Most Colorado AI Act guidance stops at the statute, and the statute is the shorter document. Senate Bill 26-189 occupies nine sections of the Colorado Revised Statutes, 6-1-1701 through 6-1-1709. The Attorney General’s proposed rules run to fourteen, and the operational cost sits in them: ten days to acknowledge a consumer’s request for human review, forty-five days to complete it, and a reviewer who cannot be the person who made the original decision or that person’s subordinate.
Both documents bite on 1 January 2027. A programme built from the statute alone will miss the deadlines the rules invented.
SB 26-189 compliance divides into four questions, so this page runs in four movements. Scope gates come first, because roughly half of the systems teams worry about fall outside the act. Then the gap between what the statute asks and what the rules specify. Then every clock in one table. Then the penalty arithmetic, which is what moves budget.
Four gates decide whether the Colorado AI Act reaches a system
Scoping fails in both directions. Teams pull marketing models into scope that the statute excludes by name, and leave out a tenant screening score that sits squarely inside a covered domain. Four questions settle it, in order.
Gate one: the technology qualifies as an ADMT only if it processes personal data and shapes a decision
Automated decision-making technology, as SB 26-189 defines it, means “a technology that processes personal data and uses computation to generate output, including predictions, recommendations, classifications, rankings, scores, or other information that is used to make, guide, or assist a decision, judgment, or determination concerning an individual”.
Two halves of that definition matter equally. Personal data has to go in. A decision about a person has to come out. A model forecasting warehouse demand fails the first half and never reaches the second.
The enrolled text then names what does not count: anti-malware and antivirus software, calculators, databases, spell-checking, and spreadsheets that need manual analysis without machine learning. Legislators wrote those exclusions to stop the act swallowing ordinary office software, and they do that job well.
A covered ADMT narrows the gate further. Coverage attaches only where the technology is “used to materially influence a consequential decision”, and materially influence means the output is “a non-de minimis factor” that affects the outcome. Incidental, trivial and clerical uses drop out. A resume parser that reformats dates does not materially influence a hiring decision. The same parser, ranking candidates into a shortlist, does.
Gate two: the decision has to sit in a covered domain
SB 26-189 uses covered domain as its statutory term, and the list it carries is specific rather than general. Employment, education, financial and lending services, health care services, essential government services, and “the lease or purchase of residential real estate in Colorado” are the domains the act reaches. The Colorado Division of Real Estate reads that last one as pulling tenant screening and mortgage decisioning into scope for its licensees.
Housing is the term guidance usually reaches for, and it is looser than the statute. Residential real estate is the boundary actually drawn.
Plenty of decisions fail this gate. Scheduling, customer service triage, advertising, product recommendations, search and content moderation are the uses commentators consistently place outside a consequential decision. Document those as out of scope rather than governing them as if they were inside it.
Differentiated pricing complicates the picture. A decision that produces pricing, costs or terms reasonably likely to materially limit, delay or deny opportunity in a covered domain counts even where nobody was formally refused anything. Risk-based insurance pricing and tiered lending rates sit here.
Gate three: some entities are exempt where another regime already binds them
SB 26-189 says in summary only that “specified entities are exempted from the requirements of the act to the extent the entities comply with other legal obligations”, which reads like a blank. The enrolled text and the law firm readings of it fill the blank in.
Exempt, on that basis and to that extent: entities regulated under HIPAA, with employment decisions and financial assistance determinations carved back into scope; devices and drugs regulated by the Food and Drug Administration; creditors already meeting sector-specific requirements; educational institutions subject to FERPA; and insurers regulated by the state. Finnegan and Epstein Becker Green read the carve-outs the same way.
Note the shape of every one of them. Exemption runs to the extent of compliance with the other regime, not to the entity as a whole. A hospital is exempt for clinical decisions under HIPAA and exposed for its hiring model. Write the exemption analysis down per system, because an exemption asserted in a meeting and never recorded is the version that collapses under an enforcement inquiry.
