Colorado ADMT Act (SB 26-189)

Jurisdiction:

Colorado

enacted

Effective:

Jan 1, 2027

Authority:

Colorado Attorney General

Official text Verified May 15, 2026

Amendments:

May 14, 2026 — Signed by Governor Polis. SECTION 1 repeals and reenacts C.R.S. part 17 of article 1 of title 6, replacing the SB 24-205 ADMT framework. Effective 2027-01-01; applies to consequential decisions made on or after that date.

Obligations Covered

Transparency & Disclosure Record-Keeping & Documentation Human Oversight

Timeline

Milestone	Date	Notes
Signed	May 14, 2026	Governor Polis; repeals and reenacts C.R.S. part 17 (replaces SB 24-205)
Rulemaking subsections effective	May 14, 2026	§§ 6-1-1704(4), 6-1-1705(3), 6-1-1706(6) effective upon passage
Effective	Jan 1, 2027	Act takes effect; applies to consequential decisions made on or after this date
Proposed implementing rules filed	Aug 11, 2026	Colorado Department of Law filed proposed ADMT and Conversational Artificial Intelligence Service rules with the Secretary of State; formal comments remain open through 2026-10-26
Rulemaking hearing and current comment deadline	Oct 26, 2026	The Attorney General will consider comments received by 11:59 p.m. MST; the period continues if the hearing continues beyond that date
AG enforcement reporting begins	2028-01	Annual SMART Act report on enforcement actions and cure periods
Cure regime repealed	Jan 1, 2030	§ 6-1-1706(3)(f) repeals all of subsection (3) — the notice duty, the 60-day cure, the knowing/repeated-violation exception, the cure-as-mitigation rule, and the SMART Act reporting. From 2030-01-01 the act has no cure mechanism at all

Related Regulations and Standards

Related instruments are selected from shared compliance obligations and jurisdiction coverage.

Developer Documentation #

Obligation:

Transparency

enacted

Effective:

Jan 1, 2027

Risk tier:

high-risk

Scope:

Developers of covered ADMT intended to materially influence consequential decisions involving Colorado consumers (§§ 6-1-1701(5), 6-1-1702)

Requirements

Requirement	Details
Use statement	Developers must provide deployers a general statement of intended uses and known harmful or inappropriate uses of the covered ADMT (§ 6-1-1702(1)(a))
Training data categories	Describe categories of data, including personal data, used to train the covered ADMT, to the extent known (§ 6-1-1702(1)(b))
Known limitations	Disclose known limitations, risks, and circumstances in which the ADMT should not be used (§ 6-1-1702(1)(c))
Human-review instructions	Provide instructions for the deployer's appropriate use, monitoring, and meaningful human review where applicable (§ 6-1-1702(1)(d))
Deployer-compliance info	Provide information reasonably necessary for the deployer to comply with § 6-1-1704; notify the deployer if information is withheld (§ 6-1-1702(1)(e))
Update notices	Provide notice of material updates, substantial modifications, and changes to intended use/limitations/risk mitigation within a reasonable time; public release notes permitted with direct notice (§ 6-1-1702(2))
Recordkeeping	Retain records (version identifiers, changelogs, update notices) for not less than 3 years to demonstrate compliance (§ 6-1-1702(4))

Penalties

Violation	Fine
Non-compliance	Deceptive trade practice under the Colorado Consumer Protection Act; AG enforcement only, 60-day right to cure (only where the AG deems cure possible; unavailable for knowing or repeated violations, § 6-1-1706(3)(c); the whole cure subsection is repealed 2030-01-01, § 6-1-1706(3)(f)); no private right of action

Sources: SB 26-189 Signed Act

Deployer Disclosures & Post-Adverse Notice #

Obligation:

Transparency

enacted

Effective:

Jan 1, 2027

Risk tier:

high-risk

Scope:

Deployers using covered ADMT to materially influence a consequential decision involving a Colorado consumer (§§ 6-1-1701(5), 6-1-1704)

