Docs

Appearance

Frequently asked questions about Colorado SB 26-189 ​

Each entry below gives a link to the section with the full provisions.

Disclaimer

This page gives general information. It is not legal advice.

What is Colorado SB 26-189? ​

Colorado Senate Bill 26-189 repeals and reenacts part 17 of article 1 of title 6 of the Colorado Revised Statutes. Part 17 is about automated decision-making technology (ADMT) used to materially influence consequential decisions. The Governor signed SB 26-189 on May 14, 2026.

SB 26-189 replaces SB 24-205 and takes effect January 1, 2027, for consequential decisions made on or after that date. Section 5(2) provisions took effect upon passage. The names Colorado AI Act and CAIA refer to SB 24-205, which added part 17 in 2024. See the other Colorado acts.

Is the Colorado AI Act (SB 24-205) still in force? ​

SB 25B-004 changed the dates of the SB 24-205 duties from February 1, 2026 to June 30, 2026. SB 26-189 repeals and reenacts part 17 from January 1, 2027, but the Section 5(2) provisions took effect upon passage. For the period from June 30, 2026 to January 1, 2027, get legal advice. The SB 24-205 duties are not duties of part 17 as SB 26-189 reenacts it. See the other acts and duties that SB 26-189 does not give.

As of October 2026, the court order of April 27, 2026 tells the Attorney General not to start enforcement, investigations included, for alleged violations of “SB24-205 (or any legislation replacing or amending SB24-205 enacted during this legislative session)”. The court order applies to violations on or before 14 days after the court rules on the xAI motion for a preliminary injunction (¶ 1). The time for that motion is “within 28 days after final adoption of rulemaking implementing SB24-205 or any legislation that may replace or amend SB24-205” (¶ 2). The court order does not change SB 24-205, SB 26-189, or their dates.

Who is covered by SB 26-189? ​

SB 26-189 gives duties to developers and deployers of covered ADMT, each a person doing business in Colorado (§ 6-1-1701(7) and (8)). These definitions, exclusions, and provisions for other legal obligations change who has duties:

  • Covered ADMT: ADMT used to materially influence a consequential decision (§ 6-1-1701(5)). The definition of materially influence has two conditions that must apply together and an exclusion (§ 6-1-1701(13)).
  • ADMT exclusions: specified technologies, tools for human review, and technology for consumers, each on its conditions (§ 6-1-1701(2)(b)).
  • Consequential decisions: two alternative definitions, nine exclusions, and seven covered domains (§ 6-1-1701(3) and (6)).
  • Consumers: an employee and "a job applicant who is a Colorado resident" are included (§ 6-1-1701(4)).
  • Developers: an intentional and substantial modification can give this role, exclusions apply, and a developer can also be a deployer (§ 6-1-1701(8)).
  • Insurers: compliance on conditions, notice and disclosure, and an employment exception (§ 6-1-1708(1) and (2)).
  • HIPAA covered entities and business associates: exclusions on conditions, with an employment exception and a location condition for a health-care provider (§ 6-1-1708(3)(a) and (b)). Covered entities have patient notice and financial assistance duties, with the same location condition (§ 6-1-1708(3)(c) to (e)).
  • Medical devices and research and development: §§ 6-1-1701 to 6-1-1706 do not apply to a medical device with FDA oversight, or to “a pharmaceutical or medical device manufacturer's research and development activities” with FDA oversight (§ 6-1-1708(4)).

What must a deployer do under SB 26-189? ​

A deployer of covered ADMT has notice, disclosure, consumer rights, and record duties in SB 26-189:

  • Notice before use: before use to materially influence a consequential decision, with a prominent public notice alternative on conditions (§ 6-1-1704(1) and (2)).
  • Disclosures after an adverse outcome: not more than 30 days after the deployer makes the decision (§ 6-1-1704(3)). Item (3)(b) has a condition on information from the developer.
  • Consumer requests after an adverse outcome: on request, instructions to request personal data and to correct factually incorrect or materially inaccurate personal data “used in a consequential decision that used a covered ADMT consistent with section 6-1-1306” (§ 6-1-1705(1)(a)(I)). On request, the deployer also gives “an opportunity for meaningful human review and reconsideration of the consequential decision, to the extent commercially reasonable” (§ 6-1-1705(1)(a)(II)). Some exceptions in §§ 6-1-1303 and 6-1-1304 do not apply to correction requests, and the deployer has no duty to correct opinions, predictions, scores, or protected evaluations (§ 6-1-1705(1)(b) and (c)).
  • Compliance records: not less than three years after each consequential decision, or more if applicable state or federal law makes it necessary (§ 6-1-1703).

These SB 26-189 provisions change deployer duties:

  • Accessibility: a deployer or developer must give the notices and disclosures of part 17 “in a manner that is reasonably accessible to consumers with disabilities and consumers with limited English proficiency, consistent with applicable state and federal law” (§ 6-1-1704(8)).
  • Trade secrets and limits on the disclosures: a deployer that withholds information because of § 6-1-1704(5) must notify the consumer. Federal law and other provisions also limit the disclosures (§ 6-1-1704(7), § 6-1-1708(5) and (6)).
  • Methods to comply, with conditions, for creditors (§ 6-1-1704(6)) and FERPA notices and consumer requests (§ 6-1-1704(9), § 6-1-1705(2)).
  • Insurer and HIPAA provisions, with employment and location conditions and different patient duties for covered entities (§ 6-1-1708(1) to (3)).