Gate four: developer and deployer duties are different, and one organisation can hold both
Developers build or substantially modify. Deployers use. An organisation that fine-tunes a purchased model on its own data and then makes decisions with it answers both sets of duties, and the two sets produce different records.
The statute states five duties; the proposed rules specify how each one is performed
Read the statute and the duty list looks manageable. Notice at the point of interaction. A plain language description within thirty days of an adverse outcome. Consumer rights to data access, correction and human review. Developer documentation to deployers. Records for three years.
The Colorado Attorney General filed proposed Automated Decision-Making Technology and Conversational Artificial Intelligence Service rules on 11 August 2026. Comments run until 26 October 2026, the date of the rulemaking hearing, and the Attorney General asked for early submissions by 4 September 2026. Rules 1 through 14 turn the five duties into procedures.
| Rule | What it adds beyond the statute | Record it produces |
| Rule 3 | Consumer communications must be understandable, accessible, available in relevant languages and readable across devices | Notice text per language and channel, with accessibility test results |
| Rule 4 | Documentation must be collected from upstream developers and flow downstream to other developers and deployers | Supply chain documentation register with version lineage |
| Rule 5 | Developer disclosures extend to known risks, testing, monitoring methods and instructions for controlling the system to mitigate risk | Model documentation pack plus monitoring instructions issued to each deployer |
| Rule 6 | Adverse outcome disclosures are specified for format, timing and content, including the principal reasons stated with specificity | Issued explanation tied to the decision record and model version |
| Rule 7 | Consumer rights processes cover data access, correction and human review where commercially reasonable | Request intake log, correction audit trail, review outcome file |
The Wiley analysis of the draft set is the clearest public breakdown of that numbering.
Rule 6 deserves a second look because it defeats a common shortcut. Adverse outcome explanations have to name the specific purpose the system served, the role the system played, the role of any human reviewers and other systems, and the principal reasons stated with specificity rather than in language that is overly broad or vague. An organisation that cannot explain how its model influenced a decision cannot write that notice. Explainability stops being a research topic at that point and becomes a drafting prerequisite.
Meaningful human review carries the heaviest operational load
SB 24-205 offered appeal with human review “if technically feasible”. Its replacement offers “meaningful human review and reconsideration” to the extent commercially reasonable. Swapping one qualifier for another looks cosmetic on the page and is not, because the proposed rules then define what meaningful means.
A reviewer under the draft rules has to be independent, holding authority to approve, modify or override the decision, and preferably not the person who made the original decision or that person’s subordinate. Competence is specified too: subject matter understanding commensurate with the nature and the negative consequences of the adverse outcome, plus training on the system itself. National Law Review’s reading of the draft sets out those criteria in detail.
Two clocks attach. Ten days to acknowledge a review request. Forty-five days to complete the review. Where the consumer has also flagged inaccurate personal data, the adverse outcome should be stayed pending correction, which means the workflow needs a hold state rather than a queue position.
Commercial reasonableness is not a get-out. The draft treats it as a multifactor test weighing the type of review, the magnitude of harm, the evidentiary value of a review, the organisation’s capacity, cost and reviewer availability, with a rebuttable presumption that review is reasonable where the adverse outcome is a severe and irreversible denial of a basic human need. Declining review for a benefits denial will therefore need an argument on the record, not silence.
Anyone already building for Article 14 of the EU AI Act will recognise the reviewer competence and authority tests. One reviewer log design, with reviewer identity, independence basis, training evidence, material reviewed, date and outcome, answers Colorado and Brussels together. Which record answers which obligation is mapped in the records that prove conformity.
