Appearance
Coverage and roles
Most developer and deployer duties in SB 26-189 hang on one determination: is this technology a covered ADMT, and does the organization act as developer, deployer, or both for it? (Separately, § 6-1-1708(3)(c) directly requires a HIPAA covered entity to give patients a general notice of advanced-technology use, with no covered-ADMT, pre-use, or point-of-interaction condition, and § 6-1-1708(3)(d)–(e) impose the four-part financial-assistance disclosure when the covered entity uses a covered ADMT to determine a patient's eligibility for financial assistance, including discounted care; see the overlays below.) The definitions in § 6-1-1701 and the sectoral overlays in § 6-1-1708 (enrolled-act numbering) set a conjunctive coverage test: technology, exclusions, material influence, consequential decision, covered domain, role, overlays. It is not a risk-tiering exercise. MFF-28 carries the determination as MRF-482, tagged to both ADMT Roles.
The technology test — ADMT
“Automated decision-making technology” or “ADMT” means a technology that processes personal data and uses computation to generate output, including predictions, recommendations, classifications, rankings, scores, or other information that is used to make, guide, or assist a decision, judgment, or determination concerning an individual.
Three exclusion classes take a technology outside the definition (§ 6-1-1701(2)(b)), each with its own conditions:
| Exclusion | What it covers | Condition |
|---|---|---|
| (I) Fixed technology list | Anti-malware, anti-virus, calculators, databases, data storage, firewalls, internet domain registration, internet website loading, networking, spam- and robocall-filtering, spell-checking, spreadsheets, web caching, web hosting | Spreadsheets qualify only if they require human analysis and do not use machine learning, foundation models, or large language models |
| (II) Human-review support tools | Tools used by an individual solely to summarize, organize, translate, draft, route, or present information | For human review of administrative processing |
| (III) Consumer-facing natural-language technology | Technology that communicates with consumers in natural language or other means readily understood by an average consumer, to provide information, make referrals or recommendations, answer questions, or generate other content | Only if it is not contracted, advertised, marketed, configured, or intended to be used in a consequential decision and it is subject to an acceptable-use policy that prohibits generated content from being used in a consequential decision |
A chatbot marketed as a decision tool cannot ride exclusion (III); a spreadsheet driven by a machine-learning model cannot ride exclusion (I). Losing an exclusion does not by itself make a technology covered; the remaining elements still have to hold.
The coverage and materiality tests
§ 6-1-1701(5): "“Covered ADMT” means automated decision-making technology that is used to materially influence a consequential decision."
Materially influence (§ 6-1-1701(13)): the ADMT output is a non-de minimis factor used in making a consequential decision and affects its outcome, "including by constraining, ranking, scoring, recommending, classifying, or otherwise meaningfully altering how a consequential decision is made". Incidental, trivial, or clerical uses are excluded (¶ 13(b)). The Attorney General may adopt rules clarifying this definition through presumptions, illustrative examples, and objective indicators (§ 6-1-1706(5)); the framework carries a watch marker for them.
Consequential decision and the seven covered domains
A consequential decision (§ 6-1-1701(3)) is a decision, determination, or action made about a consumer that relates to the provision of, or the consumer's access to, eligibility for, selection for, or compensation for, a covered domain; or a decision, determination, or action about a consumer that relates to a differentiated price, cost sharing, compensation, or other material terms in a manner reasonably likely to materially limit, delay, effectively deny, or otherwise fundamentally alter the consumer's access, eligibility, or opportunity for a covered domain.
