Colorado SB 26-189 in Modulos

Modulos has two Frameworks for Colorado SB 26-189, and each has the name Colorado SB 26-189. You add MFF-28 to the AI System of one covered ADMT. You add OFF-28 to the organization AI System, at the Organization level.

In these steps, "you" is the developer, the deployer, or a person that is the developer and the deployer.

Organization AI Systems

Frameworks at the Organization level, such as OFF-28, attach to your organization AI System. If your organization does not have one, speak to Modulos before you add a Framework at the Organization level.

One AI System for each covered ADMT

Modulos recommends this structure for an organization that uses MFF-28 for Colorado SB 26-189. You can use a different structure.

• One AI System for each tool. Use one AI System with MFF-28 for each covered ADMT. In SB 26-189, the developer documentation, the notices, the disclosures, and the records are items for one covered ADMT.
• No scoping questionnaire. MFF-28 and OFF-28 have no scoping questionnaire. You record in MRF-482 if SB 26-189 applies to the tool, and in which role (step 1 below).
• One organization AI System. OFF-28 contains the items that your organization uses for all of its covered ADMTs. These items are the notices and disclosures, human review, records, liability and contract terms, and the rules to monitor.

The ADMT Role tag

In MFF-28 and OFF-28, each Requirement has one or two values of the ADMT Role tag: Developer, Deployer, or Developer and Deployer. Developer is the developer of Colorado SB 26-189 § 6-1-1701(8). Deployer is the deployer of § 6-1-1701(7).

In SB 26-189, one person can have the two roles for the same covered ADMT. For the effect of an intentional and substantial modification and the developer exclusions, see Developer and deployer. For the limits in § 6-1-1702(3) and (5), see When the section applies.

The ADMT Role tag does not show the duties of § 6-1-1708. For each tool, find if one of these duties applies to you:

• Notice to patients. In § 6-1-1708(3)(c), a covered entity must give patients a "general notice of use of advanced technologies, including a covered ADMT". This duty is part of MRF-485.
• Disclosures for financial assistance. In § 6-1-1708(3)(d), a covered entity that "uses a covered ADMT to determine a patient's eligibility for financial assistance" must give the patient four disclosures. § 6-1-1708(3)(e) gives two methods to comply. This duty is part of MRF-486.
• Insurer notice and disclosure. In § 6-1-1708(1)(b), an insurer that "is not deemed in compliance" in § 6-1-1708(1)(a) has a notice and disclosure duty. The duty is for its use of a covered ADMT to materially influence a consequential decision about the practice of insurance. The disclosure duties of § 6-1-1704(3) apply to this notice and disclosure "to the extent applicable". This duty is part of MRF-486.

For a covered entity that is a health-care provider, § 6-1-1708(3) applies only if the health-care provider is "operating from a location within Colorado" (§ 6-1-1708(3)(b)). For these provisions, see Compliance with other legal obligations.

The Requirements

MFF-28 and OFF-28 give Requirements for the groups of duties in Colorado SB 26-189. For the law of each Requirement, follow its link below.

MFF-28, at the AI System level:

Requirement	Provisions of SB 26-189	ADMT Role	Law
MRF-482 ADMT coverage and role determination	§ 6-1-1701(2)–(8) and (13), § 6-1-1702(5), § 6-1-1703, § 6-1-1708, Section 5	Developer, Deployer	Coverage and roles
MRF-483 Developer transparency package to deployers	§ 6-1-1702(1), (3), and (5)	Developer	Developer duties
MRF-484 Developer update notices and records	§ 6-1-1702(2)–(5), § 6-1-1701(12) and (14)	Developer	Developer duties
MRF-485 Pre-use notice at points of consumer interaction	§ 6-1-1704(1), (2), (8), and (9), § 6-1-1708(3)(a)–(c)	Deployer	Notice before use
MRF-486 Post-adverse-outcome and sectoral disclosures	§ 6-1-1704(3) and (5)–(9), § 6-1-1708(1)(b) and (3)(d)–(e)	Deployer	Disclosures after an adverse outcome
MRF-487 Consumer correction and meaningful human review	§ 6-1-1705, § 6-1-1701(15)	Deployer	Consumer correction and meaningful human review
MRF-488 Deployer compliance records and liability evidence	§ 6-1-1703, § 6-1-1707	Deployer	Deployer compliance records

For the duties of covered entities and insurers in MRF-485 and MRF-486, see the ADMT Role tag and § 6-1-1708 conditions.

