Colorado ADMT Law Effective Date: January 1, 2027 (SB 26-189)
Colorado's original AI Act (SB 24-205) was repealed before it took effect. Its replacement, SB 26-189 — a narrower law covering "automated decision-making technology" (ADMT) — takes effect January 1, 2027. It applies when ADMT "materially influences" a "consequential decision" about a Colorado resident in employment, credit, education, healthcare, or housing. Unlike the repealed law, SB 26-189 does not require impact assessments — obligations are pre-use notice, a 30-day plain-language disclosure after an adverse consequential decision, and 3-year recordkeeping.
Timeline
Original Colorado AI Act (SB 24-205) signed into law
May 17, 2024
SB 24-205 repealed and replaced by SB 26-189 (ADMT law), signed by Gov. Polis
May 14, 2026
TODAY
September 9, 2026
SB 26-189 takes effect — notice, disclosure, and recordkeeping duties begin
January 1, 2027
First 30-day adverse-outcome disclosures come due for decisions made on/after Jan 1
January 31, 2027
SB 26-189 is enforced exclusively by the Colorado Attorney General under the Colorado Consumer Protection Act — there is no private right of action. Maximum civil penalty is $20,000 per violation (C.R.S. § 6-1-112(1)(a)). The AG must issue a notice of violation and an opportunity to cure before enforcing, where the AG deems the violation curable. Businesses that do not post the required pre-use ADMT notice, do not provide the 30-day adverse-outcome disclosure, or do not retain compliance records face enforcement action.
Businesses doing business in Colorado that use a covered ADMT — technology that processes personal data and uses computation to materially influence a "consequential decision" about a Colorado resident's access to, eligibility for, or terms of employment, credit/lending, education, healthcare/insurance, or housing/public accommodation — even if they did not build the tool themselves. Developers who build, modify, or substantially modify covered ADMT have a separate disclosure duty to their deployer customers.
What to do right now
Inventory every ADMT that processes personal data and produces scores, rankings, recommendations, or classifications used in consequential decisions about Colorado residents
Confirm whether each tool "materially influences" a consequential decision — not every AI-assisted process is in scope
Publish a prominent pre-use ADMT notice at points of consumer interaction (e.g., near the application or transaction)
Build the 30-day adverse-outcome disclosure process: plain-language decision description, ADMT name/version/developer, and data-category summary
Set up a compliance-record retention process — records must be kept at least 3 years after each consequential decision
If you sell or license ADMT to others: prepare the developer-side disclosure of training data categories and known limitations