Colorado ADMT Act (SB 26-189)

What changed

In May 2026, Colorado repealed SB 24-205, the "high-risk AI systems" law everyone spent 2025 preparing for, before it ever took effect. Its replacement, SB 26-189 (the ADMT Act, C.R.S. 6-1-1701 to 6-1-1709), is a different kind of law: the duty of reasonable care, mandatory risk-management programs, and impact assessments are gone. What remains is transparency and disclosure around automated decision-making technology (ADMT) used in consequential decisions. If your compliance notes still reference "high-risk AI systems" and Colorado, they describe a repealed statute.

Does it apply to you?

The law covers ADMT, meaning technology that processes personal data and generates predictions, scores, rankings, or classifications that materially influence a consequential decision, across seven domains: education, employment, residential real estate (lease or purchase), financial or lending services, insurance, health care, and essential government services. Two roles carry duties: developers (you build or sell ADMT used in those decisions) and deployers (you use it while doing business in Colorado, including for hiring).

A notable exclusion for indie AI products: a chatbot or informational AI tool is not ADMT if it isn't intended or marketed for consequential decisions and its acceptable-use policy prohibits using its output in one. If you ship an AI assistant, that AUP clause is the cheapest compliance move in this entire law.

There is no size-based exemption. The 2024 law's small-deployer carve-out did not survive. The exemptions that exist are entity-type only: HIPAA covered entities (except for employment decisions), FDA-regulated devices, insurers under Colorado's existing AI insurance rules, and lenders whose federal ECOA/FCRA adverse-action notices already satisfy the disclosure duties.

What you must do

Developers (by January 1, 2027): give each deployer plain-language documentation covering intended and known harmful uses, categories of training data, known limitations, and instructions for appropriate use and meaningful human review, plus notice of material updates. Keep records three years.

Deployers: clear and conspicuous notice to consumers before ADMT materially influences a decision about them. The statute lets a prominent public notice or link, placed reasonably proximate to the interaction, carry this duty; a well-placed website notice can do the work. After an adverse outcome: a plain-language explanation within 30 days, instructions for requesting details, correction rights for inaccurate personal data, and meaningful human review where commercially reasonable. Keep records three years.

Penalties

Exclusive enforcement by the Colorado Attorney General under the Consumer Protection Act; violations are deceptive trade practices with civil penalties up to $20,000 per violation. A 60-day notice-and-cure period applies where the AG deems cure possible, is waivable for knowing or repeated violations, and sunsets January 1, 2030. No private right of action.

What SaaSalyst checks

The colorado_ai_act_indicators check looks for ADMT consumer-disclosure signals on sites showing decision-automation indicators. Before January 1, 2027 it reports at most a warning, because the law isn't yet in effect; after that date, in-scope sites without detectable notice can fail.