Does Colorado’s New AI Decision Law Apply to You?

What you can decide after checking the facts

A better-informed decision starts with what is known, what still needs checking, and who will take the next step. The following are practical objectives to consider for this particular issue:

• Evaluate geographic and subject-matter reach.
• Classify developer/deployer role.
• Inventory notice and record obligations.
• Track rulemaking and effective dates.

Why the evidence matters

US-TechLaw is an independent technology-law research and consulting platform. This page uses the applicable official rules and product-provider documentation as reference points, rather than relying on broad claims about what every AI system or business must do. Where company-specific contracts or settings would change the conclusion, they are identified as facts to verify instead of assumed. The research is informational and does not replace qualified advice for a particular situation.

How to raise your specific question

Describe the decision or problem in a few sentences, identify the product or system involved, and state what result you need to understand. Do not send privileged documents, complete customer files, credentials, or sensitive operational records in an initial email. The scope, appropriate expertise, and any secure exchange of additional documents should be determined separately before detailed review.

Questions worth preparing:

• Does the use case involve an individual in a covered decision category?
• Who deploys the technology and where?

Questions, documents and safeguards to review

What changed in Colorado’s 2026 AI law?

Colorado's 2026 legislation replaced the earlier 2024 AI framework with new rules for automated decision-making technology. The relevant statute and Attorney General guidance identify January 1, 2027 as the start date. The analysis should therefore begin with the enacted 2026 law rather than an older summary of “high-risk AI.” First identify the specific technology, the individual affected, and the decision it influences. A general chatbot used to answer store-hours questions presents a different issue from software used to rank applicants for housing or employment. (Colorado enacted SB26-189)

Which business decisions are covered?

The Colorado law focuses on covered automated decision-making technology used to materially influence consequential decisions. The enacted summary identifies areas such as employment, education, housing, lending, insurance, healthcare, and essential government services. Ask what the system actually outputs and whether a person relies on that output in a covered decision. A recommendation can matter even when a human clicks the final approval button. Conversely, not every automated workflow is covered merely because software is used. Review statutory definitions and any applicable exclusions before deciding that the business has a particular obligation. (Colorado enacted SB26-189)

Does your software materially influence the decision?

A vendor building a decision model and an organization using it may have different responsibilities. The enacted Colorado summary addresses developers that supply covered systems and deployers that use them, including documentation and notice-related requirements. Map the actual role of each participant: who designed the model, who chose its intended use, who changed the decision thresholds, and who communicates with the individual? A company may play more than one role across its products. Preserve technical documentation and contract records that explain the boundaries of each party's involvement. (Colorado enacted SB26-189)

Are you the developer or the business using the system?

Geography requires a facts-based check. Determine which individuals and decisions are connected with Colorado and where the organization uses the technology. Do not infer coverage solely from the location of the software company's headquarters. The statute's definitions, exemptions, and any implementing regulations must be reviewed for the actual scenario. A product used for an internal demo is not necessarily equivalent to a system materially influencing a live consequential decision. Record the decision location, user location, regulated activity, and intended workflow before advising on applicability.

What notices and explanations may be required?

The 2026 law includes consumer-facing notice, explanation, personal-data request and correction, and meaningful human-review requirements in specified circumstances. Those duties need to be tied to the statutory triggers; a generic website notice should not be described as automatically sufficient. Review when notice occurs in the user's journey, what the individual must be told, and whether support staff can actually review the disputed decision. The Attorney General has identified rulemaking relevant to these requirements. Do not publish a fixed operational checklist without checking the latest official regulatory materials. (Colorado Attorney General automated-decisionmaking guidance)

What data correction and human review rights apply?

Developers and deployers need different evidence. A developer may have to provide intended-use information, limitations, and instructions for appropriate operation and human review. A deployer needs records showing its real use and notices when applicable. The law summary also identifies retention of compliance records. A useful internal register links each system to owner, purpose, affected decision, role classification, documentation received, notice path, and date of last review. Keep records proportionate to their intended compliance purpose and protect sensitive source data. (Colorado enacted SB26-189)

What records must be maintained?

Meaningful human review should be more than an automated rejection of an appeal. The reviewer needs enough information and authority to reconsider the decision. Identify what the human sees, what they can change, and how a correction is communicated. Also ask whether the underlying data is factually wrong and whether a person can request a correction through an accessible channel. Where decisions also implicate employment, consumer reporting, or other sector laws, evaluate those independently rather than treating the Colorado automated-decision statute as the entire legal framework.

When do duties take effect and what remains for rulemaking?

Preparation should focus on an inventory of covered use cases, a responsibility map, draft notices, evidence collection, and a mechanism to track official rule updates before the effective date. Test the planned user journey with sample data and identify unresolved questions for the relevant legal specialist. A final review should record why a system was classified as covered or not covered, who made the decision, and what would trigger reassessment. The goal is a defensible preparation process for the actual Colorado use case, not a blanket certification that any AI product complies.

Example: how the decision changes with the facts

Illustrative scenario, not a client case or statement of actual results.

A company offers an automated screening tool to employers operating in Colorado. The tool produces applicant rankings but does not itself send rejection messages. The analysis cannot stop at whether a human eventually clicks “reject”; it must consider whether the output materially influences a consequential employment decision. The provider and employer should identify their respective roles and assess which notice, documentation, and review provisions apply under Colorado's enacted replacement law. A second product that merely schedules interviews may present a different question. This example shows why use case, affected person, and statutory role belong in the applicability record.

Decision and evidence table

Documents and facts to prepare

For a reliable review, identify the specific system or agreement, the date and version of its relevant terms, the business decision being made, the people affected, and the records available to support the answer. The most helpful starting material for this topic is: Colorado applicability decision tree and developer/deployer requirement grid. A request for information should remain proportionate; sensitive records should be exchanged only through an appropriate authorized process.

Frequently asked questions

Does the law apply only to companies based in Colorado?

Location alone does not decide scope. Examine covered decisions, affected persons, roles, and statutory definitions.

Are developers and business users treated identically?

No. The enacted statute distinguishes relevant documentation and deployer duties.

When do the replacement rules begin?

The Colorado Attorney General identifies January 1, 2027 as the effective date.

What to check before acting

Before acting, write down the decision your team needs to make: Help businesses determine whether colorado’s 2026 automated-decision law applies to a specific product or use case. List the relevant documents and settings, the facts still missing, and the person who will confirm each point. Review the decision again if the agreement, software features, workflow, or governing requirements change. Seek qualified professional advice when the specific legal question or regulated activity requires it.

Related business and technology guides

• Explore AI Regulation
• Related research and practical support
• Does the EU AI Act Apply to Your US Software Product?
• Who Is Responsible If Your AI Agent Makes a Mistake?