What are the compliance obligations for a covered deployer under SB 26-189?

A covered deployer under SB 26-189 must: (1) provide written pre-decision notice before using ADMT in any decision affecting an individual; (2) issue an adverse action disclosure after any negative decision, explaining what was decided, what personal data was used, and the basis for the outcome; (3) offer the individual a meaningful opportunity to request human review of AI-influenced decisions; (4) obtain and retain the developer's technical documentation including intended uses, training data categories, and known inappropriate uses; (5) retain all compliance documentation, decision logs, and changelogs for a minimum of 3 years; and (6) monitor AG rulemaking and update compliance programs when rules are finalized.

Does SB 26-189 apply if I use third-party AI software?

Yes. If you use a third-party AI tool and your use of it influences decisions about identifiable individuals in a covered category, the deployer compliance obligations are yours regardless of where the software came from. You must also obtain and retain the vendor's technical documentation as part of your compliance program.

What is the deadline for SB 26-189 compliance?

Colorado SB 26-189 takes effect January 1, 2027. A 60-day cure window applies before penalties attach, through January 1, 2030. Enforcement is by the Colorado Attorney General only, there is no private right of action. Key terms including 'materially contribute' and 'meaningful human review' remain undefined pending AG rulemaking due before the effective date.

What exemptions exist under SB 26-189?

Four exemptions apply under SB 26-189: (1) HIPAA-covered entities for non-employment uses of ADMT; (2) insurers already satisfying existing Colorado algorithmic discrimination rules; (3) creditors satisfying ECOA or FCRA adverse action notice requirements; and (4) FDA-regulated medical devices. Where an exemption applies, businesses should document the exemption basis and retain that documentation on file.

SB 26-189 Compliance Checklist | Does Colorado AI Law Apply to You?

Key Term

ADMT: Automated Decision-Making Technology

Any system using computation, machine learning, statistics, or AI to make or materially contribute to a decision about a specific individual, including systems that substantially inform a human decision-maker.

Examples: AI hiring screeners, credit scoring models, insurance underwriting tools, tenant screening algorithms, clinical decision support software, benefits eligibility systems.

Step 1: Does your organization use ADMT?

Start here. Does your organization use any software or system with AI or automated decision-making that affects a specific, identifiable person, not aggregate analysis or infrastructure operations?

Does the system make or contribute to a decision about a specific, identifiable person?

Not aggregate analysis or infrastructure operations, the decision must concern an individual.

Out of scope for this system. Examples: grid optimization, demand forecasting, inventory AI.

Yes, continue to Step 2

The system affects an identifiable person. Proceed to check whether the decision falls in a covered category.

Step 2: Does the decision fall into a covered category?

SB 26-189 covers ADMT used in six categories of consequential decisions. The framing is use-based, not architecture-based, what matters is how the tool is deployed, not how it is built.

Employment

Hiring, firing, compensation, scheduling, performance, promotion, demotion

Housing

Rental applications, tenant screening, lease decisions, occupancy

Financial Services

Credit, loans, mortgages, insurance underwriting and claims, banking, fintech, collections

Healthcare

Clinical decisions, prior authorization, treatment recommendations, care access (FDA-regulated devices exempt)

Education

Admissions, placement, financial aid, academic evaluation, discipline

Essential Services

Electricity, gas, water, internet, government benefits (Medicaid, SNAP, unemployment, housing assistance), municipal services

Does the decision fall into one of the six covered categories above?

Out of scope for this system.

Yes, continue to Step 3

The decision is in a covered category. Proceed to check whether a statutory exemption applies.

Step 3: Does a statutory exemption apply?

Four exemptions remove specific uses from the law's reach. Where an exemption applies, document the basis and retain that documentation on file.

HIPAA-covered entity (non-employment uses of ADMT)

Insurer satisfying existing Colorado algorithmic discrimination rules

Creditor satisfying ECOA or FCRA adverse action notice requirements

FDA-regulated medical device

Does one of the four statutory exemptions apply to this use?

Yes: Exempt

Out of scope for that use. Document the exemption basis and retain on file.

No, You are a Covered Deployer

Compliance obligations apply. See below for what you are required to do before January 1, 2027.

Your Compliance Obligations

If you reached this point, you are a covered deployer. Your obligations depend on whether you use a vendor's AI system or built one yourself.

Deployer Only: Using a Vendor's System

Pre-decision noticeNotify individuals in writing before ADMT is used in any decision affecting them.

Adverse action disclosureAfter a negative decision: what was decided, what personal data was used, and the basis for the outcome.

Right of appealProvide a meaningful opportunity to request human review of any AI-influenced adverse decision.

Vendor documentationObtain and retain the developer's technical documentation: intended uses, training data categories, known inappropriate uses, monitoring guidance.

Record retentionRetain all compliance documentation, decision logs, ADMT version identifiers, and changelogs for a minimum of 3 years.

Monitor rulemakingAG rules defining key terms are due before Jan 1, 2027. Review and update your program when finalized.

Developer + Deployer: Built Your Own System

All six deployer obligations apply in fullEvery obligation in the left column applies to you.

Technical documentationProvide to all downstream deployers: intended uses, known inappropriate uses, training data categories, and monitoring guidance.

ChangelogsMaintain version records for every material update to the system.

Use documentationDocument intended uses and all known inappropriate uses of the system.

RetentionRetain all developer documentation for a minimum of 3 years.

Key terms still undefined. "Materially contribute," "meaningful human review," and the full scope of Essential Services remain undefined pending AG rulemaking due before January 1, 2027. Build your program anchored to the NIST AI Risk Management Framework now; revise specific procedures when rules publish. A 60-day cure window applies before penalties attach, through January 1, 2030. No private right of action. Enforcement by Colorado Attorney General only.

📄

SB 26-189 Compliance Decision Tree Printable 2-page PDF version of this decision tree

Download PDF

Legal disclaimer. This page is for general informational purposes only and does not constitute legal advice. The decision tree above is a simplified summary of SB 26-189 and is not a substitute for a complete legal analysis of your specific situation. Laws and regulations change, and key terms under SB 26-189 remain subject to Attorney General rulemaking. To understand your actual compliance obligations, consult with qualified legal counsel. Nothing on this page creates an attorney-client relationship between you and Hoog Law or Michael Hoog.

SB 26-189 Coverage Decision Tree