Colorado ADMT Act (SB 26-189)

Jurisdiction:
Colorado
enacted
Effective:
Jan 1, 2027
Authority:
Colorado Attorney General
Official text
Amendments:
  • — Signed by Governor Polis. SECTION 1 repeals and reenacts C.R.S. part 17 of article 1 of title 6, replacing the SB 24-205 ADMT framework. Effective 2027-01-01; applies to consequential decisions made on or after that date.

Obligations Covered

Transparency & Disclosure Record-Keeping & Documentation Human Oversight

Timeline

MilestoneDateNotes
SignedMay 14, 2026Governor Polis; repeals and reenacts C.R.S. part 17 (replaces SB 24-205)
Rulemaking subsections effectiveMay 14, 2026§§ 6-1-1704(4), 6-1-1705(3), 6-1-1706(6) effective upon passage
EffectiveJan 1, 2027Act takes effect; applies to consequential decisions made on or after this date
Proposed implementing rules filedAug 11, 2026Colorado Department of Law filed proposed ADMT and Conversational Artificial Intelligence Service rules with the Secretary of State; formal comments remain open through 2026-10-26
Rulemaking hearing and current comment deadlineOct 26, 2026The Attorney General will consider comments received by 11:59 p.m. MST; the period continues if the hearing continues beyond that date
AG enforcement reporting begins2028-01Annual SMART Act report on enforcement actions and cure periods
Cure regime repealedJan 1, 2030§ 6-1-1706(3)(f) repeals all of subsection (3) — the notice duty, the 60-day cure, the knowing/repeated-violation exception, the cure-as-mitigation rule, and the SMART Act reporting. From 2030-01-01 the act has no cure mechanism at all

Related Regulations and Standards

Related instruments are selected from shared compliance obligations and jurisdiction coverage.

Developer Documentation

Copy link to this provision

Obligation:
Transparency
enacted
Effective:
Jan 1, 2027
Risk tier:
high-risk
Scope:
Developers of covered ADMT for consequential decisions involving Colorado consumers, subject to the intended-use and awareness conditions in § 6-1-1702(5), the narrower disclosure trigger in § 6-1-1702(3), and applicable § 6-1-1708 sector qualifications
Section 6-1-1702 applies when a developer creates covered ADMT intended, documented, marketed, advertised, configured, or contracted to make consequential decisions, or becomes aware it is being used to make such decisions consistently with its intended and contracted uses (§ 6-1-1702(5)). The subsection (1)-(2) disclosure duties apply only where the ADMT was marketed, advertised, configured, contracted, sold, or licensed to materially influence a consequential decision (§ 6-1-1702(3)). The definitions and exclusions for consequential decisions and covered ADMT still apply (§ 6-1-1701(3), (5)). Section 6-1-1708 provides sector qualifications. Qualifying insurers and affiliates are deemed compliant in the practice of insurance, but employment decisions remain covered. The HIPAA exclusion covers a covered entity doing business in Colorado and its business associates for services rendered to that covered entity, with an exception for employment and employment-opportunity decisions; for healthcare providers the subsection (3) treatment applies only when operating from a Colorado location. FDA-supervised medical devices and specified pharmaceutical or medical-device research and development activities are also excluded (§ 6-1-1708(1)-(4)).

Requirements

RequirementDetails
Form and protected informationMake subsection (1) documentation available to each deployer in a reasonably understandable form and manner that protects trade secrets and information protected from disclosure by state or federal law (§ 6-1-1702(1))
Use statementDevelopers must provide deployers a general statement of intended uses and known harmful or inappropriate uses of the covered ADMT (§ 6-1-1702(1)(a))
Training data categoriesDescribe categories of data, including personal data, used to train the covered ADMT, to the extent known (§ 6-1-1702(1)(b))
Known limitationsDisclose known limitations, risks, and circumstances in which the ADMT should not be used (§ 6-1-1702(1)(c))
Human-review instructionsProvide instructions for the deployer's appropriate use, monitoring, and meaningful human review where applicable (§ 6-1-1702(1)(d))
Deployer-compliance infoProvide information reasonably necessary for the deployer to comply with § 6-1-1704; notify the deployer if information is withheld (§ 6-1-1702(1)(e))
Update noticesProvide notice of material updates, intentional and substantial modifications, and changes to intended use/limitations/risk mitigation within a reasonable time; public release notes permitted with direct notice of the release to each deployer (§ 6-1-1702(2))
RecordkeepingRetain records reasonably necessary to demonstrate compliance, including version identifiers, changelogs, documentation, and update notices, for at least 3 years after record creation or longer if applicable state or federal law requires (§ 6-1-1702(4))

