Does Colorado's automated decision-making law apply to my product?
What Colorado's Automated Decision-Making Technology Act (SB 26-189) covers, what developers and deployers must do starting January 1, 2027, and how the new Chatbot Safety Act fits in.
Short answer
Colorado's Automated Decision-Making Technology Act may apply if your product uses AI or another automated system that processes personal data and materially influences consequential decisions about people in Colorado, such as decisions about jobs, lending, housing, insurance, health care, or education. The law, SB 26-189, was signed May 14, 2026. It replaces the requirements of Colorado's original 2024 AI law (SB 24-205) and takes effect January 1, 2027. It centers on three things: notice before the technology influences a decision; an explanation and a path to correction and human review after an adverse decision; and documentation that developers give to the businesses that use their systems.
Does it apply to you?
- Is it automated decision-making technology? It is if it processes personal data and computationally generates predictions, recommendations, classifications, rankings, scores, or similar information used to help make decisions about people.
- Does it materially influence the decision? An output materially influences a decision when it is a more-than-trivial factor that affects the outcome, including by ranking, scoring, or recommending. Incidental, trivial, and clerical uses don't count.
- Is the decision consequential? A consequential decision is one that materially affects a person's access to, eligibility for, selection for, compensation in, or material terms of an opportunity or service in a covered area. The covered areas are education, employment, residential housing, financial and lending services, insurance, health care, and essential government services and public benefits. Routine administrative tasks, such as scheduling and routing, are excluded.
- Are you a developer or a deployer? Developers are businesses that create, offer, license, or substantially modify the technology, or otherwise make it available. Deployers are businesses in Colorado that use it. If you sell an AI tool that customers use for hiring or lending, you are likely a developer, and your customers are deployers.
What developers must do
- Give deployers documentation covering intended uses, known inappropriate uses, and the categories of training data (to the extent known). It must also cover limitations and risks, how to use the technology appropriately (including human review), and whatever else deployers need to meet their own duties.
- Tell deployers about material updates and substantial modifications.
- Keep compliance records for at least three years.
What deployers must do
- Notice first. Give clear, conspicuous notice before the technology materially influences a consequential decision. A prominent notice placed near the interaction can satisfy this.
- Adverse-decision notice. Within 30 days after an adverse consequential decision, tell the person what was decided and what role the technology played, and offer a way to request more information about the system and the inputs it used.
- Correction. Let people request correction of personal data that is factually incorrect or materially inaccurate. This doesn't generally require changing opinions, predictions, or scores just because someone disputes them.
- Human review. Offer meaningful human review and reconsideration, to the extent commercially reasonable. This is not an unconditional right to have the decision reversed.
- Records. Keep the specified records for at least three years.
The new law dropped the original law's general impact-assessment and risk-management duties, and it doesn't require a standalone bias-testing program. But Colorado's anti-discrimination laws, and federal laws such as the Equal Credit Opportunity Act and fair housing and employment laws, still apply to automated decisions, so testing for discriminatory outcomes is still a sensible way to manage that risk. See Can my AI agent give legal, health, or financial help? for adverse-action notices in lending.
Enforcement and exemptions
- The Colorado Attorney General enforces the law through the Colorado Consumer Protection Act. The law creates no new private right of action, though claims under other laws remain available.
- A 60-day cure period generally applies to violations that can be cured, with exceptions for knowing or repeated violations. The special cure provisions are scheduled to sunset in 2030.
- Exemptions are specific, not size-based. There's no general small-business exemption. Special rules apply to certain insurers already covered by Colorado's insurance AI framework, HIPAA-covered entities and their business associates within the statute's scope (some notice duties still apply), certain FDA-regulated medical devices and research activities, and some FERPA-covered educational processes.
- Rules are still in progress. The Attorney General proposed implementing rules in August 2026 and revised them in October 2026. As of this guide's date, they are still proposed, not final.
Colorado's Chatbot Safety Act
A separate law, the Chatbot Safety Act (HB 26-1263), also takes effect January 1, 2027. It covers certain publicly available conversational AI services, not consequential decisions. It requires age estimation, disclosure that users are interacting with AI, self-harm response protocols, protections for minors against explicit sexual content and simulated emotional dependence, and annual reporting. It also restricts presenting a chatbot's output as coming from, endorsed by, or equivalent to the services of certain licensed professionals. That restriction matters for legal, health, and financial assistants. See Do I have to tell users they're talking to an AI?
Checklist an agent can run against the codebase
- Find every model, score, ranking, or rule set whose output affects whether a person gets a job, loan, home, insurance policy, health care, admission, or public benefit.
- For each one, note whether the output is more than a trivial factor in the decision, and whether a person reviews it before the decision.
- Find where people are told, before the decision, that automated technology is involved.
- Check whether the product sends an adverse-decision notice within 30 days, explaining the decision and the technology's role.
- Find the path for people to request more information, correct their data, and ask for human review.
- If you supply the technology to others, find the documentation you give them and how you notify them of material changes.
- Check that decision records and notices are kept for at least three years.
- List the data fields each system uses, and flag any that could stand in for a protected characteristic, such as ZIP code or name.
- If the product is a public-facing chatbot, check for an AI disclosure, age estimation, self-harm protocols, and any claim that it substitutes for a licensed professional.
Sources
If this applies to you
An AI feature review covers whether the law reaches your product, whether you are a developer or deployer, and what notices, documentation, and contract terms to build. If you are adding one automated decision, a pre-build feature check covers that change.