Colorado SB 26-189: The ADMT Law That Replaced the Colorado AI Act

What does Colorado SB 26-189 require?

SB 26-189 requires a deployer that uses ADMT to materially influence a consequential decision to give consumers clear and conspicuous notice before use, to give, within 30 days after a decision with an adverse outcome, a plain-language description of the decision and the technology’s role, a process to request more information, and an explanation of consumer rights, and, on request, to provide instructions for requesting personal data and correcting factually incorrect or materially inaccurate personal data, and an opportunity for meaningful human review and reconsideration, to the extent commercially reasonable. It requires a developer to give deployers technical documentation and notice of material updates from January 1, 2027. Both must keep compliance records for at least 3 years, and the Attorney General enforces the law as a deceptive trade practice.

The law is codified at C.R.S. 6-1-1701 to 6-1-1709, Part 17 of the Colorado Consumer Protection Act, and applies to consequential decisions made on or after January 1, 2027.

How did SB 26-189 replace the 2024 Colorado AI Act?

The 2024 Act was delayed once, challenged in federal court, and then repealed and reenacted by a law signed before its June 30, 2026 compliance date.

• SB 24-205 was signed May 17, 2024, with duties set to apply on February 1, 2026. In August 2025, SB 25B-004 moved that date to June 30, 2026.
• On April 9, 2026, xAI sued the Attorney General (X.AI LLC v. Weiser, No. 1:26-cv-01515, D. Colo.). On April 24, the United States intervened as a plaintiff.
• SB 26-189 was introduced May 1, 2026, passed the Senate 34-1 on May 7 and the House 57-6 on May 9, and was signed May 14, 2026, as Chapter 131 of the 2026 Session Laws.

The 2024 Act was a duty-of-care law built on risk management and impact assessments. SB 26-189 is a transparency law; the enacted text contains no risk management program, no impact assessment, and no framework-based defense.

How does SB 26-189 compare with SB 24-205?

SB 24-205 vs SB 26-189, by element, from the enrolled texts

Element	2024 Act (SB 24-205)	2026 law (SB 26-189)
Scope term	“High-risk artificial intelligence system”: an AI system that makes, or is a substantial factor in making, a consequential decision	“Covered ADMT”: technology that processes personal data and uses computation to generate output used to materially influence a consequential decision; materially influence means a non-de minimis factor that affects the outcome
Covered decisions	Education, employment, financial or lending service, essential government service, health-care services, housing, insurance, legal service	Education, employment, lease or purchase of residential real estate in Colorado, financial or lending service, insurance, health-care services, essential government services and public benefits; legal services are not listed
Developer duties	Reasonable care against algorithmic discrimination; documentation to deployers; public statement; disclose known or reasonably foreseeable discrimination risks to the Attorney General within 90 days	Documentation to deployers (intended and harmful uses, training data categories, known limitations, instructions for use and human review); notice of material updates; records for 3 years; no public statement or Attorney General report
Deployer duties	Reasonable care; risk management policy and program; impact assessments; annual review; public statement; disclose discovered discrimination to the Attorney General within 90 days; exemption from the risk management, impact assessment, and public statement duties for a deployer with fewer than 50 full-time equivalent employees that does not train the system with its own data and meets other conditions	Pre-use notice; post-adverse-outcome disclosure within 30 days; respond to correction and human review requests; records for 3 years; no employee-count exemption in the text
Notice to consumers	Direct notice before the decision, with the system’s purpose, the nature of the decision, deployer contact information, a plain-language description, and, if applicable, information on the right to opt out of profiling	Clear and conspicuous notice before use, with instructions for obtaining more information; a prominent public notice reasonably accessible at points of consumer interaction satisfies the duty (6-1-1704(2))
Adverse decision explanation and appeal	Statement of the principal reasons, including the degree and manner of the AI system’s contribution and the type and sources of data; opportunity to correct data; appeal with human review if technically feasible	Within 30 days: plain-language description of the decision and the ADMT’s role, a process to request the ADMT’s name, version, developer, and data types and sources, and an explanation of consumer rights; on request: instructions for correcting data and meaningful human review and reconsideration to the extent commercially reasonable
Impact assessments	Required for each high-risk system deployed on or after February 1, 2026, at least annually, and within 90 days after an intentional and substantial modification is made available	None
Risk management program	Required, reasonable in light of the NIST AI RMF, ISO/IEC 42001, or another recognized framework	None
Framework safe harbor	Rebuttable presumption of reasonable care for compliance; affirmative defense for a violation discovered and cured through feedback, red teaming, or internal review while otherwise complying with the NIST AI RMF and ISO/IEC 42001, another substantially equivalent or more stringent recognized framework, or a framework the Attorney General designates	None; compliance with Part 17 is not a defense to, and does not excuse, noncompliance with any other law (6-1-1709(2))
Enforcement and cure	Attorney General exclusive; violation is an unfair trade practice; no statutory cure window; rulemaking permissive	Attorney General exclusive; violation is a deceptive trade practice; notice and 60 days to cure where the Attorney General deems a cure possible, not required where the Attorney General finds and can demonstrate a knowing or repeated violation, repealed January 1, 2030; rulemaking on disclosures and consumer rights mandatory by January 1, 2027
Private right of action	None	No new private right of action; fault is allocated between developers and deployers in existing anti-discrimination suits, and contract clauses that indemnify a party for its own violations are void (6-1-1707)
Effective date	Duties from February 1, 2026, moved to June 30, 2026; Part 17 repealed and reenacted by SB 26-189 effective January 1, 2027	Applies to consequential decisions made on or after January 1, 2027; the rulemaking mandates in 6-1-1704(4) and 6-1-1705(3) took effect on signature, May 14, 2026

