The act allows the joint technology committee (JTC), within 90 days after the day that the chief information security officer of the office of information technology (security officer) files a written information technology security compliance report (compliance report) with the JTC as required by the act, to vote to request that the legislative audit committee direct the state auditor to conduct a special information technology security audit (IT security audit) of the office of information technology (OIT) if the compliance report indicates that one or more audit recommendations made by the state auditor is unresolved 2 or more years past the implementation date for the audit recommendation or if a material discrepancy exists between a representation in the compliance report and a previous audit finding. If the JTC votes to request an IT security audit and if the legislative audit committee votes to direct the audit, the act requires:The state auditor to conduct the IT security audit;The state auditor to obtain input from OIT when the state auditor determines the scope and boundaries of the audit;The state auditor to submit the IT security audit report to the legislative audit committee, the JTC, the joint budget committee, and the governor; andOIT to reimburse the state auditor for the auditor's costs incurred in completing the IT security audit. The act requires OIT to establish, maintain, keep, update, and make available to state agency information technology leadership and the members of the JTC a list of all active information technology vendor contracts for state agencies. The act specifies that, except in the case of an information technology security emergency, OIT shall not publish or implement a technical information technology standard, and that the standard is void, unless the standard:Was publicly posted; andReceived approval from the security officer if the standard relates to security, access controls, or the handling of data. The act requires OIT to ensure that, if an information technology contract provides ongoing service and delivery to Coloradans, the contract maintains current architecture diagrams that are updated at least annually. The act prohibits the chief information officer from delegating a duty, responsibility, or power of the security officer. The act requires the security officer to submit 2 annual reports to the JTC. The first report is a written compliance report that includes OIT's current compliance status with applicable security standards; all open audit recommendations regarding OIT made by the state auditor and the date on which each recommendation was made; and a timeline for remediation and a mitigation plan or compensation controls for each open audit recommendation made by the state auditor. The second report is a written statewide information technology security risk report (security risk report) that assesses the overall security risk posture of state agency information technology systems. To support the preparation of the security risk report, the security officer may conduct evaluations of state agency information technology systems, including penetration testing, vulnerability scanning, configuration evaluations, and vendor and system reviews. Each state agency shall provide to the security officer, upon request, the access and information necessary to conduct evaluations of state agency technology systems, including system access, product information, and architecture information. The act requires the security officer, or the chief information officer if the security officer is unavailable, to perform the duties and uphold the responsibilities assigned to the security officer pursuant to law.(Note: This summary applies to this bill as enacted.)

The act makes various updates to language in the 'Workers' Compensation Act of Colorado' to align with technology changes in the division of workers' compensation in the department of labor and employment. These updates include changing current statutory language requiring mailing of documents to allow for electronic mailing or filing of the documents. The act also changes the fund into which an employer or employer's insurance carrier makes payments to the state for a compensable injury resulting in death of a minor without surviving parents from the subsequent injury fund to the Colorado uninsured employer fund.(Note: This summary applies to this bill as enacted.)

The act creates the commission on medicaid (commission) to develop recommendations regarding implementation of new federal medicaid policy changes that go into effect in 2026, 2027, and 2028 and to support Coloradans impacted by those policy changes. The commission is required to:Convene at least 6 times but no more than 12 times between May 14, 2026 and December 11, 2026;Invite relevant state agency representatives and medicaid stakeholders to present and provide feedback on commission recommendations; andContract with a technical advisor to assist the commission in writing and submitting a report to the general assembly and the governor documenting the commission's process and any recommendations by December 11, 2026. The act appropriates $500,000 to the legislative department from the general fund to implement the act.(Note: This summary applies to this bill as enacted.)

