Colorado AI Act

What is the Colorado AI Act?

Colorado’s AI statute is now SB 26-189, “Concerning the use of automated decision-making technology in consequential decisions,” signed by Governor Jared Polis on May 14, 2026. It repealed and reenacted C.R.S. title 6, article 1, part 17 as “Automated Decision-Making Technology in Consequential Decisions” (C.R.S. 6-1-1701 to 6-1-1709). The reenacted part “takes effect January 1, 2027” and “applies to consequential decisions made on or after January 1, 2027” (signed act, section 5; bill page).

History. The original Colorado AI Act, SB 24-205, was signed May 17, 2024 (signed act). It imposed risk-management, impact-assessment, and disclosure duties on developers and deployers of “high-risk artificial intelligence systems” to protect consumers from algorithmic discrimination, with requirements set to begin February 1, 2026. SB 25B-004 (signed August 28, 2025) moved those requirements to June 30, 2026 (bill page). Before that date arrived, SB 26-189 replaced them. None of SB 24-205’s operative duties took effect.

The reenacted law is binding state law enforced by the Colorado Attorney General. It is not a risk-tier framework: it regulates specific uses of automated decision-making technology and relies on notice, explanation, correction, and human-review duties.

For law firms, the law matters mainly where the firm itself uses covered technology to materially influence a consequential decision, most plausibly in hiring and other employment decisions. Use of generative AI in legal representation is governed by the Colorado Rules of Professional Conduct, particularly the Colorado Supreme Court’s Rule Change 2026(02), and by practice commentary such as the judge-authored Colorado Lawyer article on AI and professional conduct.

Who must comply?

The law distinguishes two regulated roles, and a firm or vendor may be either or both (C.R.S. 6-1-1701).

• Automated decision-making technology (ADMT) is technology “that processes personal data and uses computation to generate output, including predictions, recommendations, classifications, rankings, scores, or other information that is used to make, guide, or assist a decision, judgment, or determination concerning an individual.” Excluded is “a tool used by an individual solely to summarize, organize, translate, draft, route, or present information for human review,” among other carve-outs.
• Covered ADMT is ADMT “used to materially influence a consequential decision.” “Materially influence” means the output is a non-de minimis factor that affects the outcome; it “does not include incidental, trivial, or clerical uses.”
• A consequential decision relates to a consumer’s access to, eligibility for, selection for, or compensation for a covered domain, or to differentiated price or terms. The covered domains are education enrollment or opportunity, employment, the lease or purchase of residential real estate in Colorado, financial or lending services, insurance, health-care services, and essential government services and public benefits. Legal services, which SB 24-205 listed as a consequential-decision category, is not among them.
• A consumer includes an employee and a Colorado-resident job applicant.
• A deployer is “a person doing business in Colorado that deploys a covered ADMT.” A developer is a person doing business in Colorado that develops, offers, sells, leases, licenses, or otherwise makes commercially available a covered ADMT, develops a component designed or marketed for use in one, or intentionally and substantially modifies an ADMT so that it becomes covered.

The reenacted law has no small-business or employee-count exemption. Its exemptions are sectoral: for example, creditors subject to federal fair-lending and credit-reporting law, insurers subject to Colorado’s insurance AI statute, HIPAA-covered entities (except for employment decisions), FDA-regulated devices, and financial institutions subject to Gramm-Leach-Bliley.

What does the law require?

Deployers must:

1. Give “a clear and conspicuous notice” before using covered ADMT to materially influence a consequential decision; a prominent public notice at points of consumer interaction can satisfy this (6-1-1704(1)-(2)).
2. After an adverse outcome, within thirty days, provide a plain-language description of the decision and the role the covered ADMT played, instructions for requesting more information, and an explanation of the consumer’s rights (6-1-1704(3)).
3. On request after an adverse outcome, provide instructions for requesting and correcting inaccurate personal data and, “to the extent commercially reasonable,” an opportunity for meaningful human review and reconsideration (6-1-1705(1)).
4. Keep records for at least three years after the date of a consequential decision (6-1-1703).

Developers must give deployers documentation of intended and known harmful uses, the categories of training data, known limitations, and instructions for appropriate use, monitoring, and meaningful human review; notify deployers of material updates within a reasonable time; and keep records for at least three years (6-1-1702).

The reenacted law does not carry forward SB 24-205’s impact-assessment, risk-management-program, public-statement, or algorithmic-discrimination reporting duties, and it offers no presumption of compliance. It provides instead that “compliance with the requirements of this part 17 is not a defense” to noncompliance with any other applicable law (6-1-1707(8)), and it allocates liability for violations of existing anti-discrimination law between developers and deployers based on relative fault (6-1-1707).

When do the requirements apply?