What is covered ADMT, and what is a consequential decision?

ADMT is technology that processes personal data and uses computation to generate output, including predictions, recommendations, classifications, rankings, or scores, that is used to make, guide, or assist a decision about an individual (C.R.S. 6-1-1701(2)). It is covered ADMT when used to materially influence a consequential decision, meaning the output is a non-de minimis factor in the decision and affects its outcome, including by constraining, ranking, scoring, recommending, or classifying. Incidental, trivial, or clerical uses do not count (6-1-1701(13)).

Three exclusions decide whether many general-purpose tools fall outside the law. The ADMT definition excludes “a tool used by an individual solely to summarize, organize, translate, draft, route, or present information for human review of administrative processing.” It excludes technology that communicates with consumers in natural language to provide information, make referrals or recommendations, answer questions, or generate other content, if that technology is not contracted, advertised, marketed, configured, or intended to be used in a consequential decision and is subject to an acceptable use policy that prohibits using its generated content in a consequential decision. And a consequential decision does not include actions in which ADMT only summarizes, organizes, or presents information for human review without producing a score, ranking, recommendation, classification, prediction, or other inference that materially influences the outcome (6-1-1701(2)(b)(II) and (III) and (3)(b)(IV)).

A consumer includes an employee, a job applicant who is a Colorado resident, and any individual whose access, eligibility, or opportunity in Colorado is evaluated in a consequential decision by a person doing business in Colorado (6-1-1701(4)).

What must a deployer do under SB 26-189?

A deployer is a person doing business in Colorado that deploys covered ADMT.

• Notice before use (6-1-1704(1) and (2)). Before using covered ADMT to materially influence a consequential decision, the deployer must give the consumer a clear and conspicuous notice that it used or will use covered ADMT, with instructions on how to obtain the additional information the section describes. A prominent public notice, reasonably accessible at points of consumer interaction through a link or posting reasonably proximate to the transaction, satisfies this duty.
• Post-adverse-outcome disclosure (6-1-1704(3)). Within 30 days after a decision with an adverse outcome, the deployer must give a plain-language description of the decision and the role the covered ADMT played; instructions and a simple process to request the ADMT’s name, version number, developer, and the types, categories, and sources of personal data used, to the extent the developer supplied that information; and an explanation of the consumer’s rights and how to exercise them.
• Correction and human review on request (6-1-1705(1)). When a consumer experiences an adverse outcome from a consequential decision that covered ADMT materially influenced, the consumer may request, and the deployer must provide, instructions for requesting personal data and correcting factually incorrect or materially inaccurate personal data used in the decision, and an opportunity for meaningful human review and reconsideration of the decision, to the extent commercially reasonable. The correction right does not reach opinions, predictions, scores, or protected evaluations.
• Records (6-1-1703). Records reasonably necessary to demonstrate compliance must be kept for at least 3 years after the decision, longer if other law requires.