As of October 2026, the Attorney General disclosure and consumer rights rules are proposed rules only.

What must a developer do under SB 26-189? ​

From January 1, 2027, SB 26-189 gives developers documentation, notice, and record duties (§ 6-1-1702):

  • Documentation for each deployer: five items, with conditions on "form and manner", "trade secrets or information protected from disclosure by state or federal law", and notice if information is withheld (§ 6-1-1702(1)).
  • Notices of changes: three types of change, “within a reasonable time”, with direct notice for public release notes (§ 6-1-1702(2)).
  • Compliance records: not less than three years after a record is made, or more if applicable state or federal law makes it necessary (§ 6-1-1702(4)).

Section 6-1-1702(5) conditions all duties. Section 6-1-1702(3) limits only documentation and change notices to specified uses. The accessibility duty also applies to developers (§ 6-1-1704(8)).

How is SB 26-189 enforced? ​

The Colorado Attorney General enforces SB 26-189 through the Colorado Consumer Protection Act. A part 17 violation is a deceptive trade practice (§ 6-1-1706(1) and (2)). Only the Attorney General enforces violations of the disclosure requirements and consumer rights in §§ 6-1-1702 to 6-1-1705. Part 17 gives no new private right of action and keeps "existing rights or remedies" (§ 6-1-1706(4)).

These provisions and the court order can also apply (see Enforcement and civil penalties):

  • A notice of violation, “if a cure is deemed possible by the attorney general”, and a cure “within sixty days after receipt of a notice of violation”, with an exception if the Attorney General "finds and can demonstrate" that a developer or deployer "knowingly violated" or "repeatedly violated" part 17 (§ 6-1-1706(3)(a) to (c)).
  • “If a violation is discovered in the course of an enforcement action”, a court "may consider" a cure “within sixty days after receipt of written notice” "as a mitigating factor in determining civil penalties or other monetary relief, if any" (§ 6-1-1706(3)(d)).
  • The repeal of subsection (3) on January 1, 2030 (§ 6-1-1706(3)(f)).
  • As of October 2026, the court order of April 27, 2026 tells the Attorney General not to start enforcement, investigations included, for alleged violations of “SB24-205 (or any legislation replacing or amending SB24-205 enacted during this legislative session)” (¶ 1). The court order applies to violations that “occurred or may occur” on or before 14 days after the court rules on the xAI motion for a preliminary injunction (¶ 1). The time for that motion is “within 28 days after final adoption of rulemaking implementing SB24-205 or any legislation that may replace or amend SB24-205” (¶ 2).

How does Modulos model Colorado SB 26-189? ​

Modulos gives two Frameworks with the name Colorado SB 26-189: MFF-28 for one covered ADMT's AI System, and OFF-28 for the organization AI System. Requirement ADMT Role tags identify Developer, Deployer, or Developer and Deployer. They do not show HIPAA covered entity and insurer duties in § 6-1-1708. Examine those where they apply.

Modulos changes the Frameworks when the Attorney General adopts the rules of §§ 6-1-1704(4)(b) and 6-1-1705(3). See The Requirements, Steps that Modulos recommends, and Control overlap.

When does Colorado SB 26-189 take effect? ​

SB 26-189 takes effect January 1, 2027, for consequential decisions made on or after that date (Section 5(1) and (3)). Section 5(2) provisions took effect upon passage: §§ 6-1-1704(4), 6-1-1705(3), and 6-1-1706(6), § 10-3-1104.9(3)(e), and Sections 4, 5, and 6.

The Attorney General must adopt §§ 6-1-1704(3) and 6-1-1705 rules “on or before January 1, 2027”. As of October 2026, these are proposed rules only. Enforcement reports start each January from 2028. Section 6-1-1706(3), with cure provisions and the report duty, is repealed January 1, 2030. See When SB 26-189 applies.

What are the penalties under Colorado SB 26-189? ​

SB 26-189 does not give the value of a civil penalty. A violation of part 17 is a deceptive trade practice in the Colorado Consumer Protection Act (§ 6-1-1706(2)). The Legislative Council Staff fiscal note gives this information on that act: “a person committing a deceptive trade practice may be subject to a civil penalty of up to $20,000 for each violation”.

“If a violation is discovered in the course of an enforcement action”, a court "may consider" a cure “within sixty days after receipt of written notice” "as a mitigating factor in determining civil penalties or other monetary relief, if any" (§ 6-1-1706(3)(d)). The notice of violation and the cure period are in § 6-1-1706(3)(a) and (b). In § 6-1-1706(3)(c), the Attorney General "is not required to provide a cure period" if it "finds and can demonstrate" that a developer or deployer "knowingly violated" or "repeatedly violated" part 17. Subsection (3) is "repealed, effective January 1, 2030" (§ 6-1-1706(3)(f)).

As of October 2026, the court order of April 27, 2026 tells the Attorney General not to start enforcement, investigations included, for alleged violations of “SB24-205 (or any legislation replacing or amending SB24-205 enacted during this legislative session)” (¶ 1). The court order applies to violations that “occurred or may occur” on or before 14 days after the court rules on the xAI motion for a preliminary injunction (¶ 1). The time for that motion is “within 28 days after final adoption of rulemaking implementing SB24-205 or any legislation that may replace or amend SB24-205” (¶ 2). See Enforcement and civil penalties.