Answers to Common Business Legal Questions
Colorado’s New AI Decision-Making Law: What Businesses Need to Know Before 2027
Colorado’s New AI Decision-Making Law: What Businesses Need to Know Before 2027
Colorado has again moved to the forefront of artificial intelligence regulation with the passage of Colorado Senate Bill 26-189, governing the use of automated decision-making technology in “consequential” business decisions. The law takes effect on January 1, 2027, and will affect employers, lenders, insurers, housing providers, healthcare organizations, educational institutions, and technology vendors operating in Colorado.
The legislation replaces an earlier 2024 AI law with a narrower but still significant regulatory framework focused on transparency, consumer rights, and accountability in AI-assisted decision making.
What the Law Covers
The statute applies to “automated decision-making technology” (“ADMT”), broadly defined as technology that processes personal data and uses computation to generate outputs such as predictions, rankings, scores, recommendations, or classifications that are used to make or assist decisions about individuals.
The law specifically targets “consequential decisions,” including decisions involving:
- Employment or compensation
- Education admissions or opportunities
- Housing
- Lending and financial services
- Insurance
- Healthcare services
- Essential government services
If AI “materially” influences one of these decisions, the law may apply, although it is not clear what is meant by the term “materially”.
Key Obligations for AI Developers and Businesses
The law distinguishes between “developers” of AI systems and “deployers”. Deployers are businesses that use those systems in real-world decision making.
Beginning January 1, 2027, developers of covered AI systems must provide deployers with technical documentation describing:
- Intended uses of the AI system
- Categories of training data
- Known limitations and risks
- Appropriate human review procedures
- Material updates or modifications
Both developers and deployers must retain records demonstrating compliance for at least three years.
Deployers must provide consumers with clear notice when they are interacting with a covered AI system. If a consumer receives an adverse consequential decision — such as denial of employment, housing, insurance, or credit — the deployer must provide a plain-language explanation of AI’s role in that decision within 30 days of the decision.
Consumer Rights and Remedies
The new law creates several important consumer protections. Individuals affected by AI-assisted consequential decisions have the right to:
- Request access to personal data used by the AI system
- Correct factually inaccurate personal data
- Request meaningful human review of the decision
- Seek reconsideration of adverse decisions
Importantly, the law does not create a new private right of action. Consumers generally cannot sue solely because a company violated the statute. Instead, enforcement authority rests primarily with the Colorado Attorney General under the Colorado Consumer Protection Act. Violations are treated as deceptive trade practices. Before bringing an enforcement action, however, the Attorney General must provide a 60-day notice and opportunity to cure when cure is possible.
What Businesses Should Be Doing Now
Although the law does not take effect until January 2027, businesses should begin preparing now. Many organizations are already using AI tools in hiring, underwriting, customer screening, fraud detection, and other sensitive decision-making processes — often without fully understanding how those systems operate.
Businesses should consider taking the following steps during 2026:
- Inventory AI Systems
- Identify all AI or algorithmic tools used in consequential decision-making processes, including third-party software.
- Review vendor Contracts for how they may use AI tools
- Ensure contracts with AI vendors require adequate disclosures, technical documentation, cooperation, and indemnification provisions.
- Implement human review procedures to ensure that AI is not the sole decision-maker
- Establish documented procedures for meaningful human oversight and appeal processes.
- Review the accuracy, completeness, and potential bias of data used by AI systems.
- Prepare consumer notices
- Develop clear disclosures explaining when and how AI influences decisions.
- Train management and human resources personnel
Decision makers should understand both the capabilities and limitations of AI-assisted systems.
It is mainly at the state level, that we are seeing regulation of the use of AI in business decisions, particularly where automated systems affect employment, credit, housing, healthcare, and other significant consumer rights. Colorado’s new bill is just the latest example of this. Businesses that begin compliance planning now will be better positioned to reduce legal risk and adapt as AI regulation continues to evolve.
If you have questions, please reach out to Mark Spitz at Spitz Legal Counsel LLC, at mark@spitzlegalcounsel.com or 720-575-0440.
General Business Legal Services
Business Legal Services We Offer
What does a business attorney do?