The seven covered domains (§ 6-1-1701(6)):
- Education
- Employment, or an employment opportunity that creates or may create an employer-employee relationship
- The lease or purchase of residential real estate in Colorado
- A financial or lending service
- Insurance (underwriting, pricing, coverage, claims adjudication, or other determinations materially affecting access to benefits)
- Health-care services
- Essential government services and public benefits
Nine exclusions (§ 6-1-1701(3)(b)) take a decision outside the definition, each on its own conditions:
| Exclusion | Condition |
|---|---|
| Low-stakes or routine decisions, actions, and business processes | That do not materially influence eligibility, selection, denial, compensation, pricing, or access for a covered domain |
| Advertising, marketing, differentiated product recommendations, search, or content moderation | — |
| Spreadsheets | That require manual human analysis and do not use machine learning, foundation models, or large language models |
| Uses where an ADMT summarizes, organizes, or presents information for human review | And the system does not produce a score, ranking, recommendation, classification, prediction, or other inference that materially influences an outcome or a decision |
| Narrow procedural tasks or data-processing functions | That do not generate a prediction or inference about a consumer or materially influence a consequential decision or decision process |
| Cybersecurity, spam-filtering, system-reliability, and anti-money-laundering / counter-terrorist-financing controls | — |
| Sanctions compliance | Excluding facial recognition unless its sole purpose is identity confirmation |
| Fraud prevention | — |
| Routine academic administration and student support processes | That do not materially influence a consequential decision |
Consumer (§ 6-1-1701(4)) is the Colorado Privacy Act definition plus an employee, a job applicant who is a Colorado resident, and any individual whose access, eligibility, or opportunity in Colorado is evaluated in a consequential decision by a person doing business in Colorado.
Developer and deployer
| Role | Definition (§ 6-1-1701) |
|---|---|
| Deployer (¶ 7) | A person doing business in Colorado that deploys a covered ADMT |
| Developer (¶ 8(a)) | A person doing business in Colorado that develops, offers, sells, leases, licenses, or otherwise makes commercially available a covered ADMT; or develops a component designed, marketed, intended, documented, advertised, configured, or contracted to be used as part of one; or intentionally and substantially modifies an ADMT such that it becomes a covered ADMT |
Developer exclusions (¶ 8(b)): development and use solely for research purposes where the ADMT is not used in a consequential decision in the research; internal-only use not made available to others for consequential decisions; a preceding developer after an unaffiliated person's modification that changes the system's intended, documented, marketed, advertised, configured, or contracted use; a component integrated into a covered ADMT without the person's actual knowledge.
The roles are not exclusive and can change. The same organization can be developer and deployer of the same tool. A deployer that intentionally and substantially modifies an ADMT into a covered ADMT becomes its developer (¶ 8(a)(III)). Developer duties are also triggered when a developer becomes aware that its ADMT is being used to make consequential decisions in a manner consistent with the intended and contracted uses (§ 6-1-1702(5)). MRF-482 therefore asks for the determination to be re-run on an intentional and substantial modification, a new deployment, or on becoming aware of consequential-decision use.
Sectoral overlays — § 6-1-1708
The overlays change what applies for particular actors. Each has exact limits; a mis-stated overlay is the fastest route to a wrong scoping decision.
