Colorado Signs SB26-189, Replacing Its 2024 AI Law With Automated Decision-Making Rules

On May 14, 2026, Colorado's governor signed Senate Bill 26-189, titled "Automated Decision-Making Technology". According to the Colorado General Assembly's bill page, the act repeals and reenacts the consumer protections for artificial intelligence that the state passed in 2024 as Senate Bill 24-205, and replaces them with new requirements for software that helps make important decisions about people.

Colorado's 2024 law was widely watched because it was a broad state-level attempt to regulate AI in the United States. Its replacement matters to anyone who builds or buys custom software that scores, ranks or screens individuals, whether that is a hiring tool, a tenant screening feature, a lending workflow or an eligibility check, and whose users may include Colorado residents.

This article summarizes what the official bill summary says and what a software owner should take from it. It is a high-level overview, based on the legislature's summary rather than a reading of the full statute, and it is not legal advice.

What Colorado enacted on May 14, 2026

The bill page for SB26-189 on the Colorado General Assembly website shows the bill as having become law, with the governor's signature dated May 14, 2026. The page records that the bill was introduced in the Senate on May 1, 2026, so it moved from introduction to signature in about two weeks.

The official summary explains that the act repeals and reenacts the provisions created by Senate Bill 24-205 with new requirements regarding the use of automated decision-making technology in consequential decisions. In other words, Colorado did not simply postpone its earlier AI law. It rewrote it around a different central concept.

The two definitions that set the scope

Two terms in the bill summary decide whether a product is affected.

Automated decision-making technology

The summary describes automated decision-making technology, or ADMT, as technology that processes personal data and uses computation to generate output, including predictions, recommendations, classifications, rankings, scores or other information, that is used to make, guide or assist a decision, judgment or determination concerning an individual. Notice that the wording does not depend on the label "AI". A rules-based scoring model and a machine learning model could both produce a score that guides a decision; whether a given system is covered turns on the statute's full definition and its exclusions, which the summary does not set out in detail.

Consequential decision

The summary defines a consequential decision as one that relates to an individual's access to, eligibility for, or compensation related to education, employment, housing, financial or lending services, insurance, health-care services, or essential government services and public benefits. A product recommendation engine in an online store is a long way from that list. An applicant ranking feature in recruitment software is squarely on it.

What developers and deployers must do

The summary splits responsibility between the developer of a covered ADMT and the deployer, meaning the organization that uses it.

For developers, the summary says that starting January 1, 2027, a developer must provide a deployer with technical documentation describing the covered ADMT's intended uses, categories of training data, known limitations, and instructions for appropriate use and human review.

For deployers, the summary describes a clear and conspicuous notice to consumers at the point of interaction with a covered ADMT. Where a covered ADMT makes a consequential decision that results in an adverse outcome, the deployer must give the consumer a plain language description of the technology's role within 30 days. The summary adds that the attorney general must adopt rules to clarify these post-adverse outcome disclosure requirements by January 1, 2027.

Both developers and deployers must retain the records needed to demonstrate compliance for at least three years, according to the summary.

Consumer rights under the act

The bill summary lists rights that a consumer can exercise against a covered system. Consumers have the right to request personal data, and to request correction of factually incorrect personal data, used by a covered ADMT. They also have the right to request meaningful human review and reconsideration after a covered ADMT makes a consequential decision with an adverse outcome.

For a software team, each of those rights is a feature request. Someone has to be able to retrieve the inputs a decision was based on, change an incorrect value, and route a case to a person with the authority to reach a different result.

Enforcement and timing

The summary states that the attorney general is directed to enforce the act through the Colorado Consumer Protection Act. Before bringing an action prior to January 1, 2030, the attorney general must give the developer or deployer a 60-day notice and an opportunity to cure the alleged violation, if a cure is deemed possible. The summary also states that the act does not create a new private right of action, and that it establishes how fault is allocated between developers and deployers in civil actions alleging unlawful discrimination.

On timing, the bill was signed on May 14, 2026, and the summary ties the developer documentation duty to January 1, 2027. The attorney general's rules on adverse outcome disclosures are due by the same date, so some of the practical detail is not yet settled. Check the enacted text for the start date of each obligation that applies to you.

What it means for your business

The first question is which role you play, and it is possible to play both. In our reading, a company that builds a screening or scoring product and sells it to others looks like a developer, while a company that uses such a product on applicants, tenants or customers looks like a deployer. A business that commissions bespoke decision software for its own use should clarify with counsel, and in its contract, who carries the developer documentation duty.

The second point is that most of these obligations are easier to meet when they are designed in. Documentation of intended use and training data categories is simple to write while a system is being built and hard to reconstruct later. Explaining a decision 30 days after the fact requires that the system logged what data it used and what it produced. Human review requires a real override path, not a button that reruns the same model.

The third point concerns geography. Businesses outside Colorado, including UK companies, should not assume the act is irrelevant if their systems make decisions about Colorado residents; whether and how it applies is a legal question. If you are still working out what kind of system you have, our explainer on AI agents, chatbots and workflow automation may help you describe it accurately.

What to do next

Take an inventory of every system that produces a score, rank, recommendation or classification about an individual, and mark those that touch the areas in the consequential decision definition. For each one, record who built it, what personal data it uses and whether a person reviews its output.

Ask your vendors what documentation they intend to provide and when. If you are the vendor, start drafting it now. Review whether your product can already show a consumer the data used, accept a correction and hand a decision to a human reviewer, and estimate the work if it cannot. Then follow the Colorado attorney general's rulemaking, because the rules on adverse outcome disclosures will shape the wording and timing of the notices you send.

Conclusion

Colorado's SB26-189, signed on May 14, 2026, replaces the state's 2024 AI law with rules focused on automated decision-making technology used in consequential decisions. The official summary describes documentation duties for developers from January 1, 2027, notice and explanation duties for deployers, consumer rights to data correction and human review, and enforcement by the attorney general with no new private right of action. Read the bill page linked above and take legal advice before relying on any summary, including this one.

Entrant Technologies builds web applications, mobile apps and custom software. If you are planning a system that will inform decisions about people and want audit logging, explanation and human review built in from the first release, get in touch to discuss the requirements.