OFF-28, at the Organization level:

Requirement	Provisions of SB 26-189	ADMT Role	Law
ORF-483 Consumer notice and disclosure infrastructure	§ 6-1-1704(1), (2), and (8)	Developer, Deployer	Notice before use
ORF-484 Meaningful-human-review capability	§ 6-1-1701(15), § 6-1-1705(1)(a)(II)	Deployer	Consumer correction and meaningful human review
ORF-485 Deployer records program	§ 6-1-1703	Deployer	Deployer compliance records
ORF-486 ADMT liability posture and contract hygiene	§ 6-1-1707, § 6-1-1709	Developer, Deployer	Liability and contract terms
ORF-487 Colorado rulemaking and codification watch	§ 6-1-1704(4)(b), § 6-1-1705(3), § 6-1-1706(3) and (5), § 10-3-1104.9(3)(e), the codification of part 17	Developer, Deployer	Colorado SB 26-189

For the Controls in MFF-28, OFF-28, and other Frameworks, see Control overlap.

Steps that Modulos recommends

Modulos recommends this sequence for a developer or deployer that uses MFF-28 and OFF-28 for Colorado SB 26-189. Some items in the steps are duties of the act. Each step gives a link for these duties. Other items are not duties. Each of these other items tells you that Modulos recommends it.

1. Find if SB 26-189 applies to each tool, and in which role (MRF-482). Apply the definitions in Coverage and roles.
   • Modulos recommends that you record the determination in MRF-482. The act does not tell you to make a record of this determination. But a deployer must keep it if it is "reasonably necessary to demonstrate compliance with this part 17" (§ 6-1-1703).
   • Modulos recommends that you do this step again after an intentional and substantial modification or a new deployment.
   • Modulos recommends that a developer does this step again when the § 6-1-1702(5) "becomes aware" condition applies. See When the section applies.
2. Prepare the notices, human review, and records of the organization (ORF-483 to ORF-485).
   • Apply the accessibility duty for developers and deployers (§ 6-1-1704(8)) to the notices and disclosures that part 17 makes necessary.
   • If you use the prominent public notice of § 6-1-1704(2), Modulos recommends a record of the points of consumer interaction.
   • Modulos recommends that you prepare persons for meaningful human review before the first consumer request.
   • § 6-1-1701(15) gives the conditions for these persons.
   • In § 6-1-1705(1)(a)(II), a deployer must give "an opportunity for meaningful human review and reconsideration of the consequential decision, to the extent commercially reasonable". It must give it only on request after an adverse outcome.
   • As a deployer, keep the records of § 6-1-1703. Modulos recommends one procedure for all of your covered ADMTs.
3. Examine your contracts (ORF-486). For the law, see Liability and contract terms.
   • Modulos recommends this check before you sign a contract: Examine contracts for ADMT use and contracts between a developer and deployer.
   • Find the provisions that § 6-1-1707(7)(a) makes void.
   • Modulos recommends a record of the uses that the developer intended, documented, marketed, advertised, configured, or contracted for.
   • Modulos recommends that you keep each deployment in those uses, or record each difference.
   • Subsection (7) "does not prohibit or limit any person from obtaining or making a claim on applicable insurance" (§ 6-1-1707(7)(d)).
4. Do the developer duties for each tool (MRF-483, MRF-484). If § 6-1-1702(5) applies, do these items:
   • Make the documentation of § 6-1-1702(1) available to each deployer.
   • Give each deployer the notices of § 6-1-1702(2) "within a reasonable time".
   • Apply the § 6-1-1702(3) limit to the documentation and notices. See When the section applies.
   • Keep the records of § 6-1-1702(4) for not less than three years "after the creation of a record", or "for a longer period if required by applicable state or federal law".
   • For these duties, see Developer duties.
5. Do the deployer duties for each tool (MRF-485 to MRF-488). For these duties, see Deployer duties and consumer rights.
   • Before you use the covered ADMT to materially influence a consequential decision, give the notice of § 6-1-1704(1).
   • As an alternative, keep a prominent public notice that is "reasonably accessible at points of consumer interaction" (§ 6-1-1704(2)).
   • After an adverse outcome, give the disclosures of § 6-1-1704(3) "within thirty days after making the decision".
   • Where they apply to you, apply the provisions for creditors, insurers, covered entities, and FERPA.
   • When a consumer makes a request after an adverse outcome, give the items of § 6-1-1705(1)(a).
   • Keep the records of § 6-1-1703 "for not less than three years after the date of a consequential decision or for a longer period if required by applicable state or federal law".
   • Version identifiers are an example of records in § 6-1-1703. Modulos recommends that you record them for each consequential decision.
   • Modulos recommends that you record how you configured and used the covered ADMT.
6. Monitor the rules and the codification (ORF-487). Use the next section.
   • When the Attorney General or the commissioner adopts a rule, compare your notices, disclosures, procedures, and determinations with the rule.
   • When the codification of part 17 is complete, do the same.
   • On January 1, 2030, § 6-1-1706(3) is repealed. From that date, its provisions on the notice of violation, the cure, and the reports do not apply.
   • For enforcement, see Enforcement and civil penalties.