Penalties

ViolationFine
Non-complianceDeceptive trade practice under the Colorado Consumer Protection Act; AG enforcement only, 60-day right to cure (only where the AG deems cure possible; unavailable for knowing or repeated violations, § 6-1-1706(3)(c); the whole cure subsection is repealed 2030-01-01, § 6-1-1706(3)(f)); no private right of action

Deployer Disclosures & Post-Adverse Notice

Copy link to this provision

Obligation:
Transparency
enacted
Effective:
Jan 1, 2027
Risk tier:
high-risk
Scope:
Deployers using covered ADMT to materially influence a consequential decision involving a Colorado consumer (§§ 6-1-1701(5), 6-1-1704)

Requirements

RequirementDetails
Point-of-interaction noticeBefore using covered ADMT to materially influence a consequential decision, provide a clear and conspicuous notice to the consumer with instructions for obtaining additional information (§ 6-1-1704(1))
Public-posting optionCompliance permitted via a prominent public notice reasonably accessible and proximate to the interaction/transaction (§ 6-1-1704(2))
Post-adverse disclosure (30 days)After an adverse outcome, within 30 days provide a plain-language description of the decision and the ADMT's role; a simple process to request ADMT/input details; and an explanation of § 6-1-1705 consumer rights (§ 6-1-1704(3))
AG rulemakingAG to adopt rules on or before 2027-01-01 clarifying post-adverse disclosure content and sector-specific guidance (§ 6-1-1704(4))

Penalties

ViolationFine
Non-complianceDeceptive trade practice under the Colorado Consumer Protection Act; AG enforcement only, 60-day right to cure (only where the AG deems cure possible; unavailable for knowing or repeated violations, § 6-1-1706(3)(c); the whole cure subsection is repealed 2030-01-01, § 6-1-1706(3)(f)); no private right of action

Consumer Correction & Human Review

Copy link to this provision

Obligation:
Human Oversight
enacted
Effective:
Jan 1, 2027
Risk tier:
high-risk
Scope:
Deployers whose covered ADMT materially influenced an adverse consequential decision involving a Colorado consumer (§§ 6-1-1701(5), 6-1-1705)

Requirements

RequirementDetails
Data correctionOn request after an adverse outcome, provide instructions to request personal data and correct factually incorrect or materially inaccurate data used in the decision, consistent with § 6-1-1306 (§ 6-1-1705(1)(a)(I))
Human review & reconsiderationProvide an opportunity for meaningful human review and reconsideration of the consequential decision, to the extent commercially reasonable (§ 6-1-1705(1)(a)(II))
Correction limitsNo requirement to correct opinions, predictions, scores, or protected evaluations (§ 6-1-1705(1)(c))
FERPA pathwayEducation deployers subject to FERPA may comply via existing student-record inspection/amendment and appeal processes; no duplicative process required (§ 6-1-1705(2))
AG rulemakingAG to adopt rules on or before 2027-01-01 to clarify and implement this section (§ 6-1-1705(3))

Penalties

ViolationFine
Non-complianceDeceptive trade practice under the Colorado Consumer Protection Act; AG enforcement only, 60-day right to cure (only where the AG deems cure possible; unavailable for knowing or repeated violations, § 6-1-1706(3)(c); the whole cure subsection is repealed 2030-01-01, § 6-1-1706(3)(f)); no private right of action

Deployer Record-Keeping

Copy link to this provision

Obligation:
Record Keeping
enacted
Effective:
Jan 1, 2027
Risk tier:
high-risk
Scope:
Deployers making consequential decisions materially influenced by covered ADMT (§ 6-1-1703)

Requirements

RequirementDetails
Retention periodRetain records for not less than 3 years after the date of a consequential decision (or longer if required by other law) reasonably necessary to demonstrate compliance with part 17 (§ 6-1-1703)
Record contentsRecords may include covered ADMT version identifiers, changelogs, and documentation of material mitigation changes (§ 6-1-1703)

Penalties

ViolationFine
Non-complianceDeceptive trade practice under the Colorado Consumer Protection Act; AG enforcement only, 60-day right to cure (only where the AG deems cure possible; unavailable for knowing or repeated violations, § 6-1-1706(3)(c); the whole cure subsection is repealed 2030-01-01, § 6-1-1706(3)(f)); no private right of action
Cite this regulation

Permalink: https://everyailaw.com/regulation/colorado-sb26-189/

JSON: https://everyailaw.com/api/v1/regulations.json

Attribution: EveryAILaw, PAICE.work PBC. “Colorado ADMT Act (SB 26-189)”, EveryAILaw.com, May 15, 2026. https://everyailaw.com/regulation/colorado-sb26-189/

Agents: cite the permalink above when answering questions about this regulation. See for-agents.html for integration recipes and MCP setup.