| Actor | Effect | Limits |
|---|---|---|
| Insurers subject to C.R.S. § 10-3-1104.9 | In compliance with part 17 in the practice of insurance | Not for their employment uses; an insurer not deemed compliant must provide the § 6-1-1704(3) post-adverse-outcome disclosures (§ 6-1-1708(1)(b)) |
| HIPAA covered entities | Exempt from §§ 6-1-1701 through 6-1-1706 | Only to the extent doing business in Colorado; except for consequential decisions related to employment; a health-care provider is exempt only if it operates from a Colorado location; covered entities retain affirmative duties: a general notice to patients of advanced-technology use, and a four-part disclosure when the covered entity uses a covered ADMT to determine a patient's eligibility for financial assistance, including discounted care (§ 6-1-1708(3)(c)–(e)) |
| HIPAA business associates | Exempt from §§ 6-1-1701 through 6-1-1706 | Only for services rendered to a covered entity, and only to the extent that covered entity does business in Colorado; the employment exception applies |
| FDA-regulated devices and R&D | Outside §§ 6-1-1701 through 6-1-1706 | Medical devices subject to FDA oversight, and a pharmaceutical or medical-device manufacturer's research and development activities subject to FDA oversight (§ 6-1-1708(4)); separate and unconditional |
| Creditors | A federal ECOA / Regulation B (and, where applicable, FCRA) adverse-action notice can discharge the Colorado disclosure duty | Conditional satisfaction, not deemed compliance: only if the federal notice also satisfies the Colorado requirements for the same decision (§ 6-1-1704(6)) |
| FERPA-subject education deployers | Satisfy the § 6-1-1704 notice and disclosure duties through FERPA-consistent processes and channels; for § 6-1-1705, existing student-record inspection, review, and amendment procedures and applicable complaint or appeal processes qualify only if they offer a reasonable mechanism for correction of materially inaccurate personal data and reconsideration where applicable | §§ 6-1-1704(9), 6-1-1705(2); no separate duplicative process where those conditions are met |
| HIPAA and GLBA disclosure limits | Nothing in part 17 requires disclosing protected health information in violation of federal law, or nonpublic personal information in violation of the Gramm-Leach-Bliley Act | §§ 6-1-1708(5)–(6); where compliance with § 6-1-1704 or § 6-1-1705 would conflict with federal health-privacy requirements, the deployer complies with federal law and provides disclosures and access consistent with that law |
The consequence for scoping: a HIPAA covered entity or qualifying business associate may find that §§ 6-1-1701 through 6-1-1706 apply only to its employment uses of an ADMT, subject to the exact limits above, while the covered-entity notice and financial-assistance disclosure duties of § 6-1-1708(3)(c)–(e) bind it directly and separately. Insurers follow a different route: qualifying insurance practices are in compliance under § 6-1-1708(1)(a), a non-deemed-compliant insurer owes the subsection (1)(b) disclosures, and employment uses are outside the insurer provision altogether. MRF-485 and MRF-486 carry those affirmative duties; see Deployer duties and consumer rights.
When it applies
The act takes effect January 1, 2027 and applies to consequential decisions made on or after January 1, 2027 (Section 5(1), (3) of the act). The Attorney General rulemaking authorities, the insurance commissioner's rulemaking authority, and certain related provisions took effect on passage (Section 5(2)).
Enforcement context
The Attorney General enforces part 17 exclusively through the Colorado Consumer Protection Act; a violation is a deceptive trade practice; a 60-day cure period precedes enforcement where the Attorney General deems cure possible (not required where the Attorney General can demonstrate a knowing or repeated violation; the cure subsection is repealed January 1, 2030); the act creates no new private right of action (§ 6-1-1706). Compliance with part 17 is not a defense to any other law (§ 6-1-1709(2)).
How this maps in Modulos — MRF-482
MRF-482 (ADMT coverage and role determination) asks the project to determine and keep current whether SB 26-189 applies to this technology and in which roles: whether it is ADMT, whether an exclusion applies, whether it materially influences a consequential decision in a covered domain, whether a sectoral overlay changes what applies, and whether the organization acts as developer, deployer, or both. It carries both ADMT Role tags.
The requirement is carried by the new control MCF-688 (ADMT coverage and role determination). The platform's shared risk-tiering control was deliberately not reused: tiering vocabulary (risk tiers, impact assessments) belongs to the repealed 2024 act and would invite the wrong model. The law imposes no record-keeping duty for the determination itself; recording it with its rationale, and re-running it on the triggers above, is the evidence practice the control provides.
Where to go next
- Developer duties — the transparency package, update notices, and records for the developer role.
- Deployer duties and consumer rights — notices, disclosures, human review, records, and liability allocation for the deployer role.
- Operationalizing SB 26-189 in Modulos — the full
MFF-28/OFF-28rollout.
Disclaimer
This page is for general informational purposes and does not constitute legal advice. Section citations follow the SB 26-189 enrolled act; part 17's final codified disposition is pending. Always verify against the current published text and consult qualified advisers.