Colorado’s New Artificial Intelligence Decision-Making Law: What Businesses Should Know

Colorado is preparing for a significant change in how businesses use artificial intelligence (AI) to make decisions affecting consumers. Senate Bill 26-189, Colorado’s new Automated Decision-Making Technology law, was signed by Gov. Jared Polis on May 14, 2026, and takes effect January 1, 2027. 

The law repeals and replaces Colorado’s 2024 Artificial Intelligence Act. The law focuses on automated decision-making technology (“ADMT”) used in consequential decisions. These include decisions involving employment, education, housing, financial and lending services, insurance, health care, and essential government services and public benefits. The law covers technology that processes personal data and generates predictions, recommendations, classifications, rankings, scores, or similar outputs used to make or assist with decisions about individuals.

One of the law’s central requirements is greater transparency. Beginning January 1, 2027, developers of covered ADMT must provide businesses that deploy the technology with technical documentation describing its intended uses, training-data categories, known limitations, and instructions for appropriate use and human review. Developers must also notify deployers about material updates or modifications. Both developers and deployers must retain certain compliance records for at least 3 years. 

Consumers receive new rights as well. Businesses using covered ADMT must provide notice when consumers interact with the technology. If an automated decision results in an adverse outcome, consumers generally must receive a plain-language explanation of the technology’s role within 30 days. Consumers may also request access to personal data used by the system, seek correction of inaccurate information, and request meaningful human review and reconsideration of an adverse decision.

The law also allocates discrimination liability between developers and deployers based on relative fault, and it voids contract provisions that attempt to shift responsibility for a party’s own violations. Enforcement rests exclusively with the Colorado Attorney General, who generally must give a 60-day opportunity to cure before acting. The law creates no private right of action. The Attorney General’s Office is developing rules and must adopt implementing regulations by January 1, 2027, so businesses should continue monitoring the rulemaking process.

For Colorado businesses, the practical takeaway is that AI governance should not be treated solely as an information technology issue. Companies using automated systems in hiring, lending, insurance, housing, health care, or other covered areas should identify the systems they use, determine whether those systems fall within the law, understand what data they rely on, and document human-review procedures. Businesses should also review contracts with AI vendors and developers to confirm they can obtain the documentation the law requires, and establish internal procedures for consumer notices, adverse-decision disclosures, correction requests, and meaningful human review. Taking these steps now can help identify compliance gaps before the new requirements take effect.