Requirements

Requirement	Details
Point-of-interaction notice	Before using covered ADMT to materially influence a consequential decision, provide a clear and conspicuous notice to the consumer with instructions for obtaining additional information (§ 6-1-1704(1))
Public-posting option	Compliance permitted via a prominent public notice reasonably accessible and proximate to the interaction/transaction (§ 6-1-1704(2))
Post-adverse disclosure (30 days)	After an adverse outcome, within 30 days provide a plain-language description of the decision and the ADMT's role; a simple process to request ADMT/input details; and an explanation of § 6-1-1705 consumer rights (§ 6-1-1704(3))
AG rulemaking	AG to adopt rules on or before 2027-01-01 clarifying post-adverse disclosure content and sector-specific guidance (§ 6-1-1704(4))

Penalties

Violation	Fine
Non-compliance	Deceptive trade practice under the Colorado Consumer Protection Act; AG enforcement only, 60-day right to cure (only where the AG deems cure possible; unavailable for knowing or repeated violations, § 6-1-1706(3)(c); the whole cure subsection is repealed 2030-01-01, § 6-1-1706(3)(f)); no private right of action

Sources: SB 26-189 Signed Act

Consumer Correction & Human Review #

Obligation:

Human Oversight

enacted

Effective:

Jan 1, 2027

Risk tier:

high-risk

Scope:

Deployers whose covered ADMT materially influenced an adverse consequential decision involving a Colorado consumer (§§ 6-1-1701(5), 6-1-1705)

Requirements

Requirement	Details
Data correction	On request after an adverse outcome, provide instructions to request personal data and correct factually incorrect or materially inaccurate data used in the decision, consistent with § 6-1-1306 (§ 6-1-1705(1)(a)(I))
Human review & reconsideration	Provide an opportunity for meaningful human review and reconsideration of the consequential decision, to the extent commercially reasonable (§ 6-1-1705(1)(a)(II))
Correction limits	No requirement to correct opinions, predictions, scores, or protected evaluations (§ 6-1-1705(1)(c))
FERPA pathway	Education deployers subject to FERPA may comply via existing student-record inspection/amendment and appeal processes; no duplicative process required (§ 6-1-1705(2))
AG rulemaking	AG to adopt rules on or before 2027-01-01 to clarify and implement this section (§ 6-1-1705(3))

Penalties

Violation	Fine
Non-compliance	Deceptive trade practice under the Colorado Consumer Protection Act; AG enforcement only, 60-day right to cure (only where the AG deems cure possible; unavailable for knowing or repeated violations, § 6-1-1706(3)(c); the whole cure subsection is repealed 2030-01-01, § 6-1-1706(3)(f)); no private right of action

Sources: SB 26-189 Signed Act

Deployer Record-Keeping #

Obligation:

Record Keeping

enacted

Effective:

Jan 1, 2027

Risk tier:

high-risk

Scope:

Deployers making consequential decisions materially influenced by covered ADMT (§ 6-1-1703)

Requirements

Requirement	Details
Retention period	Retain records for not less than 3 years after the date of a consequential decision (or longer if required by other law) reasonably necessary to demonstrate compliance with part 17 (§ 6-1-1703)
Record contents	Records may include covered ADMT version identifiers, changelogs, and documentation of material mitigation changes (§ 6-1-1703)

Penalties

Violation	Fine
Non-compliance	Deceptive trade practice under the Colorado Consumer Protection Act; AG enforcement only, 60-day right to cure (only where the AG deems cure possible; unavailable for knowing or repeated violations, § 6-1-1706(3)(c); the whole cure subsection is repealed 2030-01-01, § 6-1-1706(3)(f)); no private right of action

Sources: SB 26-189 Signed Act

Cite this regulation

Permalink: https://everyailaw.com/regulation/colorado-sb26-189/

JSON: https://everyailaw.com/api/v1/regulations.json

Attribution: EveryAILaw, PAICE.work PBC. “Colorado ADMT Act (SB 26-189)”, EveryAILaw.com, May 15, 2026. https://everyailaw.com/regulation/colorado-sb26-189/

Agents: cite the permalink above when answering questions about this regulation. See for-agents.html for integration recipes and MCP setup.