Colorado AI Act Scope Checker (SB 26-189)

Quick answers

Does the Colorado AI Act (SB 24-205) apply to my AI system?

SB 24-205 no longer exists as operative law: it was repealed and replaced by SB 26-189 before its June 30, 2026 start date ever arrived. The live question is whether your system is a “covered ADMT” under SB 26-189 for decisions on or after January 1, 2027.

If your technology processes personal data, produces predictions, rankings, scores or recommendations that materially influence decisions about education, employment, housing, lending, insurance, health care or essential government services for Colorado consumers, the SB 26-189 documentation, notice and human-review duties are the ones to plan for — not the repealed act’s impact assessments.

What does SB 26-189 require, in one paragraph?

Developers must give deployers technical documentation (intended uses, training-data categories, known limitations, human-review instructions) and flag material updates. Deployers must notify consumers at the point of interaction, explain the ADMT’s role in plain language within 30 days of an adverse consequential decision, and honour requests for data access, correction and meaningful human review. Both sides keep compliance records for at least 3 years.

The Attorney General enforces the act as a deceptive trade practice under the Colorado Consumer Protection Act, with a 60-day cure opportunity before January 1, 2030, and the act creates no new private right of action.

When does the Colorado ADMT law take effect?

January 1, 2027. SB 26-189 applies to consequential decisions made on or after that date; its duties are not retroactive to 2026 decisions, and the predecessor act it repealed never became operative at all.

The Attorney General was directed to adopt clarifying rules by January 1, 2027; an interim draft of 4 CCR 904-6 was published during 2026, so the rule text — not the statute’s scope — is the part still moving.

How to use

1. Answer for one system at a time — a company can be a developer of one tool and a deployer of another, and the duties differ.
2. Question 3: tick every decision area the output feeds into (the seven consequential-decision areas in SB 26-189). Question 4 is the material-influence test — answer by what the output actually does in the workflow, not what the brochure calls it.
3. Read your tier, the duty list it generates, and the key-dates table below. Copy the result link if you need to share the assessment — it encodes only these five answers.

About this tool

The shift matters for anyone searching “Colorado AI Act” today: most summaries on the internet still describe the repealed high-risk framework. Under the live law there are no impact assessments and no risk-management programs. There is a developer duty to hand deployers honest technical documentation, a deployer duty to tell consumers — at the point of interaction, and again within 30 days of an adverse decision — what the ADMT did, consumer rights to see and correct their data and to ask for meaningful human review, and a 3-year record-keeping duty on both sides.

This checker walks the enacted scope test in order: Colorado connection, your role, a consequential-decision area, and material influence. It answers in the only honest register a five-question tool can use — likely in scope, possibly in scope, likely out — because the Attorney General’s implementing rules (4 CCR 904-6) were still in interim draft when the page was last verified, including a draft presumption about when an output “materially influences” a decision.

How it works

Scope under SB 26-189 is a conjunction of four things: (1) a person doing business in Colorado, deciding about Colorado consumers; (2) a technology that processes personal data and uses computation to generate output — predictions, recommendations, classifications, rankings, scores or other information — used to make, guide or assist a decision about an individual (the statutory definition of “automated decision-making technology”); (3) the output is used to materially influence a decision; and (4) the decision is a “consequential decision” — access, eligibility or compensation in education, employment, housing, financial or lending services, insurance, health-care services, or essential government services and public benefits. An ADMT meeting all four is a “covered ADMT”, and the developer/deployer duties attach to it for decisions on or after January 1, 2027.

The act deliberately drops the repealed act’s machinery: no “high-risk” classification, no reasonable-care duty, no risk-management program, no impact assessments. What replaces them is a transparency chain. Developers document (intended uses, training-data categories, known limitations, human-review instructions) and report material updates. Deployers notify (clear and conspicuous, at the point of interaction) and explain (plain language, within 30 days of an adverse outcome). Consumers can request their personal data, correct factually incorrect data, and request meaningful human review and reconsideration. Both developers and deployers retain compliance records for at least 3 years.

Two qualifiers keep this checker honest. First, the Attorney General’s implementing rules (4 CCR 904-6) were in interim draft at last verification, including a proposed rebuttable presumption that an output materially influences a decision when it constrains the options, sets a threshold, or produces a rank/score/classification/recommendation that is reviewed and consistent with the outcome. Second, specified regulated entities are exempt to the extent they comply with equivalent obligations under other law. Either can move a borderline case, which is why the middle tier exists.

Worked examples

Resume-ranking vendor sells to Colorado employers: A vendor’s tool scores and ranks job applicants; recruiters review the ranking and interview from the top. Employment is a consequential-decision area, the ranking materially influences who gets interviewed, and Colorado applicants are affected. Result pattern: likely in scope — the vendor owes deployers technical documentation, and each employer-deployer owes applicants point-of-interaction notice and a 30-day post-adverse-decision explanation.

Scheduling assistant inside a clinic: A clinic uses a tool that books appointments and sends reminders; it never affects who receives care, in what order of priority, or on what terms. Health care is a listed area, but the output does not materially influence a consequential decision about care. Result pattern: likely out of scope for covered ADMT — re-check if triage or prioritisation is ever added.

White-label credit pre-screen: A lender offers a partner’s scoring API under its own brand to pre-screen Colorado loan applicants. The lender looks like a deployer, the partner like the developer — but branding and contract terms can shift who counts as which, and both duty sets may be argued. Result pattern: possibly in scope — needs legal review.

Key dates & data passport

Frequently asked questions

More free tools