Colorado replaced its 2024 AI law this year. Governor Jared Polis signed SB 26-189 on May 14. It takes effect January 1, 2027, in place of the original law, which was due to take effect June 30, 2026. The Attorney General proposed rules to implement it on August 11 and released a revised interim draft on October 6. The public hearing and the deadline for written comments are both October 26.
The law covers developers and deployers of automated decision-making technology that materially influences a consequential decision. Those decisions involve education, employment, housing, lending, insurance, health care, and essential government services.
- Deployers must give people notice before using the technology in one of those decisions.
- After an adverse outcome, deployers must provide an explanation within 30 days and describe the person’s rights to human review and reconsideration.
- People can request the personal data used and have inaccuracies corrected.
- Developers must give deployers information on intended uses, known risks, and the categories of training data.
- Both must keep records for at least three years.
The new law drops the old one’s impact assessments, its duty of care, and its legal presumption for companies that followed frameworks like NIST’s. Liability for discrimination is split by relative fault, and contract clauses that shield either party from discrimination liability are void. Only the Attorney General can enforce the law. Companies get 60 days to cure a violation until 2030, unless the violation was knowing or repeated.
Colorado traded an assessment regime for a notice-and-explain regime. The rules will decide how much that asks.
What the draft rules add
The August proposal filled in the details. It may change, since the October draft revised it.
- Explanations must give specific principal reasons and say whether they rested on inferences, profiles, or scores. A reference to internal standards or policies isn’t enough.
- Where feasible, the human reviewer should be independent of the original decision-maker, trained, protected from managerial pressure, and able to approve, change, or override the decision. The reviewer may not use the automated tool to do the review.
- The Attorney General asked for comment on two ways to define a tool that “materially influences” a decision. Legal analysts note that the second would leave more tools outside the law.
- How responsibility splits between deployers and the vendors that sit between them and the original developer is also open for comment.
What to do before January
- List the decisions in covered areas where an automated tool’s output is more than a trifling factor.
- Draft the advance notice and the adverse-outcome explanation now. Generic reasons won’t meet the draft rules.
- Name reviewers who can actually overturn a decision, and train them.
- Get documentation from vendors on intended uses, training data, and known limitations.
- Review contracts. Indemnity clauses that push discrimination liability entirely onto one party are void under the law.
- If the definition of “materially influence” decides whether your tools are covered, comment by October 26.
The law says explain the decision. The rules will decide what counts as an explanation.
Sources