On May 5, 2026, the Colorado Senate subcommittee on Business, Labor, and Technology began consideration of Colorado Senate Bill 26-189, which would repeal and reenact Part 17 of Article 1 of Title 6, replacing the consumer protections originally enacted under SB 24-205 (the “Colorado AI Act,” or “CAIA”) with a restructured regulatory framework governing automated decision-making technology (ADMT). SB was introduced on May 1, with the Colorado legislative regular session set to close on May 13, 2026; bill sponsors have expressed confidence that they can get it passed by then.

Testimony during the session in support of SB 189 emphasized the six months, hundreds of hours, and rare group of stakeholders that went into the CAIA rewrite under Governor Polis’s working group. Supporters of the bill emphasized the compromise that makes up the bill and warned the subcommittee that significant amendments to the bill as introduced would undermine that work. Those in support of amending the bill criticized the cure period that SB 189 affords developers and deployers until 2030, sought broader transparency measures in disclosures, and suggested that a private right of action would be necessary given the Attorney General’s office’s limited resources (which the bill does not currently contain). 

SB 189 passed out of the subcommittee unanimously and now heads to appropriations before going to the Senate floor.

Overview of SB 189, as introduced

SB 189 regulates “covered ADMT,” (technology that processes personal data using computation to generate predictions, scores, rankings, classifications, or similar outputs) when such technology materially influences a consequential decision about a consumer. Consequential decisions are those affecting access to, eligibility for, or compensation in “covered domains”: employment, education, financial services, insurance, healthcare, residential real estate, and essential government services.

The statute excludes advertising, content moderation, cybersecurity, fraud prevention, AML/CTF compliance, routine clerical tasks, and tools used solely to summarize or organize information for human review. It also excludes consumer-facing LLMs provided they are not marketed or contracted as intended for consequential decision-making and are accompanied by an acceptable use policy. 

“Materially influence” is defined as a “non-de minimis factor” used in a consequential decision, including by constraining, ranking, scoring, recommending, classifying, or otherwise meaningfully altering how a consequential decision is made. It explicitly excludes incidental, trivial, or clerical uses of ADMT output, with further clarification deferred to Attorney General rulemaking.

Developer responsibilities

A "developer" is an entity doing business in Colorado that develops, sells, licenses, or substantially modifies a covered ADMT. If enacted, beginning January 1, 2027, developers must:

• Provide deployers with documentation covering intended uses, known harmful uses, training data categories, limitations, risks, monitoring instructions, and information necessary for deployer compliance.
• Notify deployers of material updates, intentional modifications, and changes to intended use or risk mitigation within a reasonable time.
• Retain compliance records (including version identifiers, changelogs, and material update documentation) for at least three years.

These obligations apply only where the ADMT was marketed, configured, contracted, or licensed for use in consequential decisions, or where the developer becomes aware of such use consistent with intended purposes.

Deployer responsibilities

A "deployer" is an entity doing business in Colorado that deploys a covered ADMT. Deployer obligations are consumer-facing and include:

• Pre-decision notice. Clear and conspicuous disclosure that ADMT is or will be used, provided before the consequential decision occurs.
• Post-adverse outcome disclosure (within 30 days). A plain-language description of the decision, the ADMT's role, instructions for requesting additional information, and an explanation of consumer rights.
• Consumer rights upon request. A process for correcting factually inaccurate personal data and an opportunity for meaningful human review and reconsideration, to the extent commercially reasonable.
• Record retention. Compliance records to be maintained for at least three years after the consequential decision.

"Meaningful human review" requires a trained individual with authority to approve, modify, or override the decision, who does not default to the system's output and has access to information about the system's intended use and limitations.

Attorney General's powers

• Exclusive enforcement. Violations are deemed deceptive trade practices under the Colorado Consumer Protection Act, enforceable solely by the Attorney General. There is currently no private right of action.
• Cure period. A 60-day cure opportunity must precede enforcement unless the violation was knowing or repeated.
• Rulemaking. The AG must adopt rules by January 1, 2027, clarifying disclosure requirements, consumer rights provisions, and the definition of “materially influence,” including presumptions and illustrative examples. Stakeholder engagement through public comment and hearings is required.
• Reporting. Beginning January 2028 (sunsetting January 2030), the AG must report on enforcement actions, cure periods offered, and violations where cure was not deemed possible.