Bill
SB 189
Colorado requires documentation, notices, data rights, and human review for automated decision-making in key life outcomes, with AG enforcement and cure periods.
SB 189 (2026A) — Automated Decision-Making Technology in Consequential Decisions
Colorado
Overview
- Purpose: To regulate the use of automated decision-making technology (ADMT) in consequential decisions that affect a person’s access, eligibility, or compensation for education, employment, housing, financial or lending services, insurance, health care, or essential government services. Builds on 2024 reforms governing consumer protections around AI by imposing transparency, data rights, human review, and enforcement requirements for ADMTs that materially influence outcomes.
Key Definitions
- ADMT: Technology that processes personal data to produce outputs (predictions, recommendations, classifications, rankings, scores, etc.) used to guide or assist a decision concerning an individual.
- Consequential Decision: Decisions affecting a consumer’s access, eligibility, or terms in covered domains (education, employment, housing, finance, insurance, health care, essential government services). Notably excludes many low-stakes, routine, or purely advertising/product-recommendation activities.
- Covered ADMT: An ADMT that materially influences a consequential decision.
- Deployers: Entities deploying a covered ADMT in Colorado.
- Developers: Entities that develop, offer, contract, or substantially modify a covered ADMT.
Main Provisions and Requirements
1) Documentation and Updates (Effective Jan 1, 2027)
- Developers must provide deployers with technical documentation describing:
- Intended uses
- Training data categories
- Known limitations
- Instructions for appropriate use and human review
- Developers must notify deployers of material updates or modifications.
- Both parties must retain records to demonstrate compliance for at least 3 years.
2) Consumer Notices and Rights
- Deployers must give clear, conspicuous notices to consumers at the point of interaction with a covered ADMT.
- Within 30 days after a consequential decision causes an adverse outcome, deployers must provide a plain-language description of the ADMT’s role and information on rights and how to obtain additional details.
- The Attorney General will issue rules clarifying post-adverse outcome disclosures by Jan 1, 2027.
3) Data Access and Correction; Human Review
- Consumers may request personal data used by a covered ADMT and correction of factually incorrect data.
- Consumers may request meaningful human review and reconsideration after an adverse outcome, to the extent commercially reasonable.
4) Enforcement and Remedies
- The Colorado Attorney General enforces this act through the Colorado Consumer Protection Act.
- Violations are treated as deceptive trade practices.
- A 60-day cure period is required before the AG may sue (if a cure is possible).
- No new private right of action; fault can be allocated between developers and deployers in discrimination cases under existing law.
- Rulemaking authority and stakeholder engagement are provided to implement and clarify provisions.
- Annual reporting requirement starting Jan 2028 detailing enforcement actions, cure periods, and violations.
5) Exemptions and Special Provisions
- Some entities may be exempt if they comply with other legal obligations.
- Provisions related to FERPA for educational institutions, health care privacy (HIPAA/HITECH context), and insurance are tailored to avoid duplicative or conflicting disclosures.
- Certain technologies are exempt from ADMT classification (e.g., basic tools, simple summarization for human review, cybersecurity, anti-fraud controls) unless used to materially influence a consequential decision.
Affected Parties
- Developers and deployers of covered ADMTs in Colorado.
- Consumers in Colorado who are subject to consequential decisions.
- State AG, which enforces through the Colorado Consumer Protection Act.
- Insurance entities, health care providers, educational institutions, and financial services providers that deploy ADMTs (with sector-specific rules and exceptions).
Timeline and Effective Dates
- January 1, 2027: Start of mandatory documentation, updates, and disclosures for covered ADMTs; rules to clarify post-adverse outcome disclosures to be adopted by the AG.
- January 1, 2027: General deployments triggering disclosure and human-review rights become relevant; record-keeping requirements apply.
- 2028 and annually thereafter: AG to report enforcement data related to cure periods and violations.
Applicability
- Applies to consequential decisions made on or after the act’s effective date.
- Includes alignment with existing consumer protection and anti-discrimination laws; preserves existing rights and remedies.
Bottom line
SB 189 aims to increase transparency, accountability, and consumer recourse when automated decision-making tools materially affect important life outcomes in Colorado, while preserving sector-specific considerations, privacy protections, and existing legal rights. It creates a framework for documentation, consumer notice, data correction rights, and meaningful human review, with a state-level enforcement mechanism through the AG and a cure-based enforcement approach.
Compiled from official sources — confirm details with the bill’s official record.
Sign in to ask a question.
