Colorado's new AI law, in plain language
Starting January 1, 2027, Colorado businesses that use AI or automated tools to help make important decisions about people — hiring, housing, lending, insurance, health care — owe those people notice, an explanation, and a human review path. Here is what the law actually says, who it actually covers, and a 5-minute way to tell whether that includes you.
The facts (verified against the enrolled bill)
- SB 26-189 was signed May 14, 2026. It repealed and replaced the famous 2024 "Colorado AI Act" (SB 24-205), which never took effect.
- Duties begin January 1, 2027. The Attorney General must publish implementing rules by that date and is the only enforcer — there is no private right of action, and businesses get a 60-day cure period (through 2030).
- There is NO small-business exemption. Headcount does not matter; what matters is what your tools do.
- The decisions that count ("consequential decisions"): education, employment, housing, financial or lending services, insurance, health care, and essential government services.
- What was REPEALED and no longer exists: impact assessments, formal risk-management programs, and the general algorithmic-discrimination duty from the 2024 law. If someone tries to sell you those, they are working from the old statute.
Does it apply to your business? The 5-minute test
You are likely a covered "deployer" only if ALL of these are true:
- You use software that processes personal data — about applicants, tenants, borrowers, patients, or customers.
- That software materially influences one of the consequential decisions above (it is more than a trivial factor in the outcome).
- It is not just baseline tech — spreadsheets, calculators, spam filters, cybersecurity, and fraud-prevention tools are carved out.
- It is not a general-purpose AI chat tool used for drafting or research — those are carved out unless configured to make consequential decisions.
- Common examples that ARE likely covered: resume-screening and interview-scoring tools, tenant-screening algorithms, automated underwriting aids, AI-driven patient triage.
If you are covered, the duties are concrete
- Notice before use — tell people, clearly and conspicuously, that an automated tool will influence the decision.
- Adverse-outcome explanation — within 30 days of a negative decision, a plain-language explanation of what data was used and how to correct it.
- Human review — a meaningful path for the person to request reconsideration by a human.
- Data correction — let people fix wrong personal data that fed the decision.
- Records — keep documentation for 3 years.
The honest part
Two things most write-ups get wrong. First: much of what ranks on Google today still describes the repealed 2024 law and its dead June 2026 deadline — check the bill number before trusting anything (including this page: we cite SB 26-189 and review this page as the AG rulemaking progresses). Second: enforcement is currently paused by a federal court order while rulemaking finishes, but the January 1, 2027 compliance date has not moved. The right posture is calm readiness, not panic — and for many small businesses, an honest applicability check ends with "this law does not cover what you do."
What we do
A bilingual ADMT readiness engagement: we inventory your tools, run the applicability test honestly, and — if you are covered — deliver the notices (English and Spanish), the adverse-outcome letter templates, the human-review procedure, and the recordkeeping setup. Fixed fee, quoted on the call — priced once the AG rules finalize.
This page is general information verified against leg.colorado.gov as of July 12, 2026 — not legal advice. Confirm your specific situation with a Colorado-licensed attorney.
Ready to put AI to work?
Book a free 30-minute discovery call. Plain language, in your language, no obligation.