“Meaningful human review” means review by a person the deployer designates who has authority to approve, modify, or override the decision, considers relevant available primary evidence, is trained for the review, does not default to the system output, and has access to sufficient information to understand the output’s intended use, material limitations, input categories, and principal factors (6-1-1701(15)).

A creditor that is required to provide, and provides, an ECOA adverse action notice complies with the notice and disclosure duties for the same decision if that notice also satisfies them, and the federal notice may carry a brief statement that covered ADMT was used (6-1-1704(6)).

What must a developer provide under SB 26-189?

A developer is a person doing business in Colorado that makes covered ADMT commercially available, develops a component designed or contracted to be part of one, or intentionally and substantially modifies an ADMT so that it becomes covered.

On and after January 1, 2027, a developer must make available to each deployer, in a form and manner reasonably understandable to a deployer that protects trade secrets and information protected from disclosure by law (6-1-1702(1)):

• a general statement of intended uses and known harmful or inappropriate uses
• a description of the categories of data, including personal data, used to train the system, to the extent known
• known limitations, risks, and circumstances in which the system should not be used
• instructions for appropriate use, monitoring, and meaningful human review
• the information the deployer reasonably needs to meet its own disclosure duties, with notice to the deployer if any information is withheld

The developer must also notify deployers of material updates, intentional and substantial modifications, and changes to intended use, limitations, or risk mitigation within a reasonable time (6-1-1702(2)). These duties apply only to a deployer’s use of covered ADMT that was marketed, advertised, configured, contracted, sold, or licensed to be used to materially influence a consequential decision (6-1-1702(3)).

How does the Attorney General enforce the law, and how does the cure window work?

The Attorney General enforces Part 17 through the Colorado Consumer Protection Act, and violations of sections 6-1-1702 through 6-1-1705 are enforceable exclusively by the Attorney General (6-1-1706(1)). A violation is a deceptive trade practice under a new 6-1-105(1)(uuuu).

Before any enforcement action, the Attorney General must issue a notice of violation if the Attorney General deems a cure possible. If the developer or deployer fails to cure within 60 days after receiving the notice, the Attorney General may sue. No cure period is required where the Attorney General finds and can demonstrate a knowing violation or repeated violations. The cure subsection is repealed effective January 1, 2030 (6-1-1706(3)).

The statute creates no new private right of action and does not limit existing remedies (6-1-1706(4) and 6-1-1709). In an existing unlawful-discrimination suit arising from a decision that covered ADMT materially influenced, fault is allocated between developers and deployers by relative fault, and a contract clause that indemnifies a developer or deployer for its own violations of Colorado anti-discrimination law is void (6-1-1707).

Where do the Attorney General’s rules stand?

On or before January 1, 2027, the Attorney General must adopt rules clarifying the post-adverse-outcome disclosures and the consumer rights section, and may adopt rules on the meaning of “materially influence” (6-1-1704(4), 6-1-1705(3), 6-1-1706(5)).

The Department of Law filed proposed rules, designated 4 CCR 904-6, with the Secretary of State on August 11, 2026, released an interim draft redline on October 6 and a regulatory analysis on October 21, and set the rulemaking hearing for October 26, 2026, with the written comment period set to close at the end of that day, or on the last day of the hearing if it is continued.

The interim draft sets a January 1, 2027 effective date and proposes a rebuttable presumption (draft Rule 6.1) that an ADMT output materially influences a consequential decision if it constrains an option set, sets a threshold, or produces a rank, score, classification, recommendation, prediction, or other inference that pertains to the individual, is reviewed by the decision-maker or used to screen data made available to the decision-maker before or during the decision, and is consistent with the outcome, rebuttable by evidence that the output was a de minimis factor.

The same rulemaking covers HB 26-1263, the Chatbot Safety Act (Session Laws 2026, Chapter 208), approved May 29, 2026. Most of its operator duties apply on and after January 1, 2027, and its annual reports to the Attorney General are due on and after July 1, 2027. As of October 25, 2026, no rules had been adopted. The date to watch is final adoption, not the hearing, because adoption starts xAI’s 28-day filing window in the litigation below.

