Deployer duties and consumer rights

SB 26-189 gives duties to a deployer, that is, a person doing business in Colorado that deploys a covered ADMT (§ 6-1-1701(7)). For a consumer, the duties of the deployer come in this sequence:

1. Notice before use (§ 6-1-1704(1) and (2)). The deployer must give the consumer a clear and conspicuous notice. It must give this notice before it uses a covered ADMT to materially influence a consequential decision.
2. Disclosures after an adverse outcome (§ 6-1-1704(3)). If the consequential decision results in an adverse outcome for the consumer, the deployer must give three disclosures "within thirty days after making the decision".
3. Correction and human review (§ 6-1-1705(1)). After an adverse outcome, the consumer can make a request. The deployer must then give instructions to request and to correct personal data. It must also give "an opportunity for meaningful human review and reconsideration of the consequential decision, to the extent commercially reasonable".
4. Records (§ 6-1-1703). The deployer must keep records "reasonably necessary to demonstrate compliance with this part 17" for a minimum period after each consequential decision.

Section 6-1-1707 also gives provisions on liability for developers and deployers. The section numbers here are the numbers in the enrolled act of SB 26-189. As of October 2026, the codification of part 17 is not complete (see Colorado SB 26-189).

SB 26-189 applies to consequential decisions made on or after January 1, 2027 (Section 5(3), see the dates of SB 26-189). As of October 2026, the Attorney General rules on disclosures and consumer rights that SB 26-189 makes necessary are proposed rules, not adopted.

Notice before use — § 6-1-1704(1) and (2)

Section 6-1-1704(1) of SB 26-189 gives this duty to a deployer:

Prior to a deployer using a covered ADMT to materially influence a consequential decision, the deployer shall provide a clear and conspicuous notice to a consumer that the deployer used or will use a covered ADMT in a consequential decision affecting the consumer and instructions regarding how the consumer may obtain the additional information described in this section.

Section 6-1-1704(2) gives the deployer an alternative method to comply with § 6-1-1704(1):

A deployer complies with subsection (1) of this section by maintaining a prominent public notice that is reasonably accessible at points of consumer interaction, including through a link or posting that is reasonably proximate to the interaction or transaction in which a consequential decision may occur.

Section 6-1-1704(8) gives a duty to a deployer and to a developer:

A deployer or developer shall provide the notices and disclosures required by this part 17 in a manner that is reasonably accessible to consumers with disabilities and consumers with limited English proficiency, consistent with applicable state and federal law.

This duty applies to the notices and disclosures that part 17 tells each of these persons to give. In § 6-1-1708(3)(a), §§ 6-1-1701 to 6-1-1706 "do not apply to a covered entity within the meaning of" HIPAA, on the conditions of § 6-1-1708(3).

Section 6-1-1704(9) applies to a deployer "that is subject to FERPA", "for a consequential decision relating to education". That deployer:

• "satisfies the notice and disclosure requirements of this section by providing notice and disclosures through processes and channels that are consistent with FERPA and the deployer's FERPA notices and student record access procedures, including, where applicable, notice to a parent or guardian or an eligible student" (§ 6-1-1704(9)(a))
• "is not required to establish a separate or duplicative notice or disclosure process if the deployer has established a notice or disclosure process to comply with FERPA" (§ 6-1-1704(9)(b)).

The general notice of a HIPAA covered entity

Section 6-1-1708(3)(c) of SB 26-189 gives a notice duty to a HIPAA covered entity:

A covered entity shall provide patients with a general notice of use of advanced technologies, including a covered ADMT. The notice may be incorporated with other notices describing patient rights and how the covered entity provides care.

Four points apply to this notice:

• Section 6-1-1708(3)(c) gives the duty to the covered entity. It does not name the business associate.
• The § 6-1-1708(3)(c) notice is a different duty from the notice of § 6-1-1704(1). It is not a method to comply with § 6-1-1704(1).
• In § 6-1-1708(3)(a), §§ 6-1-1701 to 6-1-1706 "do not apply to a covered entity", "except for a consequential decision related to employment or an employment opportunity". For that decision, §§ 6-1-1701 to 6-1-1706 apply.
• For a covered entity that is a health-care provider, the location condition of § 6-1-1708(3)(b) also applies to this notice.