A business attorney helps companies manage legal risk, drafts and negotiates contracts, structure transactions, and ensure compliance with laws so owners can focus on growth. A business attorney also helps entrepreneurs form a new company, advising on the best form of legal entity and setting it up.
Do I really need a business lawyer for my company?
If your business has contracts, employees, partners, or regulatory obligations, legal guidance is critical to avoid costly mistakes and disputes.
What types of clients do you work with?
We work with startups, entrepreneurs, family-owned businesses, and established companies across a wide range of industries.
What is “outside general counsel”?
Outside general counsel provides ongoing legal support similar to an in-house lawyer, but on a flexible, cost-effective basis.
How is your approach different from larger law firms?
We prioritize understanding your business deeply and providing practical, proactive advice with personalized attention. In addition to a strong emphasis on customer service, a solo attorney such as myself has much lower overhead costs, which allows me to charge clients lower fees than the larger firms, with the same quality of legal work.
Colorado Business Startups & Entity Formation
Business Startups & Entity Formation
What type of business entity should I choose?
As lawyers say, “it depends.” The best structure (LLC, corporation, etc.) depends on liability, tax considerations, ownership, and future growth plans.
Why is forming an LLC beneficial?
An LLC offers liability protection and flexible management, helping separate personal and business risks.
Do I need an operating agreement for my Colorado LLC?
Yes. A written operating agreement clarifies ownership, management, and decision-making, and helps avoid disputes. We offer proactive advice with personalized attention. In addition to a strong emphasis on customer service, a solo Colorado attorney such as myself has much lower overhead costs, which allows me to charge clients lower fees than the larger firms, with the same quality of legal work.
Contracts & Transactions
Contracts & Transactions
Why are contracts so important for my Colorado business?
Well-written contracts define rights and obligations, reduce misunderstandings, and protect your business from disputes. While oral contracts are enforceable, it is always safer to put it in writing!
Can I use online contract templates?
Templates can be risky because they may not reflect your specific business needs or applicable laws. I have seen people use online contracts that lacked provisions that a business lawyer would have known to include, which resulted in lawsuits and hard feelings.
What types of contracts should my Colorado business have?
Common agreements include customer contracts, vendor agreements, employment agreements, and operating or shareholder agreements.
How can a lawyer help with contract negotiations?
A lawyer ensures terms are clear, fair, and aligned with your business objectives while minimizing risk.
Mergers & Acquisitions
Mergers & Acquisitions
What should I expect when buying or selling a business in Colorado?
Transactions involve due diligence, negotiation, structuring (asset vs. stock deal), and detailed documentation.
Why is legal guidance important in M&A transactions?
These deals are complex and involve financial, legal, and operational risks that require experienced oversight.
What is due diligence?
Due diligence the process of reviewing financial, legal, and operational information before completing a transaction, to make sure the buyer knows what he or she is getting.
Employment & Compliance
Employment & Compliance
What employment law issues should Colorado businesses be aware of?
Hiring, termination, wage compliance, and workplace policies all carry legal risks if not handled properly.
How can I reduce employment-related risk?
Use clear policies, compliant contracts, and consistent practices across your workforce.
Colorado’s New AI Decision-Making Law: What Businesses Need to Know Before 2027
Colorado’s New AI Decision-Making Law: What Businesses Need to Know Before 2027
Colorado has again moved to the forefront of artificial intelligence regulation with the passage of Colorado Senate Bill 26-189, governing the use of automated decision-making technology in “consequential” business decisions. The law takes effect on January 1, 2027, and will affect employers, lenders, insurers, housing providers, healthcare organizations, educational institutions, and technology vendors operating in Colorado.
The legislation replaces an earlier 2024 AI law with a narrower but still significant regulatory framework focused on transparency, consumer rights, and accountability in AI-assisted decision making.
What the Law Covers
The statute applies to “automated decision-making technology” (“ADMT”), broadly defined as technology that processes personal data and uses computation to generate outputs such as predictions, rankings, scores, recommendations, or classifications that are used to make or assist decisions about individuals.
The law specifically targets “consequential decisions,” including decisions involving:
- Employment or compensation
- Education admissions or opportunities
- Housing
- Lending and financial services
- Insurance
- Healthcare services
- Essential government services
If AI “materially” influences one of these decisions, the law may apply, although it is not clear what is meant by the term “materially”.
