Coverage and roles

SB 26-189 (Colorado Senate Bill 26-189) gives duties to developers and deployers of a covered ADMT. These definitions help you find if a technology is a covered ADMT. They also help you find if your organization is the developer of that technology, its deployer, or its developer and deployer. Section 6-1-1701 of part 17, as SB 26-189 reenacts it, gives the definitions. Section 6-1-1708 changes how part 17 applies to some persons.

SB 26-189 applies to consequential decisions made on or after January 1, 2027. For all dates of SB 26-189, see When SB 26-189 applies.

For a HIPAA covered entity's patient duties and the location condition for a health-care provider (§ 6-1-1708(3)(b) to (e)), see the general notice and financial assistance disclosures.

The technology test — ADMT

For developers and deployers, the ADMT definition is the first test to find if SB 26-189 gives them duties. Section 6-1-1701(2)(a) of SB 26-189 gives this definition:

“Automated decision-making technology” or “ADMT” means a technology that processes personal data and uses computation to generate output, including predictions, recommendations, classifications, rankings, scores, or other information that is used to make, guide, or assist a decision, judgment, or determination concerning an individual.

In § 6-1-1701(2)(b) of SB 26-189, 3 groups of technology are not ADMT. Each group has its conditions:

Exclusion in § 6-1-1701(2)(b)	Technology in the group	Condition
§ 6-1-1701(2)(b)(I): 14 technologies	"anti-malware", "anti-virus", "calculators", "databases", "data storage", "firewalls", "internet domain registration", "internet website loading", "networking", "spam- and robocall-filtering", "spell-checking", "spreadsheets", "web caching", and "web hosting"	Spreadsheets are in the group only if they "require human analysis and do not use machine learning, foundation models, or large language models". The other 13 technologies have no condition.
(II) Tools for human review	"a tool used by an individual solely to summarize, organize, translate, draft, route, or present information for human review of administrative processing"	The tool is "used by an individual solely" for these tasks, and the tasks are "for human review of administrative processing".
(III) Technology for consumers	Technology that "communicates with consumers in natural language or other means readily understood by an average consumer for the purpose of providing consumers with information, making referrals or recommendations, answering questions, or generating other content"	All of these conditions: (A) the technology "is not contracted, advertised, marketed, configured, or intended by a person to be used in a consequential decision", and (B) the technology "is subject to an acceptable use policy that prohibits generated content to be used in a consequential decision".

Thus, if a person marketed a technology for use in a consequential decision, that technology cannot use exclusion (III). Spreadsheets that use machine learning cannot use exclusion (I). If no exclusion applies, the technology is not automatically a covered ADMT. The other tests in the next sections must also apply.

Covered ADMT and materially influence

The definitions of developer and deployer in SB 26-189 refer to a covered ADMT. Section 6-1-1701(5) of SB 26-189 gives this definition: "“Covered ADMT” means automated decision-making technology that is used to materially influence a consequential decision."

Section 6-1-1701(13) of SB 26-189 gives the definition of materially influence:

(a) “Materially influence” means: (I) an ADMT output is a non-de minimis factor that is used in making a consequential decision; and (II) an ADMT output affects the outcome of a consequential decision, including by constraining, ranking, scoring, recommending, classifying, or otherwise meaningfully altering how a consequential decision is made. (b) “Materially influence” does not include incidental, trivial, or clerical uses.

Thus the two conditions in (a) must apply together.

The Attorney General "may adopt rules" on materially influence (§ 6-1-1706(5)(b)). As of October 2026, there are proposed rules of the Attorney General and a request for written comments on two alternative standards for "Materially Influence". The proposed rules are not adopted, and the alternative standards are not rules. See Attorney General rules and other sources.

Consequential decision and the seven covered domains

Section 6-1-1701(3)(a) of SB 26-189 gives this definition:

(a) “Consequential decision” means: (I) A decision, determination, or action made about a consumer that relates to the provision of or a consumer's access to, eligibility for, selection for, or compensation for a covered domain; or (II) A decision, determination, or action about a consumer that relates to a differentiated price, cost sharing, compensation, or other material terms in a manner that is reasonably likely to materially limit, delay, effectively deny, or otherwise fundamentally alter the consumer's access, eligibility, or opportunity for a covered domain.

Adverse outcome has a different definition (§ 6-1-1701(1)). An adverse outcome starts some deployer duties after a decision. For that definition, see Disclosures after an adverse outcome.

