SB 26-189 repeals and reenacts Colorado’s existing artificial intelligence consumer-protection framework to regulate the use of automated decision-making technology (ADMT) in “consequential decisions.” The bill defines ADMT broadly as technology that processes personal data and generates outputs such as predictions, rankings, scores, or recommendations used to make or assist decisions about an individual. It applies to decisions affecting access to or terms of education, employment, housing, lending, insurance, health care, and essential government services, while carving out a range of excluded tools and low-stakes uses such as spam filtering, spreadsheets without machine learning, routine scheduling, and certain cybersecurity or fraud-prevention functions.
The bill imposes new duties on both developers and deployers of covered ADMT. Developers must provide deployers with technical documentation, information about intended uses, training data categories, known limitations, and material updates, and both sides must retain compliance records for at least three years. Deployers must give consumers clear notice when a covered ADMT is used, provide a plain-language explanation after an adverse outcome, and offer a process for consumers to request personal data, correct factually incorrect or materially inaccurate data, and seek meaningful human review and reconsideration. The attorney general is directed to adopt rules to clarify the disclosure and review requirements, and the bill includes special treatment for credit, education, insurance, HIPAA-covered entities, and certain federal privacy or safety obligations.
In state law, the bill amends the Colorado Consumer Protection Act to make violations of the new ADMT requirements a deceptive trade practice and gives the attorney general exclusive enforcement authority. It also creates a 60-day notice-and-cure process before enforcement actions in many cases, requires annual reporting on enforcement and cure periods, and sunsets that reporting-related cure framework in 2030. The bill does not create a new private right of action, but it expressly preserves existing remedies under anti-discrimination, consumer protection, and product liability law. It also addresses how fault is allocated between developers and deployers in discrimination cases involving ADMT, limits indemnification provisions that would shift liability for unlawful conduct, and adds a related rulemaking provision for insurer notice and disclosure standards.
The overall sentiment reflected in the bill text and context is supportive of stronger consumer protections and greater transparency around AI-driven decisions, with an emphasis on balancing accountability and practical implementation. The measure appears to have been enacted and signed by the governor, suggesting it had sufficient legislative support to advance. The structure of the bill—especially its exemptions, delayed effective date, and rulemaking directives—also indicates an effort to make the requirements workable for businesses, schools, insurers, health-care providers, and government entities.
The main points of contention likely center on the scope of the bill and the compliance burden it creates. Developers and deployers may disagree over who is responsible when an ADMT contributes to an unlawful or discriminatory outcome, and the bill’s fault-allocation and indemnification provisions are designed to address that tension. Another likely issue is the breadth of the notice, disclosure, and human-review requirements, especially where trade secrets, federal privacy laws, or operational security concerns are implicated. At the same time, the bill narrows those obligations through exemptions for HIPAA-covered entities, insurers in certain contexts, and federally regulated activities, reflecting a compromise between consumer-rights advocates and industry or sector-specific stakeholders.
The bill substantially revises Colorado law governing automated decision-making by replacing prior AI consumer-protection provisions with a more detailed regulatory regime in Title 6. It adds new statutory duties for developers and deployers of covered ADMT, creates consumer notice and review rights, and makes violations enforceable as deceptive trade practices under the Colorado Consumer Protection Act. It also amends insurance-related law to allow the commissioner to update notice and disclosure rules, and it appropriates state funds to the Department of Law for enforcement and implementation.
The bill appears to have been generally favorable and policy-driven, with the legislature and governor supporting a framework intended to increase transparency, accountability, and consumer control over AI-assisted consequential decisions. The enacted status and absence of recorded opposition in the provided context suggest broad acceptance of the need for regulation, though the bill’s many exemptions and delayed implementation indicate sensitivity to industry concerns and administrative feasibility.
Likely areas of contention include whether the bill goes too far in regulating AI systems used in hiring, housing, lending, insurance, health care, and public benefits, and whether the notice, documentation, and human-review obligations are operationally burdensome. Developers may object to disclosure requirements that could implicate proprietary information, while deployers may resist being held responsible for decisions influenced by third-party tools. Another key issue is liability allocation: the bill limits joint and several liability, restricts indemnification clauses that would shield parties from their own misconduct, and preserves existing discrimination claims, which may be viewed as necessary consumer protection by supporters but as exposure-expanding by industry stakeholders.