For the full conditions of § 6-1-1708(3), see Coverage and roles.

Disclosures after an adverse outcome — § 6-1-1704(3)

Section 6-1-1704(3) of SB 26-189 gives this duty to a deployer:

If a deployer uses a covered ADMT to materially influence a consequential decision that results in an adverse outcome for a consumer, the deployer shall provide within thirty days after making the decision:

Item	§ 6-1-1704(3)
(a)	"a plain language description of the consequential decision and the role the covered ADMT played in the consequential decision"
(b)	"instructions and a simple-to-follow process to request additional information about the covered ADMT and the inputs, including the name of the covered ADMT, the covered ADMT version number, if applicable, the covered ADMT developer, and the types, categories, and sources of personal data used, to the extent the deployer receives the necessary information from the developer in compliance with section 6-1-1702"
(c)	"an explanation of the consumer rights described in section 6-1-1705 and how to exercise them"

The period starts when the deployer makes the decision. Only item (b) has a condition about information from the developer. For the information that a developer must make available to a deployer, see Developer duties.

The adverse outcome

Section 6-1-1701(1) of SB 26-189 gives the definition of "adverse outcome":

"Adverse outcome" means: (a) A decision that denies, terminates, revokes, or materially reduces or restricts a consumer's access to, eligibility for, selection for, compensation for, or the provision of an opportunity or service; or (b) A decision that results in materially less favorable differentiated price, cost, compensation, or other material terms that are reasonably likely to materially limit, delay, or effectively deny, or otherwise fundamentally alter, a consumer's access to, eligibility for, selection for, compensation for, or the provision of an opportunity or service compared to terms offered to similarly situated consumers. If a decision outcome imposes materially less favorable differentiated pricing or terms, the decision outcome materially influences price, cost sharing, compensation, or material terms.

An adverse outcome starts the disclosure duty of § 6-1-1704(3) and the consumer rights of § 6-1-1705(1).

Limits on the disclosures

SB 26-189 gives these limits on the information that a deployer must disclose:

• Trade secrets (§ 6-1-1704(5)). "Nothing in this section requires a deployer to disclose a trade secret or information protected from disclosure by state or federal law." If the deployer withholds information because of § 6-1-1704(5), "the deployer shall notify the consumer".
• Federal law, cybersecurity, and fraud prevention (§ 6-1-1704(7)). Part 17 "shall not be construed to require a person to make a disclosure, provide an explanation, or furnish information to a consumer to the extent doing so would be prohibited by federal law or would compromise the confidentiality or integrity of cybersecurity, fraud prevention, anti-money laundering, counter-terrorist financing, or economic sanctions compliance programs required by law".
• HIPAA (§ 6-1-1708(5)). Part 17 does not make it necessary for "a covered entity or business associate" to disclose "protected health information or other information in a manner that would violate federal law". Also, "to the extent compliance with section 6-1-1704 or 6-1-1705 would conflict with federal health privacy requirements, the deployer shall comply with applicable federal law and provide disclosures and access consistent with that law".
• Gramm-Leach-Bliley Act (§ 6-1-1708(6)). Part 17 "does not require a person to disclose nonpublic personal information in a manner that would violate" the Gramm-Leach-Bliley Act "or its implementing regulations".

The accessibility duty of § 6-1-1704(8) also applies to these disclosures (see Notice before use).

Creditors

Section 6-1-1704(6) of SB 26-189 applies to a creditor, "with respect to a consequential decision involving the offering, the denial, the pricing, the servicing, or other material terms of credit". The creditor complies with the notice or disclosure requirements of § 6-1-1704 for the same decision or adverse outcome if all of these conditions apply:

• Federal law makes a notice to the consumer necessary, and the creditor gives that notice. The federal law is the Equal Credit Opportunity Act and its implementing regulations, for example Regulation B (12 CFR 1002). When applicable, it also includes the Fair Credit Reporting Act.
• That notice "also satisfies the notice or disclosure requirements of this section" (§ 6-1-1704(6)(a)).

