Colorado’s New AI Decision-Making Law: What Businesses Need to Know Before 2027

May 19, 2026 | AI, Artificial Intelligence, General Business FAQ, Medium-sized business, Regulatory FAQ, Small business

Colorado’s New AI Decision-Making Law: What Businesses Need to Know Before 2027

 

Colorado has again moved to the forefront of artificial intelligence regulation with the passage of Colorado Senate Bill 26-189, governing the use of automated decision-making technology in “consequential” business decisions. The law takes effect on January 1, 2027, and will affect employers, lenders, insurers, housing providers, healthcare organizations, educational institutions, and technology vendors operating in Colorado.

The legislation replaces an earlier 2024 AI law with a narrower but still significant regulatory framework focused on transparency, consumer rights, and accountability in AI-assisted decision making.

What the Law Covers

The statute applies to “automated decision-making technology” (“ADMT”), broadly defined as technology that processes personal data and uses computation to generate outputs such as predictions, rankings, scores, recommendations, or classifications that are used to make or assist decisions about individuals.

The law specifically targets “consequential decisions,” including decisions involving:

  • Employment or compensation
  • Education admissions or opportunities
  • Housing
  • Lending and financial services
  • Insurance
  • Healthcare services
  • Essential government services

If AI “materially” influences one of these decisions, the law may apply, although it is not clear what is meant by the term “materially”.

Key Obligations for AI Developers and Businesses

The law distinguishes between “developers” of AI systems and “deployers”. Deployers are businesses that use those systems in real-world decision making.

Beginning January 1, 2027, developers of covered AI systems must provide deployers with technical documentation describing:

  • Intended uses of the AI system
  • Categories of training data
  • Known limitations and risks
  • Appropriate human review procedures
  • Material updates or modifications

Both developers and deployers must retain records demonstrating compliance for at least three years.

Deployers must provide consumers with clear notice when they are interacting with a covered AI system. If a consumer receives an adverse consequential decision — such as denial of employment, housing, insurance, or credit — the deployer must provide a plain-language explanation of AI’s role in that decision within 30 days of the decision.

Consumer Rights and Remedies

The new law creates several important consumer protections. Individuals affected by AI-assisted consequential decisions have the right to:

  • Request access to personal data used by the AI system
  • Correct factually inaccurate personal data
  • Request meaningful human review of the decision
  • Seek reconsideration of adverse decisions

Importantly, the law does not create a new private right of action. Consumers generally cannot sue solely because a company violated the statute. Instead, enforcement authority rests primarily with the Colorado Attorney General under the Colorado Consumer Protection Act. Violations are treated as deceptive trade practices. Before bringing an enforcement action, however, the Attorney General must provide a 60-day notice and opportunity to cure when cure is possible.

What Businesses Should Be Doing Now

Although the law does not take effect until January 2027, businesses should begin preparing now. Many organizations are already using AI tools in hiring, underwriting, customer screening, fraud detection, and other sensitive decision-making processes — often without fully understanding how those systems operate.

Businesses should consider taking the following steps during 2026:

  • Inventory AI Systems
  • Identify all AI or algorithmic tools used in consequential decision-making processes, including third-party software.
  • Review vendor Contracts for how they may use AI tools
  • Ensure contracts with AI vendors require adequate disclosures, technical documentation, cooperation, and indemnification provisions.
  • Implement human review procedures to ensure that AI is not the sole decision-maker
  • Establish documented procedures for meaningful human oversight and appeal processes.
  • Review the accuracy, completeness, and potential bias of data used by AI systems.
  • Prepare consumer notices
  • Develop clear disclosures explaining when and how AI influences decisions.
  • Train management and human resources personnel

Decision makers should understand both the capabilities and limitations of AI-assisted systems.

It is mainly at the state level, that we are seeing regulation of the use of AI in business decisions, particularly where automated systems affect employment, credit, housing, healthcare, and other significant consumer rights. Colorado’s new bill is just the latest example of this. Businesses that begin compliance planning now will be better positioned to reduce legal risk and adapt as AI regulation continues to evolve.

If you have questions, please reach out to Mark Spitz at Spitz Legal Counsel LLC, at mark@spitzlegalcounsel.com or 720-575-0440.