Every Colorado AI Act deadline, collected
The Colorado AI Act and its rulemaking run nine clocks between them. Scattered dates are how programmes miss deadlines, so here they are in one place.
| Clock | Length or date | Whose duty |
| Rulemaking hearing and comment close | 26 October 2026 | Anyone wanting influence on the rules |
| Statute in force | 14 May 2026, on signing | Both |
| Protections apply to decisions made on or after | 1 January 2027 | Both |
| Attorney General rules adopted by | 1 January 2027 | Attorney General |
| Adverse outcome explanation issued | Within 30 days | Deployer |
| Human review request acknowledged | Within 10 days | Deployer |
| Human review completed | Within 45 days | Deployer |
| Records retained | At least 3 years | Both |
| Cure period before enforcement, until 1 January 2030 | 60 days | Attorney General |
The cure right is narrower than it first reads. Knowing and repeated violations fall outside it, so a documented failure that recurs after notice loses the benefit.
Retention needs planning against neighbouring regimes rather than in isolation. Three years is the floor here and nothing more. A system serving Colorado consumers and European users inherits ten years for the technical file under Article 18 of the EU AI Act and six months for automatically generated logs, so the archive gets designed to the longest clock and the three-year duty becomes a subset of it. The mapping discipline behind that appears in where these instruments overlap.
SB 24-205 lost its risk duties and kept its records, which changed who does the work
SB 24-205 required developers and deployers to use reasonable care against algorithmic discrimination, run impact assessments with annual review of each deployment, maintain a risk management programme, and report discovered algorithmic discrimination to the Attorney General within ninety days. None of those four survived the rewrite, as Crowell records.
Removing them moved the work from the risk function to operations. Reasonable care was a standard a lawyer argued about after the fact. Notice at the point of interaction, an explanation in thirty days and a reviewed decision in forty-five are things a product team either shipped or did not.
Liability was redistributed at the same time. Developer exposure now attaches to use for the intended purpose, unintended uses fall back on the deployer, fault is apportioned by relative fault where a discrimination claim proceeds, and contractual indemnity for a party’s own violations is void. Vendor contracts drafted against the 2024 allocation need rereading, because the clause shifting all AI liability to the supplier no longer does what its drafter intended.
Penalty arithmetic is what makes a notice failure expensive
SB 26-189 carries no fine schedule of its own, and neither do the rules. Enforcement runs through the Colorado Consumer Protection Act, where a violation counts as a deceptive trade practice, and CRS 6-1-112 sets civil penalties at “not more than twenty thousand dollars for each such violation”, rising to “not more than fifty thousand dollars” where the consumer is an elderly person.
Per violation is the phrase that matters. Notice duties attach to interactions, and explanation duties attach to adverse outcomes, so a lender running ten thousand automated declines with a defective explanation template is not looking at one defect. Volume converts a drafting error into a balance sheet item, and it is the strongest argument available for getting the notice text reviewed before January rather than after.
No new private right of action exists, so plaintiff firms are not the near-term risk. The Attorney General, with a sixty-day cure letter and a penalty schedule that multiplies, is.
The rulemaking deadline also starts a litigation clock
Colorado’s 2024 act never reached enforcement. xAI LLC sued the Attorney General in xAI LLC v. Weiser, 1:26-cv-01515, filed in the District of Colorado on 9 April 2026, and the United States intervened as a co-plaintiff on 24 April 2026.
The order that followed is the part worth diarising. On 27 April 2026 the court suspended proceedings on terms: the state would not initiate enforcement, and xAI must move for a preliminary injunction within twenty-eight days after final adoption of the rulemaking. Since the Attorney General must adopt rules by 1 January 2027, adoption starts a twenty-eight day window in which a fresh constitutional challenge may land. Planning that assumes quiet through 2027 is planning against the docket.
Federal pressure continues around it. Executive Order 14365, signed on 11 December 2025, created a Department of Justice task force to challenge state AI laws, and a Federal Trade Commission draft policy statement of 1 July 2026 argued implied preemption where state law conflicts with federal law. Neither has removed SB 26-189. Its transparency and records duties are also a harder constitutional target than the discrimination duty that drew the original suit, which makes waiting for the act to disappear a weak strategy.
Colorado now runs two AI statutes on the same date
Colorado’s House Bill 26-1263, the Chatbot Safety Act, was signed on 29 May 2026 and takes effect on 1 January 2027 alongside the decisioning statute. Duties cover disclosure that a user is interacting with an artificial intelligence system, crisis response procedures, protections for users under eighteen, parental controls for accounts held by children under thirteen, and operator reporting. Rules 9 through 13 of the proposed set implement it, including age assurance methods that may not rely on self-declaration alone.
