Automated Decision-Making Technology in Consequential Decisions
Senate Bill 26-189, signed by Governor Polis on May 14, 2026 as Chapter 131, repealed Colorado's 2024 Artificial Intelligence Act and reenacted part 17 of article 1 of title 6 of the Colorado Revised Statutes in its place. Where the 2024 law regulated "high-risk artificial intelligence systems" through a duty of reasonable care against algorithmic discrimination, the replacement regulates "covered automated decision-making technology" — technology that processes personal data to materially influence a consequential decision — and is built on disclosure and consumer rights rather than risk management. A consequential decision is one relating to a consumer's access to, eligibility for, selection for or compensation in a covered domain: education enrollment or opportunity, employment, the lease or purchase of residential real estate in Colorado, financial or lending services, insurance including underwriting, pricing and claims adjudication, health-care services, and essential government services and public benefits including eligibility and renewal determinations. Low-stakes and routine decisions such as scheduling, classroom personalization and administrative routing are excluded. On and after January 1, 2027, a developer must give each deployer a general statement describing the intended and known harmful or inappropriate uses of the technology and a description of the categories of data, including personal data, used to train it. Before a deployer uses covered ADMT to materially influence a consequential decision it must give the consumer clear and conspicuous notice, and when a consumer experiences an adverse outcome the deployer must on request provide instructions for accessing and correcting inaccurate personal data and an opportunity for meaningful human review and reconsideration, to the extent commercially reasonable. The Attorney General enforces the part through the Colorado Consumer Protection Act as a deceptive trade practice, with a sixty-day right to cure that does not apply where a violation is knowing or repeated. The act creates no new private right of action. It took effect on passage under a safety clause and applies to consequential decisions made on or after January 1, 2027.
Status history
Current status as of 2026-05-14
Enacted
2026-05-14
Impact areas
- Workforce Impacts
- Enterprise Adoption
- AI Policy