Where does the X.AI v. Weiser litigation stand?

As of October 25, 2026, the case remained open with all case management and other deadlines stayed, and xAI had not filed its preliminary injunction motion. Two terms of the April 27, 2026 minute order (ECF No. 24) govern enforcement. The Attorney General shall not initiate enforcement, including an investigation, for alleged violations of SB 24-205 or any legislation replacing or amending it enacted during the 2026 session that occurred or may occur on or before 14 days after the date the court rules on xAI’s forthcoming preliminary injunction motion. And xAI shall file that motion, and an amended complaint if necessary, within 28 days after final adoption of rulemaking implementing SB 24-205 or its replacement. The order does not move the January 1, 2027 application date.

How does SB 26-189 treat insurers, HIPAA covered entities, and employers?

Insurance has its own Colorado regime: SB21-169 (C.R.S. 10-3-1104.9) and the Division of Insurance’s governance rule, Regulation 10-1-1 (3 CCR 702-10), which was extended to private passenger auto and health benefit plan insurers effective October 15, 2025. SB 26-189 provides that an insurer and affiliated entities subject to 10-3-1104.9 are in compliance with Part 17 in the practice of insurance; an insurer not deemed compliant must give the post-adverse-outcome disclosures to the extent applicable (6-1-1708(1)). The deemed-compliance clause does not reach an insurer’s own employment decisions (6-1-1708(2)). Section 3 of the act lets the Insurance Commissioner adopt rules on insurer notices and disclosures to consumers.

HIPAA covered entities, and their business associates for services to them, are exempt from sections 6-1-1701 to 6-1-1706 to the extent they do business in Colorado, except for employment decisions; a health-care provider gets the exemption only if operating from a Colorado location. A covered entity must still give patients a general notice of its use of advanced technologies, and one that uses covered ADMT to determine eligibility for financial assistance must give specific disclosures (6-1-1708(3)).

Employment decisions stay covered even for insurers and HIPAA covered entities. A consumer includes an employee and a Colorado-resident job applicant, the covered domain is employment that creates or may create an employer-employee relationship, and the text sets no employee-count threshold. The consequential-decision definition excludes low-stakes or routine decisions, actions, and business processes, including routine scheduling and workflow management, that do not materially influence eligibility for, selection for, denial of, compensation for, pricing of, or access to an opportunity or service in a covered domain (6-1-1701(3)(b)(I)).

How should a business prepare for January 1, 2027?

• Inventory every tool that scores, ranks, classifies, or recommends in a covered decision about a consumer as 6-1-1701(4) defines it, which includes employees, Colorado-resident job applicants, and anyone whose access, eligibility, or opportunity in Colorado is evaluated by a person doing business in Colorado
• Decide, with counsel, which tools materially influence a decision under 6-1-1701(13), and document the de minimis call for each tool you exclude
• Draft the pre-use notice and place it at each point of consumer interaction, with a link to the instructions for requesting more information
• Build the 30-day adverse-outcome disclosure: the decision in plain language, the ADMT’s role, the information request process, and the consumer rights explanation
• Designate and train human reviewers who can override the decision and who hold the developer’s documentation
• Ask each ADMT vendor for the 6-1-1702 documentation and a material-update notice process, and remove indemnity clauses that 6-1-1707(7) would void
• For credit decisions, map the ECOA adverse action notice against 6-1-1704 and add the ADMT statement if you rely on 6-1-1704(6)
• Set a 3-year retention schedule for version identifiers, changelogs, notices, and mitigation records, and calendar the adopted rules, xAI’s 28-day filing window, and the court’s ruling

The US state AI laws guide sets Colorado beside California, Texas, New York, and the federal preemption push. The insurance AI guide covers the Division of Insurance regulation, the insurers page maps Colorado’s rules, including SB 26-189, by line of business, and the employers and HR page lays the Colorado and California hiring duties side by side.

This page is general information as of October 2026, not legal advice. The Attorney General’s rules and the X.AI docket can change the enforcement picture within weeks; confirm current text with the Colorado General Assembly, the Attorney General, or counsel.