Section 6-1-1701(6) gives 7 covered domains:

(a) "an education enrollment or an education opportunity"
(b) "employment or an employment opportunity that creates or may create an employer-employee relationship"
(c) "the lease or purchase of residential real estate in Colorado"
(d) "a financial or lending service"
(e) "insurance, including underwriting, pricing, coverage, claims adjudication, or other determinations that materially affect access to benefits"
(f) "health-care services"
(g) "essential government services and public benefits, including eligibility and renewal determinations"

In § 6-1-1701(3)(b), 9 groups are not consequential decisions. Each group has its conditions or examples:

§ 6-1-1701(3)(b)	Exclusion
§ 6-1-1701(3)(b)(I)	"low-stakes or routine decisions, actions, and business processes that do not materially influence eligibility for, selection for, denial of, compensation for, pricing of, or access to an opportunity or service for a covered domain, including routine scheduling, classroom personalization, administrative routing, customer service triage, communication of decisions, or workflow management"
(II)	"advertising, marketing, differentiated product recommendations, search, or content moderation"
(III)	"spreadsheets that require manual human analysis and do not use machine learning, foundation models, or large language models"
(IV)	"actions in which an ADMT is used to summarize, organize, or present information for human review and the system does not produce a score, ranking, recommendation, classification, prediction, or other inference that materially influences an outcome or a decision"
(V)	"narrow procedural tasks or data-processing functions that do not generate a prediction or inference about a consumer or materially influence a consequential decision" or "consequential decision process"
(VI)	"Activities relating to technologies" used for "cybersecurity, spam- and robo-call filtering, system reliability, and anti-money laundering and counter-terrorist financing controls"
(VII)	"activities relating to technologies used for economic sanctions compliance", for example compliance with the Bank Secrecy Act, the USA PATRIOT Act, the Red Flags Rule of the Federal Trade Commission, and the "sanctions programs administered by the United States Department of the Treasury". Item (VII) then gives this limit: "excluding facial recognition unless the sole purpose of which is to confirm an individual's identity".
(VIII)	"activities relating to technologies used for fraud prevention, including identity verification, consumer identification, monitoring, and reporting controls required under state or federal law"
(IX)	"routine academic administration and student support processes that do not materially influence a consequential decision"

The consumer — § 6-1-1701(4)

In § 6-1-1701(4)(a) of SB 26-189, a consumer "has the meaning set forth in section 6-1-1303 (6)(a)". In § 6-1-1701(4)(b), a consumer also "includes an employee, a job applicant who is a Colorado resident, and any individual whose access to, eligibility for, or opportunity in Colorado is evaluated in a consequential decision by a person doing business in Colorado".

Thus, in all of part 17, an employee is a consumer. A job applicant who is a Colorado resident is also a consumer. For the special provision on exceptions in § 6-1-1705(1)(b), see Consumer correction and meaningful human review.

Section 6-1-1701 of SB 26-189 also uses definitions from other law:

Definition	§ 6-1-1701	Source
Employee and employer	(9) and (10)	§ 8-4-101(5) and (6)
FERPA	(11)	The Family Educational Rights and Privacy Act of 1974, 20 U.S.C. § 1232g, and its implementing regulations
Personal data	(16)	§ 6-1-1303(17)
Trade secret	(17)	§ 7-74-102(4)

Developer and deployer

In § 6-1-1701(7) of SB 26-189, a deployer is "a person doing business in Colorado that deploys a covered ADMT".

In § 6-1-1701(8)(a), a developer is a person doing business in Colorado to which one or more of these items apply:

§ 6-1-1701(8)(a)(I): The person "develops, offers, sells, leases, licenses, or otherwise makes commercially available a covered ADMT".
(II) The person "develops a component that is designed, marketed, intended, documented, advertised, configured, or contracted to be used as part of a covered ADMT".
(III) The person "intentionally and substantially modifies an ADMT such that it becomes a covered ADMT".

In § 6-1-1701(8)(b), a person is not a developer if one of these items applies:

§ 6-1-1701(8)(b)(I)(A): The person develops and uses an ADMT "solely for research purposes and the ADMT is not used in a consequential decision in the research".
§ 6-1-1701(8)(b)(I)(B): The person develops and uses an ADMT "for internal purposes, such as use and development activities by affiliates and commercial support functions, and that does not make the system available to another person for use in a consequential decision".
(II) The person "is a preceding developer that makes an ADMT commercially available and an unaffiliated person modifies the covered ADMT in a manner that changes the system's intended, documented, marketed, advertised, configured, or contracted use".
(III) The person "has designed, marketed, intended, documented, advertised, configured, or contracted a component that is used as part of an ADMT, but the component is integrated into a covered ADMT without the actual knowledge of the person".