Thus, the notice in federal law is a method to comply only if it also gives the notice or disclosure items of § 6-1-1704. A creditor that complies with the federal law of the first condition and with § 6-1-1704(6)(a) "is not required to provide a separate or duplicative notice pursuant to this section" (§ 6-1-1704(6)(b)). Section 6-1-1704(6) does not make it necessary for a creditor to give a notice or disclosure "in a manner that is prohibited by federal law" (§ 6-1-1704(6)(c)). The notice can include "a brief statement indicating that a covered ADMT was used to materially influence the consequential decision and instructions for how the consumer may obtain any additional information or exercise any rights provided under this part 17" (§ 6-1-1704(6)(d)).

Insurers

In SB 26-189, § 6-1-1708(1) gives conditions for insurer compliance in the practice of insurance and makes § 6-1-1704(3) disclosures necessary "to the extent applicable" for insurers not deemed in compliance.

Rules on the disclosures

On or before January 1, 2027, the Attorney General must adopt rules "to clarify and implement the post-adverse outcome disclosure requirements" of § 6-1-1704(3) (§ 6-1-1704(4)(b)). As of October 2026, these rules are not adopted. See the rules of the Attorney General.

Financial assistance from a HIPAA covered entity

Section 6-1-1708(3)(d) of SB 26-189 gives a disclosure duty to a HIPAA covered entity, "notwithstanding subsection (3)(a)":

A covered entity that uses a covered ADMT to determine a patient's eligibility for financial assistance, including discounted care as described in section 25.5-3-502, shall provide a patient the following disclosures:

The four disclosures are:

• § 6-1-1708(3)(d)(I): "a plain language description of the consequential decision and the role of the covered ADMT in the consequential decision"
• § 6-1-1708(3)(d)(II): "the types of information about the individual the covered entity relied upon in making its determination of eligibility, except for trade secrets and other confidential or legally protected information"
• § 6-1-1708(3)(d)(III): "information on how to request correction of materially inaccurate personal data held by the covered entity consistent with" HIPAA "and section 25.5-3-502"
• § 6-1-1708(3)(d)(IV): "information on how to request meaningful human review or reconsideration, where applicable".

Section 6-1-1708(3)(e) gives the methods for these disclosures:

A covered entity may comply with subsection (3)(d) of this section through either an advance general disclosure of the information required by subsection (3)(d) of this section or through a notice provided within thirty calendar days after an adverse outcome. This section does not create a separate and duplicative disclosure process or appeal process if the review opportunities and information described in subsection (3)(d) of this section are provided.

This duty applies to the decision on eligibility for financial assistance. It applies to the covered entity, not to a business associate. For a health-care provider, it applies only on the location condition of § 6-1-1708(3)(b) (see Coverage and roles).

Consumer correction and meaningful human review — § 6-1-1705

Section 6-1-1705(1)(a) of SB 26-189 gives a consumer rights after an adverse outcome:

When a consumer experiences an adverse outcome resulting from a consequential decision in which a covered ADMT materially influences the consequential decision, the consumer may request and the deployer shall provide in response to the request:

• § 6-1-1705(1)(a)(I): instructions to request personal data, and to correct factually incorrect or materially inaccurate personal data, "used in a consequential decision that used a covered ADMT consistent with section 6-1-1306"
• § 6-1-1705(1)(a)(II): "an opportunity for meaningful human review and reconsideration of the consequential decision, to the extent commercially reasonable".

The deployer gives these items only after an adverse outcome and a request of the consumer. Item (I) is a duty to give instructions. The condition "to the extent commercially reasonable" applies to item (II) only. It does not apply to the instructions of item (I).

