Short answer
Colorado's original AI Act (SB 24-205) was repealed and replaced by SB 26-189, the Automated Decision-Making Technology (ADMT) Act, effective 1 January 2027. Developers and deployers of ADMT used in consequential decisions must give pre-use notice, an explanation of the decision, a way to correct inaccurate inputs and a human review path for adverse decisions. A conditional small-deployer exemption applies for deployers of about 40 or fewer employees.
The “Colorado AI Act” everyone wrote about in 2024 is gone. SB 24-205 would have taken full effect on 1 February 2026, but after a year of industry pushback the Colorado legislature repealed it and replaced it with SB 26-189, the Automated Decision-Making Technology Act — a tighter, more operational statute. Governor Polis signed it in May 2026. It applies to consequential decisions made on or after 1 January 2027, and the Colorado Attorney General's rulemaking is already under way.
If you're a SaaS or AI startup selling into employment, lending, insurance, education, housing, healthcare, legal, essential government services or criminal justice workflows — and some of your customers are in Colorado — this piece lays out the duties, the small-deployer exemption, the rulemaking status, and how Colorado stacks up against California's ADMT rules. For the older coverage of SB 24-205 see our Colorado and California AI laws explainer.
What was repealed and why
SB 24-205 was pitched as the first US state analogue to the EU AI Act. It took a risk-tier approach with duties on developers and deployers of “high-risk AI systems” and a 1 February 2026 effective date. Three things undermined it:
- Overlap with existing law. Several of SB 24-205's core duties duplicated the CCPA/CPRA automated-decision provisions and existing anti-discrimination law, raising preemption and clarity concerns.
- Vague risk definitions. “High-risk” was tied to a long list of use cases without clear boundaries, which small businesses complained made compliance unknowable.
- Operational cost. Impact assessment and risk management duties applied even to small deployers, which the state's own fiscal note flagged as a problem for Colorado's startup ecosystem.
SB 26-189 keeps the policy goal — protect Coloradans from opaque automated decisions in high-stakes contexts — and swaps the risk-tier structure for a decision-level duty structure: duties attach to the moment of the consequential decision, not to the category of model.
Developer or deployer: who you are matters
| Role | Who | Core duties |
|---|---|---|
| Developer | You build or materially modify an ADMT system used to make consequential decisions about Colorado residents. | Pre-sale documentation to deployers (intended uses, data types used in training, known limitations, risk-mitigation measures), update obligations when the system materially changes. |
| Deployer | You use an ADMT system to make a consequential decision about a Colorado resident, whether or not you built it. | Notice to the consumer, an explanation of adverse decisions, a correction right over inaccurate personal data used in the decision, a human-review path on request. |
A SaaS startup selling an AI-powered hiring assistant to Colorado employers is a developer; the employer who uses it to rank candidates is a deployer. Both sets of duties sit on the vendor if the vendor also uses the tool for its own hiring. Classification should be done per product, not per company.
What counts as a consequential decision
SB 26-189 is tighter than SB 24-205 on scope. A decision is “consequential” only when it has a material legal or similarly significant effect on a consumer in one of these categories:
- Employment or employment opportunity
- Education or vocational training
- Housing, including rental and real-estate
- Financial or lending services
- Insurance (including rating and underwriting)
- Healthcare and essential medical services
- Legal services
- Essential government services
- Criminal justice
Marketing, advertising, pricing optimisation that does not meaningfully affect access, and purely internal operational decisions (routing, scheduling, inventory) are outside scope. A customer-support bot that answers questions is outside scope; the same bot that decides whether an insurance claim gets paid is inside scope.
The four duties at the decision moment
SB 26-189's core design is that when an ADMT system makes a consequential decision, four things must be available to the affected consumer:
- Pre-use notice. Before (or at) the decision, the consumer is told that ADMT is being used, what categories of personal data the ADMT uses, and the role the ADMT plays in the decision.
- Explanation on adverse decision. If the decision is adverse to the consumer (denied, declined, charged more, downgraded, rejected), the deployer must give the principal reasons for the adverse decision in a way the consumer can understand.
- Correction right. The consumer can correct inaccurate personal data that the ADMT used; the deployer must re-run the decision after correction.
- Human review on request. On a timely request after an adverse decision, the consumer gets a human review (not another ADMT pass).
The practical build for most deployers is a “decision receipt” feature: a dated, logged notice shown at the decision moment, with a persistent link to explanation, correction and human-review workflows. Most teams already have the plumbing for GDPR Article 22 and CCPA opt-out; SB 26-189 is a strict superset.
The small-deployer exemption
SB 26-189 contains a conditional exemption for small deployers — reported as businesses with 40 or fewer employees — subject to limits on the volume and category of consequential decisions. The exemption does not apply to developers; building a product used by larger deployers makes you a developer regardless of your own headcount. Conditions published in rulemaking will determine whether and when the exemption falls away, so draft rules will matter here.