To consequential decisions made on or after January 1, 2027 (section 5(3)). The provisions directing Attorney General rulemaking took effect on passage.

The Attorney General must adopt rules on the post-adverse-outcome disclosures and the consumer-rights provisions on or before January 1, 2027 (6-1-1704(4)(b), 6-1-1705(3)), and may adopt rules clarifying “materially influence” (6-1-1706(5)). On August 11, 2026, the Department of Law filed proposed rules (4 CCR 904-6) covering both SB 26-189 and the Chatbot Safety Act (HB 26-1263). Written comments are accepted between August 11 and October 26, 2026, and the public rulemaking hearing is set for October 26, 2026 at 10:00 AM (coag.gov/ai; notice of hearing).

What does compliance documentation look like?

A deployer preparing for January 1, 2027 may wish to be able to produce:

• An inventory of each ADMT tool used in a covered domain, with a record of whether it materially influences consequential decisions.
• The pre-use consumer notice, or the public notice posted at points of consumer interaction.
• A template for the thirty-day post-adverse-outcome description, and the procedure for responding to requests for more information.
• The data-correction and human-review procedure.
• The developer documentation received for each covered tool.
• Records retained for at least three years.

A developer should be able to produce the documentation it supplied to each deployer and its record of material-update notices.

For a law firm, the most likely covered use is an AI tool that screens, ranks, or scores job applicants or employees. Tools used only to draft, summarize, organize, or route information for human review fall outside the ADMT definition. This documentation set is separate from what the Colorado Rules of Professional Conduct call for when a lawyer uses AI in legal work; see the Colorado state page.

How does this interact with Colorado state-bar guidance?

The ADMT law and the Colorado Rules of Professional Conduct address different domains. The ADMT law protects Colorado consumers, including employees and job applicants, when covered technology materially influences a consequential decision. The Rules of Professional Conduct govern a lawyer’s use of any AI system in the course of legal representation.

Colorado Rule Change 2026(02), effective January 8, 2026, adds a Scope paragraph stating that technology’s role “does not diminish a lawyer’s responsibilities under these Rules.” In People v. Crabill (November 22, 2023), an attorney who filed ChatGPT-generated citations he had not read, then falsely blamed an intern, was suspended for one year and one day, with ninety days served, on stipulated violations of Rules 1.1, 1.3, 3.3(a)(1), and 8.4(c). The Colorado Court of Appeals’ published opinion in Al-Hamim v. Star Hearthstone (December 26, 2024) warned that future filings containing AI-generated hallucinations may result in sanctions.

A firm using AI in hiring would face the ADMT law’s notice and adverse-decision duties alongside its ordinary employment-law obligations; a firm using AI in client work faces the Rules of Professional Conduct regardless of whether the ADMT law applies. The deeper Colorado bar and court guidance is on the Colorado state page.

Who enforces it?

The Colorado Attorney General “shall enforce this part 17 through the ‘Colorado Consumer Protection Act,’” and violations of the developer and deployer duties are “enforceable exclusively by the attorney general” (6-1-1706(1)). A violation is a deceptive trade practice (6-1-1706(2)). Where a cure is possible, the Attorney General must first issue a notice of violation and allow sixty days to cure, except for knowing or repeated violations; that cure provision is repealed January 1, 2030 (6-1-1706(3)). The law creates no new private right of action (6-1-1706(4), 6-1-1709(1)).

The Department of Law’s page at coag.gov/ai is the location for the rulemaking record, comments, and hearing information.

Primary sources

• Colorado SB 26-189, Concerning the use of automated decision-making technology in consequential decisions (signed May 14, 2026; 2026 Colo. Sess. Laws ch. 131): signed act (PDF); bill page.
• Colorado SB 24-205, Consumer Protections for Artificial Intelligence (signed May 17, 2024; repealed and reenacted by SB 26-189 before its requirements took effect): signed bill text (PDF).
• Colorado SB 25B-004 (signed August 28, 2025), which moved SB 24-205’s requirements to June 30, 2026: leg.colorado.gov/bills/sb25b-004.
• Colorado Department of Law, ADMT and Chatbot Safety rulemaking (4 CCR 904-6): coag.gov/ai; notice of rulemaking hearing.
• People v. Crabill, 23PDJ067 (Office of the Presiding Disciplinary Judge of the Colorado Supreme Court, Nov. 22, 2023): PDJ summary of the approved stipulation (PDF).
• Colorado Supreme Court, Rule Change 2026(02), adopted en banc January 8, 2026, effective immediately: Rule Change 2026(02) (PDF).
• Al-Hamim v. Star Hearthstone, LLC, 2024 COA 128, No. 24CA0190 (Colo. App. Dec. 26, 2024): opinion (PDF).