February 2026 (later pushed to June 30, 2026), the law drew a federal legal challenge and significant industry criticism. Governor Polis signed SB 26-189 on May 14, 2026, which repeals and reenacts Part 17 of Colorado's consumer protection statute under the title "Automated Decision-Making Technology in Consequential Decisions," replacing the original framework in its entirety with a more streamlined approach effective January 1, 2027.
The Automated Decision-Making Technology Act applies to "Automated Decision-Making Technology" (ADMT), which the statute defines as “a technology that processes personal data and uses computation to generate output including predictions, recommendations, classifications, rankings, scores, or other information that is used to make, guide, or assist a decision, judgment, or determination concerning an individual.” This terminology replaces the former "High-Risk AI System" concept and broadens the law's applicability. The statute defines "Covered ADMT" as any ADMT used to "materially influence" a consequential decision. "Materially Influence" means the ADMT output is a non-de minimis factor used in making a consequential decision affecting its outcome. A "Consequential Decision" is one impacting an individual's access to, eligibility for, selection for, or compensation related to education, employment, housing, financial or lending services, insurance, healthcare services, or essential government services.
Key compliance obligations include:
- Developer Obligations: Developers (a person doing business in Colorado that (a) develops, offers, sells, leases, licenses or otherwise makes a covered ADMT commercially available; (b) develops a component that is designed, marketed, intended, documented, advertised, configured or contracted to be used as part of a covered ADMT; or (c) intentionally and substantially modifies an ADMT such that it becomes a covered ADMT) must provide Deployers with technical documentation and instructions regarding the system's capabilities and intended uses, and notices of material updates, intentional and substantial modifications, and changes that impact the intended uses, limitations, or risk mitigation for the covered ADMT. Developers are also required to maintain records to demonstrate compliance with the Automated Decision-Making Technology Act for three (3) years after a required record’s creation. These obligations replace the former law's more expansive requirements, which included provision of documentation to Deployers regarding foreseeable uses, known harmful and/or inappropriate uses, training data summaries, known discrimination risks, and system limitations, as well as maintenance of a public use-case inventory and disclosure of known discrimination risks to the Attorney General and Deployers within 90 days of discovery.
- Deployer Obligations: Deployers (a person doing being in Colorado that deploys a covered ADMT) must maintain records demonstrating compliance for at least three (3) years after the consequential decision and provide consumer notices regarding the use of ADMT in consequential decisions. The former law's mandatory Risk Management Policy and Program, impact assessments upon initial deployment (and annually thereafter), and pre-decision consumer notification requirements are no longer required.
- Consumer Rights: If an adverse outcome occurs, consumers may request and a Deployer will provide (1) instructions for requesting personal data and correcting factually incorrect or materially inaccurate personal data used in the consequential decision and (2) the opportunity to request meaningful human review and/or reconsideration of the consequential decision so long as it is commercially reasonable.
- Enforcement: Enforcement remains vested exclusively in the Attorney General, with no private right of action. Violations under the Automated Decision-Making Technology Act are considered deceptive trade practices under the Colorado Consumer Protection Act (the Consumer Protection Act) and enforcement happens through the Consumer Protection Act. If the violation can be cured, the Attorney General must provide a sixty (60) day notice and cure period before seeking enforcement unless the violation is known or repeated. The Attorney General is also required to adopt rules to clarify what post-adverse outcome disclosure requirements entail by the effective date.
- Civil Liability Framework: A new section establishes that Developers and Deployers may be held civilly liable for unlawful discrimination claims based on their relative fault under existing laws which include the Colorado Anti-Discrimination Act. The Automated Decision-Making Technology Act also voids indemnification provisions in contracts between Deployers and Developers that shield a party from liability for its own anti-discrimination violations arising from ADMT use.
What Businesses Should Do Now
With enactment of the Automated Decision-Making Technology Act, businesses now have a clearer compliance timeline targeting January 1, 2027. Businesses should prepare in the following ways:
Inventory your AI systems. Identify which systems make or materially influence consequential decisions in covered domains (hiring, lending, housing, insurance, healthcare, education, government services). This step is necessary under the Automated Decision-Making Technology Act.
Prepare consumer-facing disclosures. Under the Automated Decision-Making Technology Act, Developers must provide notices of material updates to Deployers, and Deployers must provide notices to consumers regarding the use of ADMTs in consequential decisions. Begin drafting these materials now.
Review current contracts. The Automated Decision-Making Technology Act voids indemnification provisions in contracts between Deployers and Developers that shield a party from liability for its own anti-discrimination violations arising from ADMT use. Businesses should review existing vendor and technology agreements for provisions that may become unenforceable following the January 1, 2027 effective date.
Prepare record keeping infrastructure. Developers and Deployers must maintain records demonstrating compliance with the Automated Decision-Making Technology Act for three (3) years.
Readers should contact the authors of this article for more information.
