CO SB189: Automated Decision-Making Technology

In one paragraph

Colorado's SB 26-189 repeals and reenacts the 2024 AI Act as rules for automated decision-making technology (ADMT) that materially influences consequential decisions such as hiring, lending, housing and health care. Developers must document covered ADMT for deployers; deployers must give notice before use, explain adverse outcomes within 30 days and, on request, give correction steps and, where commercially reasonable, human review. Signed May 14, 2026 (Chapter 131); applies from January 1, 2027. A stipulated April 27, 2026 order in X. AI LLC v. Weiser bars AG enforcement of 2026 laws replacing SB 24-205 for violations through 14 days after a ruling on xAI's planned injunction motion.

Plain-English summary, written with AI assistance. The official text controls.

What it means for business

From January 1, 2027, developers must document ADMT for deployers, and deployers must give notices, adverse-outcome explanations and correction and review options; a stipulated order bars AG enforcement of 2026 laws replacing SB 24-205 for violations through 14 days after an injunction ruling.

Key provisions

1. 1Covered ADMT: technology that processes personal data and computes outputs (predictions, scores, rankings, recommendations, classifications) used to make, guide or assist a decision about an individual, when the output is a non-de minimis factor that affects a consequential decision; excludes routine software, summarizing or drafting aids, chatbots barred from consequential decisions, and advertising, search, fraud-prevention, AML and cybersecurity uses (§ 6-1-1701)
2. 2Developers: give each deployer the intended and known harmful uses, training-data categories, known limitations and risks, instructions for appropriate use, monitoring and meaningful human review, and information needed for consumer disclosures; notify deployers of material updates and changes within a reasonable time; keep records 3 years; applies to ADMT marketed, configured, contracted or licensed for consequential decisions (§ 6-1-1702)
3. 3Deployers: clear and conspicuous notice before using covered ADMT in a consequential decision (a prominent public notice at points of interaction qualifies); after an adverse outcome, within 30 days, a plain-language description of the decision and the ADMT's role, a simple way to request the ADMT's name, version and developer and the personal data types and sources, and an explanation of rights; on request, instructions to correct inaccurate personal data and, to the extent commercially reasonable, meaningful human review and reconsideration; records kept 3 years; notices accessible to consumers with disabilities or limited English (§§ 6-1-1703 to 6-1-1705)
4. 4A creditor's required ECOA (and, where applicable, FCRA) notice satisfies the notice duties for the same credit decision if it also meets them, and FERPA processes can satisfy the notice and rights duties for education decisions; insurers subject to § 10-3-1104.9 comply in the practice of insurance; HIPAA covered entities are exempt except for employment decisions but must give patients a general notice and financial-assistance disclosures; FDA-overseen medical devices exempt (§§ 6-1-1704, 6-1-1705, 6-1-1708)
5. 5Attorney General enforcement only, under the Colorado Consumer Protection Act (a violation is a deceptive trade practice); notice and a 60-day cure before action if the AG deems a cure possible, except for knowing or repeated violations (cure rule repealed January 1, 2030); no new private right of action (§§ 6-1-1706, 6-1-1709)
6. 6Under an April 27, 2026 minute order in X. AI LLC v. Weiser, No. 1:26-cv-01515 (D. Colo.), the Attorney General may not initiate enforcement, including investigations, for violations of SB 24-205 "or any legislation replacing or amending SB24-205 enacted during this legislative session" occurring through 14 days after the court rules on xAI's planned preliminary-injunction motion; the order does not name this act, which passed May 12, 2026 and repeals and reenacts SB 24-205's Part 17. xAI must file that motion within 28 days after final adoption of implementing rules. It is a stipulated stay; the court has not ruled on the merits
7. 7Developers and deployers can be liable under state anti-discrimination law, including the Colorado Anti-Discrimination Act, for decisions materially influenced by covered ADMT, with fault allocated by relative fault; developers are liable only for uses they intended, documented, marketed or contracted for; contract clauses indemnifying a party for its own discriminatory acts are void (§ 6-1-1707)
8. 8Signed May 14, 2026 (Chapter 131, Session Laws 2026). Under Section 5, the AG rulemaking duties (§§ 6-1-1704(4), 6-1-1705(3); rules to be adopted on or before January 1, 2027), the joinder clause (§ 6-1-1706(6)), the insurance commissioner's notice-rule power (§ 10-3-1104.9(3)(e)) and the $46,190 appropriation took effect on signing; the rest takes effect January 1, 2027 and applies to consequential decisions made on or after that date, so the 2024 act as amended by SB 25B-004 otherwise remains in Part 17 until then

Latest legislative action

May 14, 2026. Governor Signed

Sponsors (showing 5 of 45)

Roll call votes (showing 3 of 12)

Amendments (6)

• Senate Business, Labor, & Technology Amendment L.001 Adopted 2026-05-05
• Senate Business, Labor, & Technology Amendment L.002 Adopted 2026-05-05
• Senate Appropriations Amendment J.001 Adopted 2026-05-06
• Second Reading Amendment L.003 Adopted 2026-05-06
• Second Reading Amendment L.004 Adopted 2026-05-06
• House Judiciary Amendment L.006 Adopted 2026-05-08