What Colorado SB 26-189 requires
SB 26-189: Colorado's ADMT law (replaced SB 24-205)
SB 24-205, signed in May 2024, was delayed to June 30, 2026 by SB25B-004. SB 26-189 ("Automated Decision-Making Technology"), signed May 14, 2026, repealed and replaced it. It covers developers and deployers doing business in Colorado whose automated decision-making technology is used in consequential decisions about consumers — employment, education, housing, financial/lending, insurance, health care and essential government services — made on or after January 1, 2027.
What changed from SB 24-205
SB 26-189 drops SB 24-205's duty of care to avoid algorithmic discrimination, its mandatory impact assessments, and its rebuttable presumption of compliance for following a risk-management framework such as the NIST AI RMF. It focuses instead on transparency and disclosure.
Notices, explanations and human review
Deployers must give consumers notice before covered ADMT is used in a consequential decision. Within 30 days of an adverse outcome, they must provide a plain-language explanation of the decision and the technology's role, how to request more information, and the consumer's rights, including correcting inaccurate personal data and requesting meaningful human review and reconsideration. Developers must give deployers documentation on intended uses, known risks and limitations, and training-data categories. Records must be kept for at least three years.
Enforcement
The Colorado Attorney General has exclusive enforcement authority under the Colorado Consumer Protection Act. There is no private right of action. A 60-day cure period applies to curable violations and sunsets January 1, 2030. The AG must adopt implementing rules by January 1, 2027.