This post is not legal advice. Check your own situation with a lawyer. What it covers is the practical work inside your apps and processes, which takes longer than most teams expect.
What changed in Colorado
Colorado passed an AI law in 2024 (SB 24-205). In May 2026 the state replaced it with Senate Bill 26-189, the Automated Decision-Making Technology Act, approved on 14 May 2026. It takes effect on 1 January 2027 and applies to consequential decisions made on or after that date.
The Attorney General must adopt rules before 1 January 2027. Proposed rules were filed on 11 August 2026, an interim draft followed on 6 October 2026, and a public hearing was held on 26 October 2026. The final rules were not published when we wrote this, so details may still shift.
Does it apply to you?
The law covers "automated decision-making technology" used to materially influence a consequential decision about a person. Consequential decisions are in these areas:
- Education enrollment or opportunity
- Employment, including hiring
- Buying or leasing a home in Colorado
- Financial or lending services
- Insurance
- Health care services
- Essential government services and public benefits
A "consumer" includes employees and job applicants who live in Colorado.
The law also lists what is not a consequential decision. Routine scheduling, customer service triage, workflow routing, advertising, marketing, product recommendations and search are excluded. So is a tool that only summarizes or organizes information for a person to review, as long as it does not produce a score, ranking, recommendation or prediction that materially influences the outcome.
In short, an AI chatbot that answers order questions is likely out. An AI tool that ranks job applicants or scores loan requests is likely in.
What a deployer has to do
If you use such a tool, the law calls you a deployer. Your main duties are:
- Notice before use. Give a clear notice that the tool is or will be used in the decision, with instructions on how to get more information. A prominent public notice near the point where the decision happens can satisfy this.
- Explanation after a negative result. Within 30 days of an adverse outcome, provide a plain language description of the decision and the tool's role, a simple way to ask for more detail about the tool and the data it used, and an explanation of the person's rights.
- Correction and human review. If the person asks, give them a way to correct inaccurate personal data and a chance for meaningful human review and reconsideration, to the extent commercially reasonable. The reviewer must have authority to change the decision and must not simply default to the system's output.
- Records for three years. Keep records that show compliance for at least three years after each decision, such as tool version numbers and change logs.
The Attorney General enforces the law. There is no private right of action, and in many cases the Attorney General must first give you 60 days to fix a violation.
A practical checklist for the next seven weeks
- List every AI tool. Include features inside your HR, lending, CRM or ticketing software, not only standalone AI products.
- Flag the ones that touch decisions about people in the areas above. For each, write down what it produces: a score, a ranking, a yes or no.
- Ask vendors for documentation. Developers must give deployers information on intended uses, known limits and how to do human review. Ask now, not in December.
- Add the notice to the right screen. Job application forms, loan or credit forms and onboarding flows are the usual places.
- Build the adverse outcome step. Decide who sends the explanation, from which template, and how a request for review comes back in.
- Name and train reviewers. Give them access to the inputs and the reasons behind the output.
- Turn on logging. Store the decision, tool version, inputs used and any human override, with a three year retention setting.
Our checklist for connecting AI to business systems covers access, logging and approval steps in more detail, and our guide to AI automation for SME operations helps you decide where AI belongs in the first place.
Common mistakes
- Assuming the law only applies to Colorado companies. It applies to anyone doing business in Colorado.
- Treating a "human in the loop" who always clicks approve as meaningful review.
- Keeping the notice in a privacy policy nobody sees.
- Waiting for the final rules before starting. The statute is already fixed.
Where Ascent24 fits
Ascent24 builds and integrates business software. We can add the notice screens, adverse outcome emails, review queues and decision logs to your existing apps and AI integrations. We do not give legal advice, so pair this work with your lawyer's review. Write to info@ascent24.io to talk it through.
FAQs
When does the Colorado ADMT Act take effect?
On 1 January 2027. It applies to consequential decisions made on or after that date.
Does it apply to a business based outside Colorado?
It applies to a person doing business in Colorado that uses a covered tool. Job applicants who are Colorado residents and employees are included as consumers.
Is a customer service chatbot covered?
Usually not. The law excludes customer service triage, routine scheduling, marketing and recommendations, as long as they do not materially influence a decision in a covered area.
Are the Attorney General's rules final?
Not yet. Proposed rules were filed on 11 August 2026, an interim draft was released on 6 October 2026, and the hearing took place on 26 October 2026. The law requires rules before 1 January 2027.
How long must records be kept?
At least three years after the date of each consequential decision, or longer if another law requires it.
Sources
- Colorado Attorney General, Automated Decision-Making Technology and Chatbot Safety Rulemaking: https://coag.gov/ai/
- Colorado General Assembly, Senate Bill 26-189, Session Laws Chapter 131 (approved 14 May 2026): https://www.leg.colorado.gov/laws/session-laws/SB26-189/131/download