In 2024, the general assembly enacted Senate Bill 24-205, which created consumer protections in interactions with artificial intelligence systems. The act repeals and reenacts those provisions with new requirements regarding the use of automated decision-making technology in consequential decisions. The act defines an 'automated decision-making technology' (ADMT) as a technology that processes personal data and uses computation to generate output, including predictions, recommendations, classifications, rankings, scores, or other information that is used to make, guide, or assist a decision, judgment, or determination concerning an individual. The act defines a 'consequential decision' as a decision that relates to an individual's access to, eligibility for, or compensation related to education, employment, housing, financial or lending services, insurance, health-care services, or essential government services and public benefits. The act requires the developer of an ADMT (developer) that is used to materially influence a consequential decision (covered ADMT), starting January 1, 2027, to provide a deployer of a covered ADMT (deployer) with technical documentation describing the covered ADMT's intended uses, categories of training data, known limitations, and instructions for appropriate use and human review. Developers must notify deployers of material updates or modifications to the covered ADMT. Both developers and deployers are required to retain records necessary to demonstrate compliance with the act for at least 3 years. The act establishes consumer notice requirements, mandating that deployers provide clear and conspicuous notice to consumers at the point of interaction with a covered ADMT. A deployer is required to provide a consumer with a plain language description of a covered ADMT's role within 30 days after the covered ADMT makes a consequential decision that results in an adverse outcome for the consumer. The attorney general must adopt rules to clarify these post-adverse outcome disclosure requirements by January 1, 2027. Consumers have the right to request personal data and correction of factually incorrect personal data used by a covered ADMT. The act also grants consumers the right to request meaningful human review and reconsideration following a covered ADMT making a consequential decision resulting in an adverse outcome. The attorney general is directed to enforce the act through the 'Colorado Consumer Protection Act', and a violation of the act is deemed a deceptive trade practice. Before initiating an action before January 1, 2030, the attorney general must provide the developer or deployer with a 60-day notice and opportunity to cure the alleged violation, if a cure is deemed possible. The act does not create a new private right of action but establishes how fault is allocated between developers and deployers in civil actions alleging unlawful discrimination under existing law. Specified entities are exempted from the requirements of the act to the extent the entities comply with other legal obligations.(Note: This summary applies to this bill as enacted.)

No later than July 1, 2026, the department of health care policy and financing (HCPF) shall convene a steering committee (steering committee) to support the transition of services provided in qualified residential treatment programs (QRTP) and psychiatric residential treatment facilities (PRTF) to the managed care system for members in the care and custody of a county department of human or social services (county department). No later than April 1, 2027, HCPF, in collaboration with the steering committee, shall develop policies and recommendations to support the transition of QRTP and PRTF to the managed care system for members in the care and custody of a county department. No later than July 1, 2027, HCPF shall implement or initiate the transition of services provided in QRTP and PRTF to the managed care system for members in the care and custody of a county department according to the policies and recommendations developed by HCPF in collaboration with the steering committee. HCPF shall submit quarterly reports to the joint budget committee with information about the steering committee's monthly meetings.(Note: This summary applies to this bill as enacted.)

The act clarifies that video and audio recordings (recordings) depicting an incident of a peace officer's use of force that resulted in death (incident) must be provided to the decedent's immediate family within 21 days after the incident regardless of whether there is a complaint of peace officer misconduct for the incident. The act requires the multi-agency team investigating the incident or the law enforcement agency that employs the peace officer who used force in the incident to notify the decedent's immediate family about the multi-agency team investigation into the incident within 24 hours after the scene of the incident is cleared. The notification must include the names of the law enforcement agencies that comprise the multi-agency investigating team and the status of the investigation. The act prohibits a peace officer participating in the investigation of a criminal matter involving an incident from making an extrajudicial statement on behalf of a law enforcement agency that the peace officer knows or reasonably should know will be disseminated by means of public communication and will have a substantial likelihood of materially prejudicing an adjudicative proceeding on the matter. Video of an incident produced for purposes of a community or critical incident briefing must include certain disclaimers, and narration or commentary must be limited to the facts of the incident.(Note: This summary applies to this bill as enacted.)

If the executive director of the department of health care policy and financing (state department) receives gifts, grants, and donations for the purpose of providing support for the development and funding of an enhanced reimbursement model for nursing facilities that serve residents with behavioral health needs, the state department is required to use the gifts, grants, and donations for that purpose. Receiving gifts, grants, and donations for this purpose does not commit the state to an expenditure of general fund money, and the general assembly shall not reduce any appropriation made to the state department for the same purpose. If requested by the joint budget committee, the state department is required to report the state department's use of the gift, grants, and donations received.(Note: This summary applies to this bill as enacted.)

The producer responsibility program for statewide recycling (program) provides recycling services to covered entities in the state and is financed through annual dues assessed against producers of products that use packaging materials and paper products (producers). The bill reaffirms the authority of the solid and hazardous waste commission in the department of public health and environment (department) to direct an appeals process whereby producers may contest the program dues assessed against them by requesting a hearing before the producer responsibility program for statewide recycling advisory board (advisory board). If a producer requests a hearing before the advisory board, the advisory board is required to hold the hearing and issue written recommendations to the department as to whether the dues assessed against the producer should be adjusted. The department is required to make a determination whether to approve or reject the advisory board's recommendations regarding the assessed dues within 45 days after receiving the advisory board's recommendations on the matter. The department's determination is a final agency action subject to judicial review.(Note: This summary applies to the reengrossed version of this bill as introduced in the second house.)