For the Review procedure, see Reviews & Statuses.

Rules and codification to monitor

Colorado SB 26-189 gives rulemaking authority to the Attorney General and to the commissioner of insurance. Each item below can change a Requirement. This monitor task is part of ORF-487. It is not a duty of the act. Modulos recommends it, and changes the Frameworks when the Attorney General adopts the rules of § 6-1-1704(4)(b) and § 6-1-1705(3).

As of October 2026, there are proposed rules of the Attorney General in 4 CCR 904-6, with a public hearing on October 26, 2026. These proposed rules are not adopted.

Item	Provision	As of October 2026	Requirements that it can change	Law
Rules of the Attorney General on the disclosures after an adverse outcome	§ 6-1-1704(4)(b)	The Attorney General "shall adopt" these rules on or before January 1, 2027. Proposed rules, not adopted.	MRF-486, ORF-483	Colorado SB 26-189
Rules of the Attorney General on consumer rights	§ 6-1-1705(3)	The Attorney General "shall adopt" these rules on or before January 1, 2027. Proposed rules, not adopted.	MRF-487, ORF-484	Colorado SB 26-189
Rules of the Attorney General on materially influence	§ 6-1-1706(5)(b)	The Attorney General "may adopt" these rules, with no date. In the notice for 4 CCR 904-6, the Attorney General requests written comments on two alternative standards. These standards are not rules.	MRF-482	Colorado SB 26-189
Other rules of the Attorney General for part 17	§ 6-1-1706(5)(a)	The Attorney General "may adopt rules as necessary to implement and clarify this part 17", with no date.	The Requirements that a rule changes	Colorado SB 26-189
Rules of the commissioner of insurance on notice and disclosures from insurers	§ 10-3-1104.9(3)(e)	The commissioner "may adopt" these rules, with no date.	The insurer duty in MRF-486	Colorado SB 26-189
Codification of part 17	HB 26-1263 also adds a § 6-1-1708 to part 17	Not complete	Each section number	Colorado SB 26-189
Court order in X.AI LLC v. Weiser	Minute order of April 27, 2026	The court order applies to the Attorney General, who is the defendant. It limits when the Attorney General can start enforcement, an investigation included, for "alleged violations of SB24-205 (or any legislation replacing or amending SB24-205 enacted during this legislative session)".	None	Colorado SB 26-189

Items with no Control in the Framework

For Colorado SB 26-189, MFF-28 and OFF-28 have no Control for these items.

• No Control for the duties of SB 24-205. SB 26-189 repeals and reenacts part 17, which SB 24-205 made. The duties of SB 24-205 are not duties of part 17 as SB 26-189 reenacts it. For these duties, see Duties that part 17 does not give.
• No Control for HB 26-1263. HB 26-1263 gives duties to an operator of a conversational artificial intelligence service. It is a different act. See the section on HB 26-1263 in Colorado SB 26-189.
• No Control for the insurance provisions of § 10-3-1104.9. For insurers, the two Frameworks hold the items of § 6-1-1708(1): the compliance of an insurer "in the practice of insurance", and the notice and disclosure of § 6-1-1708(1)(b). ORF-487 only monitors the rules that the commissioner of insurance "may adopt" (§ 10-3-1104.9(3)(e)) (see Rules and codification to monitor).
• No Control for the proposed rules. As of October 2026, the proposed rules of the Attorney General in 4 CCR 904-6 are not adopted. ORF-487 only monitors this rulemaking (see Rules and codification to monitor).
• No presumption or defense for the use of the Frameworks. No provision of SB 26-189 gives a presumption or a defense to a person because that person uses a governance Framework. Also, § 6-1-1709(2) tells you that "compliance with this part 17 does not constitute a defense to and does not excuse noncompliance with any applicable law". See Duties that part 17 does not give.

Where to go next

Colorado SB 26-189 overview

The dates, SB 24-205 and HB 26-1263, enforcement, the proposed rules, and the court order

Coverage and roles

The ADMT definition, materially influence, the seven covered domains, the consumer, and the two roles

Developer duties

The documentation for each deployer, the notices of material updates, and the developer records

Deployer duties and consumer rights

The notice before use, the disclosures after an adverse outcome, correction, human review, records, and liability

Control overlap

The Controls in the two Colorado Frameworks and in other Frameworks

Disclaimer

This information is general. It is not "legal advice".

The section numbers follow the enrolled act of SB 26-189. As of October 2026, the codification of part 17 is not complete, because HB 26-1263 also adds a § 6-1-1708. As of October 2026, the rules that the Attorney General must adopt are proposed rules and are not adopted. Compare this information with the act and the rules at the time of your decision. Get legal advice.