Section 6-1-1705(1)(b) gives this provision for the right to request correction:

For the purposes of this subsection (1), the exceptions to the definition of "consumer" in section 6-1-1303 (6)(b) and the exceptions in section 6-1-1304 (2)(k), (2)(n), and (2)(o) do not apply to the right to request correction of factually incorrect or materially inaccurate personal data pursuant to this subsection (1).

In § 6-1-1701(4)(b), the definition of "consumer" includes "an employee, a job applicant who is a Colorado resident", for all of part 17 (see Coverage and roles). Section 6-1-1705(1)(c) tells the deployer that § 6-1-1705(1)(a) does not make correction of opinions, predictions, scores, or protected evaluations necessary.

Meaningful human review

Section 6-1-1701(15) of SB 26-189 gives the definition of "meaningful human review":

“Meaningful human review” means review by a individual designated by the deployer who has authority to approve, modify, or override a consequential decision and who: (a) considers relevant, available primary evidence; (b) is trained to conduct the review; (c) does not default to the system output; and (d) has access to sufficient information to understand: (I) the output's: (A) intended use; (B) material limitations; and (C) categories of inputs; and (II) the principal factors used to generate the output, without requiring disclosure of proprietary source code, model weights, or other trade secrets.

The authority "to approve, modify, or override a consequential decision" is a condition of the definition. Thus, a person who can only recommend a decision does not do meaningful human review. Item (c) is also a condition of the definition. SB 26-189 does not tell a person who does meaningful human review how frequently to change a consequential decision. A developer must make available instructions for "meaningful human review, where applicable" (§ 6-1-1702(1)(d), see Developer duties). Modulos recommends that the deployer also keep a record of each human review, its result, and the primary evidence (see the steps in Modulos).

FERPA and HIPAA

Section 6-1-1705(2)(a) of SB 26-189 applies to a deployer "that is subject to FERPA", "for a consequential decision relating to education". That deployer "complies with the requirements of subsection (1) of this section through the deployer's existing student record inspection, review, and amendment procedures and any applicable district complaint or appeal process, if the deployer offers a reasonable mechanism for a parent, guardian, or eligible student to request correction of materially inaccurate personal data and reconsideration where applicable under this part 17".

Section 6-1-1705(2)(b) gives a different condition: "A deployer that is subject to FERPA is not required to establish a separate or duplicative correction or human review and reconsideration process if the deployer has established a correction or human review and reconsideration process to comply with FERPA."

Section 6-1-1708(5) also applies to the consumer rights of § 6-1-1705 (see Limits on the disclosures).

Rights that part 17 does not give

Part 17 gives no general right to appeal, other than the meaningful human review and reconsideration of § 6-1-1705(1)(a)(II). It gives no duty to tell the principal reasons for an adverse outcome, and no right to opt out (see Colorado SB 26-189).

Rules on the consumer rights

Section 6-1-1705(3) tells the Attorney General to adopt rules "to clarify and implement the requirements of this section" on or before January 1, 2027. As of October 2026, the Attorney General has not adopted these rules, which are proposed rules (see the rules of the Attorney General).

Deployer compliance records — § 6-1-1703

Section 6-1-1703 of SB 26-189 gives this duty to a deployer:

A deployer shall retain, for not less than three years after the date of a consequential decision or for a longer period if required by applicable state or federal law, records reasonably necessary to demonstrate compliance with this part 17. Records may include, as applicable, covered ADMT version identifiers, changelogs, and documentation of material mitigation changes.

The duty gives a period and the records to keep:

• The period. The period starts on the date of each consequential decision. It is a minimum ("not less than"). It can be "for a longer period if required by applicable state or federal law".
• The records. The deployer must keep the records "reasonably necessary to demonstrate compliance with this part 17". The records in § 6-1-1703 are only examples ("may include, as applicable").

Records that are "reasonably necessary" can include records of the notices, the disclosures, and each request for correction or human review. Section 6-1-1703 does not give these records as examples. Section 6-1-1707 does not tell a deployer to keep records.