Operators running both a decisioning model and a customer chatbot in the state are inside both statutes and inside one rulemaking. Sequencing the two programmes separately duplicates the notice, logging and reporting work.
One evidence set, several statutes
Colorado is one jurisdiction in a pattern that keeps widening. The National Conference of State Legislatures reported that in 2025 “all 50 states, Puerto Rico, the Virgin Islands, and Washington, D.C., have introduced legislation on this topic”, and that “thirty-eight states adopted or enacted around 100 measures”.
Texas, California and Illinois each added duties with different triggers and different artefacts. Only one of them changed shape mid-flight, which is why so much published guidance still describes a reasonable care duty that left the statute in May 2026. A wider view of the United States instruments and the records behind them sits in the US laws and the records they demand.
Where these records end up living
SB 26-189 generates small records at high volume. A notice shown. An explanation issued. A review requested, acknowledged within ten days and completed within forty-five. A correction made and an outcome stayed while it happens. Spreadsheets survive the first month of that and then stop.
Govern365 was built for the volume. The AI System Registry holds each covered ADMT with its owner, covered domain, risk tier and version, which answers the scoping question an enforcement letter asks first. The Audit Evidence Manager attaches each notice, explanation and review record to the duty it satisfies, with dates and approvers attached. Governance Workflows route reconsideration requests through an independent reviewer and hold the decision while data is corrected, so the ten and forty-five day clocks are tracked rather than remembered. Continuous Monitoring keeps the three-year archive whole as models change. All four sit in one platform at govern365.ai, and the route from intake to approved decision with records attached is shown on where these approvals are tracked.
Frequently asked questions
Is the Colorado AI Act still in force?
Not in its 2024 shape. SB 26-189 repealed and reenacted SB 24-205 on 14 May 2026, replacing the algorithmic discrimination framework with an automated decision-making technology framework codified at CRS 6-1-1701 through 6-1-1709. Protections apply to decisions made on or after 1 January 2027.
Are impact assessments still required?
Not as a Colorado statutory mandate. SB 26-189 dropped both the impact assessment requirement and the duty of reasonable care. Impact assessments remain useful evidence and stay mandatory elsewhere, including the fundamental rights impact assessment under Article 27 of the EU AI Act for certain deployers.
What counts as an adverse outcome under SB 26-189?
A decision that denies, terminates, revokes or materially reduces or restricts a consumer’s access in a covered domain, or that produces materially less favourable differentiated price, cost, compensation or other material terms. The thirty-day explanation duty attaches to that definition rather than to any negative result.
How fast does a human review request have to be handled?
Under the proposed rules, acknowledged within ten days and completed within forty-five. The reviewer has to be independent of the original decision, hold authority to change it, and understand the subject matter in proportion to the consequences.
How long must the records be kept?
At least three years, for developers and deployers alike. Three years sits below the EU AI Act’s ten years for technical documentation and above its six-month floor for automatically generated logs, so organisations exposed to both design to ten years.
What are the penalties for breaching the Colorado AI Act?
Violations are deceptive trade practices under the state’s Consumer Protection Act, carrying civil penalties of up to twenty thousand dollars per violation and up to fifty thousand dollars where the consumer is an elderly person. Before 1 January 2030 the Attorney General must give sixty days’ notice and an opportunity to cure, except for knowing or repeated violations.
Which systems fall outside the act entirely?
Anti-malware and antivirus software, calculators, databases, spell-checking and spreadsheets without machine learning are excluded from the definition. Scheduling, customer service triage, advertising, product recommendations, search and content moderation generally fail the consequential decision test. Exempt entities include HIPAA-regulated organisations, FDA-regulated devices and drugs, creditors, FERPA institutions and state-regulated insurers, in each case only to the extent they comply with the other regime.