A pragmatic read: if you have 40 or fewer employees and you only deploy ADMT in a narrow, low-volume slice of your own operations, you may qualify. If you're a SaaS vendor whose product makes consequential decisions on behalf of customers, you are almost certainly a developer and the exemption is irrelevant.
Rulemaking status
The Colorado Attorney General's office released interim draft rules on 6 October 2026 and held a rulemaking hearing on 26 October 2026. The draft rules provide additional detail on notice content, timing of the explanation duty, what counts as an “adverse” decision, and how the small-deployer exemption is proved. Final rules are expected in advance of the 1 January 2027 effective date, though enforcement timing remains subject to pending litigation challenging aspects of the Act.
Startups should treat the interim draft as a credible preview, build to it, and expect the final rules to tighten edge cases rather than fundamentally change the shape of the duties.
Colorado vs California ADMT side by side
| Point | Colorado SB 26-189 | California ADMT (CPPA regs) |
|---|---|---|
| Effective | 1 Jan 2027 | Staggered from 2027; risk-assessment duty 1 Apr 2027 |
| Scope trigger | Consequential decisions in nine listed categories | Significant decisions and extensive-profiling use cases |
| Pre-use notice | Required | Required |
| Explanation right | Required for adverse decisions | Access right to logic and output |
| Opt-out | Human review on request | Opt-out from ADMT in significant decisions |
| Risk assessment | Deployer-side, scoped to consequential-decision use cases | Risk assessment on a staggered timeline from 2027 |
| Small-business exemption | Conditional ~40-employee deployer carve-out | Tied to CCPA applicability thresholds |
Startup checklist for 1 January 2027
- Inventory your ADMT. One row per product feature that affects a decision. Classify as consequential or not against the nine categories.
- Decide developer vs deployer per feature. This drives whose duty is whose.
- Design the decision receipt. Timestamped, logged notice at the decision moment, with a persistent link to explanation, correction and human-review workflows.
- Train support staff on human review. The human reviewer must have the authority and information to override the ADMT.
- Document pre-sale materials. If you're a developer, prepare the use-cases/limitations/risk-mitigation documentation deployers will ask for.
- Fold ADMT duties into existing CCPA ops. If you already handle CCPA access and opt-out, your request handling plumbing extends to Colorado with modest changes.
- Map to ISO 42001. ISO 42001's AI management system clauses are the cleanest internal governance frame for the ADMT duties.
For how CCPA overlaps with ADMT, see the CCPA framework page; for AI-startup playbooks, see AI startup solutions.
Frequently asked questions
Did Colorado repeal its AI Act?
Yes. SB 24-205, the "Colorado AI Act," was repealed and replaced by SB 26-189 (the Automated Decision-Making Technology Act, or ADMT Act), signed by Governor Polis in May 2026 and effective 1 January 2027. The new law covers much of the same ground but with a cleaner developer/deployer split, an explicit small-deployer exemption, and a different rulemaking pathway through the Attorney General.
When does SB 26-189 take effect?
The ADMT Act applies to consequential decisions made on or after 1 January 2027. The Colorado Attorney General held a rulemaking hearing on 26 October 2026 and released interim draft rules on 6 October 2026. Enforcement timing is subject to pending litigation and could shift.
Who does the ADMT Act apply to?
Developers (anyone who develops or materially modifies an ADMT system used to make a consequential decision about a Colorado resident) and deployers (anyone who uses an ADMT system to make such a decision). The law applies to businesses regardless of where they are headquartered as long as the decision is about a Colorado resident.
What is a consequential decision under the ADMT Act?
A decision that has a material legal, or similarly significant, effect on a consumer in employment, education, housing, financial or lending services, insurance, essential government services, healthcare, legal services or criminal justice. Marketing, advertising and purely internal operational decisions are generally outside scope.
Is there a small-business exemption?
The ADMT Act contains an exemption for small deployers meeting specific criteria (reported as 40 or fewer employees under limited conditions). Developers do not benefit from this exemption. Companies at or near the headcount threshold should map against the statute carefully — qualification is conditional on how much the ADMT system is used and in what categories.
How does the ADMT Act compare to California's ADMT rules?
California's ADMT regulations (finalised under the CPPA) impose pre-use notice, access and opt-out rights for ADMT used in significant decisions, with risk assessments on a staggered timeline from 2027. Colorado adds a stronger notice-at-decision-time duty, an explanation right, a correction right and a human-review right for adverse decisions. Running both on one ADMT inventory is standard practice for US-national SaaS vendors.
Run the ADMT Act with your existing privacy program
LowerPlane maps Colorado SB 26-189, California ADMT, EU AI Act Article 50 and ISO 42001 onto one AI inventory so a single evidence base answers every US and EU buyer. See AI startup solutions or compare pricing on /pricing/.