Key Takeaways
- Colorado’s Senate passed SB26‑189, a bill creating a regulatory framework for automated decision‑making technology (ADMT) used in consequential decisions such as housing, employment, credit, insurance, healthcare, and essential government services.
- The law requires clear consumer notices when ADMT is involved, provides a right to explanation and correction after adverse outcomes, and mandates a 30‑day window for consumers to request additional information.
- Deployers must obtain detailed disclosures from developers about the ADMT’s intended uses, training data, limitations, risks, and any updates; these requirements begin January 1, 2027.
- The Attorney General will enforce the statute under the Colorado Consumer Protection Act, issuing a 60‑day cure notice before pursuing violations deemed deceptive trade practices; no private right of action is created.
- Liability for anti‑discrimination violations (under the Colorado Anti‑Discrimination Act) is apportioned between developers and deployers based on relative fault, and contracts cannot indemnify a party for liability arising solely from its own actions.
- SB26‑189 replaces and expands upon 2024 AI‑protection legislation, incorporating recommendations from a governor‑appointed task force and moving next to the Senate Appropriations Committee for further review.
Overview of the Legislation’s Purpose and Scope
Senate Majority Leader Robert Rodriguez and Senate President James Coleman introduced SB26‑189 to establish Colorado’s first comprehensive regulatory regime for automated decision‑making technology when it is used to make consequential decisions about individuals. The bill defines ADMT as any system that automatically processes personal data and produces an output that informs, guides, or assists a decision affecting a person’s access to, eligibility for, or compensation related to education, employment, housing, financial or lending services, insurance, healthcare, or essential government services. By targeting these high‑impact areas, the legislature aims to curb potential harms—such as wrongful denial of housing or employment—while preserving space for innovation.
Consumer‑Facing Protections and Notice Requirements
To protect individuals, the bill obliges any entity that deploys an ADMT (the “deployer”) to give consumers a clear, conspicuous notice whenever they interact with technology covered by the statute. If the ADMT contributes to an adverse outcome—such as a loan denial or a premium increase—the deployer must provide a plain‑language description of the technology’s role in the decision and outline a process for the consumer to request further information within 30 days. Consumers also gain the right to ask for correction of any factually inaccurate personal data used by the system and to demand a meaningful human review of the decision. These provisions are designed to ensure transparency and give affected individuals a practical avenue to challenge erroneous or biased outcomes.
Developer Disclosure Obligations and Implementation Timeline
Beginning January 1, 2027, ADMT developers must furnish deployers with a detailed description of the technology’s intended uses, the categories of personal data used to train the model, known limitations and risks, and instructions for appropriate use and human review. Developers are also required to communicate any updates or modifications to the ADMT as they occur. The Attorney General (AG) is tasked with adopting rules that clarify the exact disclosure requirements following an adverse outcome; these rules must be finalized by December 31, 2026. This staggered timeline gives industry players time to adjust their documentation and compliance processes while ensuring that the rules are in place before the core obligations take effect.
Enforcement Mechanism and Remedial Process
Enforcement of SB26‑189 falls exclusively to the Colorado Attorney General, who will treat violations as deceptive trade practices under the Colorado Consumer Protection Act. Upon receiving an allegation of non‑compliance, the AG must issue a 60‑day notice to the alleged violator—whether a developer or deployer—providing an opportunity to cure the violation if a cure is deemed feasible. If the issue remains unresolved after the cure period, the AG may pursue civil penalties or other remedies authorized by the consumer protection statute. Notably, the bill does not create a private right of action, meaning individuals cannot sue directly under this law; redress must flow through the AG’s enforcement actions.
Liability Allocation and Anti‑Discrimination Provisions
The legislation explicitly ties ADMT accountability to existing anti‑discrimination law, particularly the Colorado Anti‑Discrimination Act (CADA). Developers and deployers may be held liable for violations of CADA that stem from their use of ADMT in consequential decisions. Fault is to be apportioned based on the relative responsibility of each party, ensuring that neither side can escape liability simply by shifting blame. Moreover, any contractual indemnity clause that attempts to shield a developer or deployer from liability arising solely from its own actions under CADA is rendered void. This provision reinforces the principle that responsibility for discriminatory outcomes remains with the party whose conduct directly caused the harm, whether that be flawed model training by a developer or improper deployment by a business.
Relation to Prior AI Legislation and Task‑Force Recommendations
SB26‑189 builds on and replaces a 2024 bill that Rodriguez authored to introduce consumer protections for high‑risk AI systems. Over the preceding six months, a governor‑convened task force examined AI policy, gathered stakeholder input, and produced a set of recommendations aimed at balancing consumer safety with business viability. The current bill incorporates many of those recommendations, expanding the scope of covered decisions, refining notice and correction rights, and clarifying enforcement pathways. By repealing the earlier legislation and enacting a more robust framework, Colorado aims to create a clearer, more enforceable set of rules that reflect the evolving landscape of automated decision‑making.
Legislative Next Steps and Outlook
Having secured unanimous approval from the Senate Business, Labor, and Technology Committee, SB26‑189 now advances to the Senate Appropriations Committee for further scrutiny, particularly regarding any fiscal impacts associated with implementation and enforcement. If it continues to garner bipartisan support, the bill could become a model for other states grappling with the rapid proliferation of AI‑driven decision systems. Supporters argue that the measure strikes an appropriate balance: it safeguards Coloradans from opaque, potentially discriminatory automated outcomes while imposing compliance burdens that are considered reasonable for developers and businesses. The coming months will reveal whether the Appropriations Committee endorses this vision and whether the legislation ultimately becomes law.