One person can be the developer and also the deployer of the same covered ADMT. Item (III) of § 6-1-1701(8)(a) also applies to a deployer. Thus a deployer that makes an intentional and substantial modification of an ADMT, such that the ADMT becomes a covered ADMT, is a developer. The exclusions in § 6-1-1701(8)(b) also apply to that person. For the definition of intentional and substantial modification (§ 6-1-1701(12)), see Notices of material updates and other changes.

Sections 6-1-1702(3) and (5) of SB 26-189 limit when the developer duties apply.

No provision of SB 26-189 tells a person to record its determination (the result of these tests and its role). No provision tells a person to make that determination again. A deployer must keep records "reasonably necessary to demonstrate compliance with this part 17" (§ 6-1-1703). These records can include the determination. In § 6-1-1702(4), the records of a developer are for compliance with § 6-1-1702. The determination can change if one of these changes occurs:

A person makes an intentional and substantial modification.
A person deploys the technology for a new use.
A developer knows of a use in consequential decisions, as in § 6-1-1702(5).

Compliance with other legal obligations — § 6-1-1708

Section 6-1-1708 of SB 26-189 ("Compliance with other legal obligations") changes how part 17 applies to some persons and technologies. These are insurers, HIPAA covered entities and their business associates, and medical devices and research with oversight by the U.S. Food and Drug Administration (FDA). Section 6-1-1708(5) and (6) also give limits from federal law on disclosures.

Person	Effect	Conditions and limits
Insurer (definition in § 10-1-102(13)) and affiliated entities "that are subject to the requirements of section 10-3-1104.9"	In § 6-1-1708(1)(a), they "are in compliance with this part 17 in the practice of insurance".	In § 6-1-1708(2), the section "does not limit the applicability of this part 17 to uses of covered ADMT related to insurer employment or insurer employment opportunities". The commissioner of insurance "may adopt new rules or update existing rules regarding notice and disclosures from insurers to consumers" (§ 10-3-1104.9(3)(e)).
Insurer that is not deemed in compliance in § 6-1-1708(1)(a)	In § 6-1-1708(1)(b), the insurer must give "notice and disclosure of its use of a covered ADMT in materially influencing a consequential decision regarding the practice of insurance pursuant to the disclosure requirements of section 6-1-1704 (3)".	"to the extent applicable"
HIPAA covered entity	In § 6-1-1708(3)(a), §§ 6-1-1701 to 6-1-1706 do not apply to a HIPAA covered entity, "to the extent the covered entity is doing business in Colorado".	The exception is "a consequential decision related to employment or an employment opportunity". For a covered entity that is a health-care provider (45 CFR 160.103), § 6-1-1708(3)(b) gives this condition: "this subsection (3) applies only if the health-care provider is operating from a location within Colorado".
Business associate of a covered entity	In § 6-1-1708(3)(a), §§ 6-1-1701 to 6-1-1706 do not apply to "a covered entity's business associates for any services rendered to a covered entity", "to the extent the covered entity is doing business in Colorado".	The same exception for a consequential decision related to employment or an employment opportunity.
HIPAA covered entity: duties to patients	A general patient notice (§ 6-1-1708(3)(c)), and disclosures if it "uses a covered ADMT to determine a patient's eligibility for financial assistance" (§ 6-1-1708(3)(d) and (e)).	For a covered entity that is a health-care provider, subsection (3) "applies only if the health-care provider is operating from a location within Colorado" (§ 6-1-1708(3)(b)).
Medical device and research and development with FDA oversight	In § 6-1-1708(4), §§ 6-1-1701 to 6-1-1706 do not apply to "a medical device subject to oversight by the United States Food and Drug Administration". They also do not apply to "a pharmaceutical or medical device manufacturer's research and development activities that are subject to oversight by the United States Food and Drug Administration".	The two items apply only with FDA oversight. The research item includes "clinical investigations conducted under 21 CFR 312".
Limits from federal law on disclosures	Sections 6-1-1704(7) and 6-1-1708(5) and (6) limit the disclosures that part 17 makes necessary.	See the conditions of each limit.

These provisions of §§ 6-1-1704 and 6-1-1705 of SB 26-189, not of § 6-1-1708, also change the deployer duties:

Creditors (§ 6-1-1704(6)). For a creditor's notice and disclosure duties, see the method to comply and its conditions.
FERPA: notice and disclosures (§ 6-1-1704(9)). For a consequential decision related to education, a deployer "that is subject to FERPA" can use the notice and disclosure "processes and channels", on this provision's conditions.
FERPA: correction and human review (§ 6-1-1705(2)). For a consequential decision related to education, a deployer "that is subject to FERPA" can use its "existing student record inspection, review, and amendment procedures", on this provision's conditions.