Automated Decision-Making Technology
SB189 creates a new Colorado framework regulating the use of automated decision-making technology (ADMT) when it materially influences “consequential decisions” affecting consumers. The bill defines ADMT, consequential decisions, covered domains, developers, deployers, and related terms, and it carves out a number of exclusions for routine or low-stakes tools, cybersecurity and fraud-prevention systems, certain educational functions, and some health and insurance-related uses. It also sets out when a system is considered to “materially influence” a decision and when a person is treated as a developer or deployer under the law.
The bill imposes documentation, notice, recordkeeping, and consumer-rights obligations on developers and deployers beginning January 1, 2027. Developers must provide deployers with information about intended uses, training data categories, known limitations, appropriate use, and material updates. Deployers must notify consumers before using covered ADMT in consequential decisions and provide additional disclosures after adverse outcomes, including how to request more information. Consumers who suffer an adverse outcome may request correction of materially inaccurate personal data and an opportunity for meaningful human review and reconsideration, subject to limits and existing law. Enforcement is assigned exclusively to the attorney general under the Colorado Consumer Protection Act, with a cure period for many violations, no new private right of action, and annual reporting requirements that sunset in 2030.
The bill also amends Colorado’s deceptive trade practices law to make violations of the new ADMT provisions a deceptive trade practice, and it adds a rulemaking provision for the attorney general to clarify implementation. Separate provisions address insurers, HIPAA-covered entities, and medical devices, generally preserving existing federal privacy and regulatory regimes while requiring some notices or disclosures in limited circumstances. The bill includes an appropriation of $46,190 to the Department of Law for implementation.
Overall, the voting record suggests broad bipartisan support. The bill advanced through Senate and House committees unanimously or near-unanimously, and it passed third reading in both chambers with large majorities. The final Senate concurrence on House amendments was also overwhelmingly favorable, indicating that the legislature viewed the measure as a significant but workable consumer-protection and transparency bill for AI-driven decisions.
The main points of contention appear to center on the scope of regulation, the burden on businesses, and how much disclosure is feasible without revealing trade secrets or conflicting with federal law. The bill responds to those concerns by excluding many routine tools, limiting disclosure of proprietary information, providing exceptions for HIPAA, GLBA, and certain insurance and medical-device contexts, and allowing the attorney general to tailor rules by sector. The presence of a cure period and the absence of a private right of action also suggest an effort to balance consumer protections with compliance flexibility for developers and deployers.
SB189 would add a new part 17 to title 6, article 1 of the Colorado Revised Statutes governing automated decision-making technology used in consequential decisions. It expands the state’s deceptive trade practices law to cover violations of these ADMT requirements, authorizes attorney general enforcement, and creates new duties for developers and deployers involving documentation, consumer notice, post-adverse-outcome disclosures, record retention, correction of inaccurate personal data, and meaningful human review. The bill also interacts with insurance, education, health care, and financial services law by creating sector-specific exceptions and cross-references, while preserving federal privacy and regulatory requirements. It takes effect January 1, 2027, with some rulemaking and appropriation provisions effective upon passage.
The overall sentiment around SB189 appears strongly favorable and policy-driven, with broad bipartisan support in both chambers and no recorded committee opposition in the provided voting history. The bill was advanced repeatedly with unanimous or near-unanimous committee votes and passed floor votes by wide margins, suggesting lawmakers generally supported the goal of increasing transparency and accountability for AI-assisted consequential decisions. The limited number of dissenting votes on third reading indicates some reservations, but not enough to prevent passage.
The likely areas of contention are the breadth of the ADMT definition, the compliance burden on businesses that use algorithmic tools in hiring, lending, insurance, education, health care, and public benefits, and the risk of exposing proprietary or sensitive information. Developers and deployers may be concerned about recordkeeping, notice obligations, and the requirement to provide meaningful human review after adverse outcomes. Consumer advocates are likely to support the bill’s transparency and correction rights, while industry stakeholders may have pushed for the bill’s many exclusions, federal-law carveouts, trade-secret protections, and the attorney general’s rulemaking authority to clarify ambiguous terms such as “materially influence.”