Key Obligations for AI Developers and Businesses
The law distinguishes between “developers” of AI systems and “deployers”. Deployers are businesses that use those systems in real-world decision making.
Beginning January 1, 2027, developers of covered AI systems must provide deployers with technical documentation describing:
- Intended uses of the AI system
- Categories of training data
- Known limitations and risks
- Appropriate human review procedures
- Material updates or modifications
Both developers and deployers must retain records demonstrating compliance for at least three years.
Deployers must provide consumers with clear notice when they are interacting with a covered AI system. If a consumer receives an adverse consequential decision — such as denial of employment, housing, insurance, or credit — the deployer must provide a plain-language explanation of AI’s role in that decision within 30 days of the decision.
Consumer Rights and Remedies
The new law creates several important consumer protections. Individuals affected by AI-assisted consequential decisions have the right to:
- Request access to personal data used by the AI system
- Correct factually inaccurate personal data
- Request meaningful human review of the decision
- Seek reconsideration of adverse decisions
Importantly, the law does not create a new private right of action. Consumers generally cannot sue solely because a company violated the statute. Instead, enforcement authority rests primarily with the Colorado Attorney General under the Colorado Consumer Protection Act. Violations are treated as deceptive trade practices. Before bringing an enforcement action, however, the Attorney General must provide a 60-day notice and opportunity to cure when cure is possible.
What Businesses Should Be Doing Now
Although the law does not take effect until January 2027, businesses should begin preparing now. Many organizations are already using AI tools in hiring, underwriting, customer screening, fraud detection, and other sensitive decision-making processes — often without fully understanding how those systems operate.
Businesses should consider taking the following steps during 2026:
- Inventory AI Systems
- Identify all AI or algorithmic tools used in consequential decision-making processes, including third-party software.
- Review vendor Contracts for how they may use AI tools
- Ensure contracts with AI vendors require adequate disclosures, technical documentation, cooperation, and indemnification provisions.
- Implement human review procedures to ensure that AI is not the sole decision-maker
- Establish documented procedures for meaningful human oversight and appeal processes.
- Review the accuracy, completeness, and potential bias of data used by AI systems.
- Prepare consumer notices
- Develop clear disclosures explaining when and how AI influences decisions.
- Train management and human resources personnel
Decision makers should understand both the capabilities and limitations of AI-assisted systems.
It is mainly at the state level, that we are seeing regulation of the use of AI in business decisions, particularly where automated systems affect employment, credit, housing, healthcare, and other significant consumer rights. Colorado’s new bill is just the latest example of this. Businesses that begin compliance planning now will be better positioned to reduce legal risk and adapt as AI regulation continues to evolve.
If you have questions, please reach out to Mark Spitz at Spitz Legal Counsel LLC, at mark@spitzlegalcounsel.com or 720-575-0440.
Regulatory & Risk Management
Colorado Regulatory & Risk Management
What is Colorado’s Deceptive Pricing Practices Law?
A 2026 law requiring transparent pricing and prohibiting hidden fees, aimed at protecting consumers.
How can my business comply with pricing laws?
Ensure all advertised prices are clear, accurate, and include required disclosures.
How can a lawyer help me manage business risk?
By identifying potential issues early, structuring agreements properly, and providing ongoing advice.
Working With The Firm
Working With The Law Firm
How do I get started working with your Denver Law Firm?
Typically, you begin with an initial consultation to discuss your business and legal needs.
Does contacting the firm create an attorney-client relationship?
No. An attorney-client relationship begins only after the new client signs a client-engagement letter, which the attorney will provide.
Is my information confidential when I contact you?
Confidentiality applies only after an attorney-client relationship is established, so sensitive information should be shared carefully beforehand.
Get Guidance For Your Situation.
Contact Spitz Legal Counsel
We offer a free 30 minute initial consultation.
Office: 3900 E. Mexico Ave. Suite 300
Denver, Colorado 80210
Phone: 720 575 0440
Fax: 303 927 0809
Email: mark@spitzlegalcounsel.com