Colorado Rewrites Its AI Law
Colorado has repealed the artificial intelligence statute it passed in 2024 and replaced it with a narrower law aimed at automated decision-making technology. Governor Polis signed Senate Bill 26-189 on May 14, 2026, and it takes effect January 1, 2027. The 2024 law, Senate Bill 24-205, was scheduled to take effect June 30, 2026, and never did.
The new law asks less of businesses than the law it replaces, but it still reaches a wide range of companies. Any business that uses software to help make decisions about hiring, pay, housing, lending, insurance or health care for people in Colorado should begin preparing now.
What the law covers
The law regulates "automated decision-making technology," which it defines as technology that processes personal data and uses computation to produce outputs such as predictions, recommendations, classifications, rankings or scores that are used to make, guide or assist decisions about individuals. Unlike the 2024 law, the definition does not require that the system infer its outputs the way an AI model does. A tool that simply scores or ranks applicants can qualify even if no one would call it artificial intelligence.
The obligations apply only when the technology materially influences a "consequential decision." A consequential decision is one that affects a person's access to, eligibility for, selection for or compensation in education, employment, the lease or purchase of residential real estate in Colorado, financial or lending services, insurance, health care or essential government services. It also includes decisions about price or other material terms that are reasonably likely to limit, delay or deny that access. Material influence means the output is more than a minimal factor in making the decision and actually affects the outcome, for example by ranking, scoring, recommending or classifying. Incidental, trivial and clerical uses are not covered.
The definition excludes several common tools, each subject to conditions. Among them are anti-malware software, basic calculators, spreadsheets that require human analysis and do not use machine learning or large language models, tools that only summarize or organize information for a person to review without producing a score or recommendation that influences the outcome, and consumer chat tools that are not marketed or configured for consequential decisions and whose acceptable use policies prohibit that use.
The law borrows the Colorado Privacy Act's definition of consumer and adds employees, job applicants who are Colorado residents, and anyone whose access to, eligibility for or opportunity in Colorado is evaluated in a consequential decision by a business operating in Colorado.
Duties of developers
A developer that markets or contracts its technology for use in consequential decisions must give the businesses using it documentation describing the intended uses, known harmful or inappropriate uses, the categories of training data, known limitations and risks, instructions for appropriate use and human review, and the information the business needs for its own disclosures. Developers must notify those businesses of material updates and keep compliance records for at least three years. They are not required to disclose trade secrets, but they must tell the business when they withhold information.
Duties of businesses that use the technology
The law calls a business that uses covered technology a "deployer." Employers, landlords, lenders and insurers that license screening or scoring software will often fall into this category. A deployer must:
Give consumers clear and conspicuous notice before covered technology is used in a consequential decision. A prominent public notice where consumers interact with the business can satisfy this requirement.
Within 30 days after an adverse decision, give the consumer a plain-language explanation of the decision, the role the technology played, how to request more information about the technology and its inputs, and the consumer's rights.
After an adverse decision, on the consumer's request, provide instructions for obtaining and correcting factually incorrect or materially inaccurate personal data used in the decision and, to the extent commercially reasonable, an opportunity for meaningful human review and reconsideration.
Keep records showing compliance for at least three years from the date of the decision.
The Attorney General must adopt rules on the adverse decision disclosures and consumer rights by January 1, 2027, so more detail on those requirements should be available by the time the law takes effect.
Enforcement
Only the Colorado Attorney General can enforce the law, and a violation is treated as a deceptive trade practice under the Colorado Consumer Protection Act. The law creates no private right of action. Before bringing an action, the Attorney General must give notice and a 60-day opportunity to cure if the Attorney General deems a cure possible. The cure period does not apply to knowing or repeated violations and expires January 1, 2030.
The law also addresses discrimination claims brought under existing state law when covered technology influenced the decision. Fault is allocated between the developer and the deployer according to their relative responsibility, and a developer is liable only when the deployer used the technology in a way the developer intended, documented, marketed or contracted for. A contract provision that indemnifies a party for its own violation of Colorado anti-discrimination law is generally void, with a limited exception for developers whose technology was used outside its intended and documented purposes.
What was dropped from the 2024 law
The 2024 law would have imposed a duty of reasonable care to prevent algorithmic discrimination, required deployers to maintain risk management programs and complete annual impact assessments, and required reports to the Attorney General. None of those requirements survived. Legal services also are no longer a covered category.
Exemptions
Some regulated businesses receive relief. HIPAA covered entities are largely exempt for uses outside employment. Insurers subject to Colorado's existing statute on insurers' use of external data and algorithms are deemed compliant in the practice of insurance, though not for their employment decisions. Creditors can use their federal adverse action notices to meet the new disclosure requirements if those notices also include the information the Colorado law requires. These exemptions are specific, and a business should confirm that its use falls within one before relying on it.
What to do now
Start with an inventory of the software your business uses to screen, rank, score or evaluate applicants, employees, tenants, borrowers or customers. For each tool, determine whether it materially influences a consequential decision and whether your vendor intends it for that use.
Then review your vendor contracts. Ask each vendor when it will deliver the required documentation, confirm what support the vendor will provide for consumer notices, which remain your legal responsibility, and look closely at indemnification provisions in light of the new limits.
Finally, assign someone to handle adverse decision explanations and human review requests. The explanation must go out within 30 days after the decision.
This article is provided for general informational purposes only and does not constitute legal advice.
Comments