The period of a developer starts "after the creation of a record" (§ 6-1-1702(4), see Developer duties). Section 6-1-1703 gives covered ADMT version identifiers as an example of records. Modulos recommends that the deployer record the version identifiers for each consequential decision, and how it configured and used the covered ADMT (see the steps in Modulos).

Liability and contract terms — § 6-1-1707

Section 6-1-1707 of SB 26-189 gives provisions on the liability of developers and deployers. Section 6-1-1707(1) to (4) gives these provisions:

• Liability (§ 6-1-1707(1)). A developer or deployer "may be held liable in an action alleging unlawful discrimination under state anti-discrimination laws", for example the Colorado Anti-Discrimination Act, "arising from a consequential decision materially influenced by a covered ADMT".
• Fault (§ 6-1-1707(2)). In that action, "fault shall be allocated among deployers and developers based on their relative fault for the violation".
• Claimant (§ 6-1-1707(3)). "Nothing in this section shall be construed to apportion liability to a claimant where such apportionment is not provided for under existing law."
• Joint and several liability (§ 6-1-1707(4)). "Nothing in this section shall be construed to create joint and several liability, except to the extent permitted under existing law."

Liability of the developer and of the deployer

Section 6-1-1707(5)(a) of SB 26-189 limits the liability of a developer in an action of § 6-1-1707(1). A developer is liable "only to the extent that" all of these conditions apply:

• "the developer's covered ADMT was used by a deployer in a manner that was intended, documented, marketed, advertised, configured, or contracted for by the developer" (§ 6-1-1707(5)(a)(I))
• "the developer's covered ADMT materially influenced a consequential decision that gave rise to the violation of existing law" (§ 6-1-1707(5)(a)(II)).

Section 6-1-1707 gives three more provisions:

• Other uses (§ 6-1-1707(5)(b)). "A developer is not liable under this section for violations of existing law arising from a deployer's use of a covered ADMT in a manner that was not intended, documented, marketed, advertised, configured, or contracted for by the developer."
• The deployer (§ 6-1-1707(6)). The section does not limit the liability of a deployer for "the deployer's independent acts or omissions in a consequential decision materially influenced by a covered ADMT, including using an ADMT in a manner that was not intended, documented, marketed, advertised, configured, or contracted for by the developer if the developer of the covered ADMT complied with section 6-1-1702".
• Other liability (§ 6-1-1707(8)). The section does not limit liability "separate and apart from liability under this section, for a violation of state law".

Contract terms

Section 6-1-1707(7)(a) of SB 26-189 makes some contract terms void:

Notwithstanding any other provision of law, if a provision of a contract for the use of automated decision-making technology in making a consequential decision or any other contract between a developer and deployer purports to indemnify, defend, or hold harmless or has the effect of indemnifying, defending, or holding harmless the indemnitee from or against any liability for damages pursuant to this section resulting from the developer's or deployer's own acts or omissions related to the use of automated decision-making technology in making consequential decisions in violation of the “Colorado Anti-Discrimination Act”, parts 3 to 8 of article 34 of title 24, or other Colorado anti-discrimination law, the provision is contrary to public policy and void.

Section 6-1-1707(7)(b) to (d) gives the limits of this provision:

• Developer (§ 6-1-1707(7)(b)). "The limitations of subsection (7)(a) of this section do not apply to a developer where the use of the covered ADMT in making a consequential decision was not intended, documented, marketed, advertised, configured, or contracted for by the developer if the developer of the covered ADMT complied with section 6-1-1702."
• Other contract terms (§ 6-1-1707(7)(c)). Subsection (7) "does not otherwise limit the enforceability of contract terms between parties acting in a commercial or business capacity, except to the extent otherwise provided by applicable law".
• Insurance (§ 6-1-1707(7)(d)). Subsection (7) "does not prohibit or limit any person from obtaining or making a claim on applicable insurance for any applicable alleged liabilities or related losses".

Compliance is not a defense

Section 6-1-1707(8) of SB 26-189 gives this limit: "Compliance with the requirements of this part 17 is not a defense to and does not otherwise excuse noncompliance with any applicable law." Section 6-1-1709(2) gives the same limit for compliance with part 17 (see Colorado SB 26-189). Section 6-1-1707(9) is about the use of an ADMT: "The use of an ADMT in a consequential decision does not excuse, justify, or provide a defense to any obligation or liability under state or federal law, including obligations and liability related to discrimination or consumer protection."

But § 6-1-1707(6) and (7)(b) give an effect to the compliance of a developer with § 6-1-1702. SB 26-189 does not tell a person to examine contracts against § 6-1-1707(7). It also does not tell a person to keep records of the uses that the developer intended, documented, marketed, advertised, configured, or contracted for. Modulos recommends these steps (see the steps in Modulos).

The four deployer duties side by side

SB 26-189 gives these four duties to a deployer:

	Notice before use (§ 6-1-1704(1) and (2))	Disclosures after an adverse outcome (§ 6-1-1704(3))	Correction and human review (§ 6-1-1705(1))	Records (§ 6-1-1703)
Start	The deployer uses a covered ADMT to materially influence a consequential decision	The deployer uses a covered ADMT to materially influence a consequential decision that results in an adverse outcome for a consumer	A covered ADMT materially influences a consequential decision that results in an adverse outcome for a consumer, and the consumer makes a request	Each consequential decision
Time	"Prior to" the use	"within thirty days after making the decision"	"in response to the request"	"for not less than three years after the date of a consequential decision or for a longer period if required by applicable state or federal law"
Contents	A clear and conspicuous notice of the use, and "instructions regarding how the consumer may obtain the additional information described in this section"	The three items of § 6-1-1704(3)	Instructions to request and to correct personal data, and meaningful human review "to the extent commercially reasonable"	Records "reasonably necessary to demonstrate compliance with this part 17"
Other provisions	Prominent public notice: § 6-1-1704(2). Creditors: § 6-1-1704(6). Accessibility: § 6-1-1704(8). FERPA: § 6-1-1704(9). The § 6-1-1708(3)(c) notice is a different duty, not a method to comply.	Rules: § 6-1-1704(4)(b). Trade secrets: § 6-1-1704(5). Creditors: § 6-1-1704(6). Federal law: § 6-1-1704(7). FERPA: § 6-1-1704(9). Insurers: § 6-1-1708(1)(b). Covered entities: § 6-1-1708(3)(d) and (e). HIPAA: § 6-1-1708(5). Gramm-Leach-Bliley Act: § 6-1-1708(6).	Correction: § 6-1-1705(1)(b) and (c). FERPA: § 6-1-1705(2). Rules: § 6-1-1705(3). HIPAA: § 6-1-1708(5).	Insurers: § 6-1-1708(1)(a). Covered entities: § 6-1-1708(3)(a). Medical devices: § 6-1-1708(4).

Section 6-1-1708(1)(a), (3)(a), and (4) apply to all four duties, not only to the records, on their conditions (see Coverage and roles).

Deployer duties in Modulos

For SB 26-189, Modulos gives deployer duties in MFF-28 Requirements MRF-485 to MRF-488 and related organization work in OFF-28 Requirements ORF-483 to ORF-486 (see The Requirements).

Where to go next

• Developer duties — the documentation that a developer makes available to each deployer, and its notices of changes.
• Coverage and roles — the tests for a covered ADMT, and the provisions for insurers, HIPAA covered entities, and a medical device.
• Modulos Frameworks for SB 26-189 — the two Frameworks, the Requirements, and the steps in Modulos.

Disclaimer

This information is general. It is not legal advice. As of October 2026, the Attorney General rules that §§ 6-1-1704(4)(b) and 6-1-1705(3) make necessary are only proposed rules. In § 6-1-1709(2), compliance with part 17 "does not constitute a defense to and does not excuse noncompliance with any applicable law". Always compare this information with the enrolled act of SB 26-189, and get legal advice.