Colorado passed SB 26-189 on 9 May 2026 and signed it on 14 May. It repeals SB 24-205 — the 2024 Colorado AI Act — which was deferred twice and never once took effect. From 1 January 2027 the duties attach to consequential decisions, and to nothing else on the list beside them.
COLORADO SB 26-189 · ADMT · FROM 1 JAN 2027
The Colorado AI Act your team planned for no longer exists.
What replaced it binds the deployer, not the tool - four duties, live 1 January 2027, and considerably narrower than the Act it repealed.
ADMT
Covered ADMT
Consequential decision
Adverse outcome
Meaningful human review
Our promise
“Reasonable care is a claim. Testing is evidence.”
Every finding is written against a clause of the instrument itself — defensible line by line, to anyone who asks. The fee is fixed at $12,500, and nothing is charged until you approve it.
- Each additional system
- $3,000
- Re-audit, same scope
- $8,000
- Renewal, every twelve months
- $10,500 locked
This costs more than the estate ladder, and it should. The ladder is a private assessment written for you. A framework audit produces a published summary iDharma maintains for twelve months - a notice template where the law requires one, a 60-day expiry warning, and a quarterly check that the summary is still live and still linked.
Request this auditThe case file
Colorado’s AI law, in three chapters
Most teams are on the wrong side of the repeal in one of two directions: still finishing an impact assessment nothing asks for, or hearing “repealed” and stopping there. The replacement is narrower, not absent, and not quick to build from a standing start in eighteen months.
Our readiness review is built for the statute that binds you now. We inventory the technology sitting in your decision paths, record the materially-influences call system by system, and hand you the notices, the review route and the retention rule itself, written to the statute.
What is ADMT?
Technology that decides before you do.
Technology that scores or ranks people, and materially influences a consequential decision.
- Deployers deciding about a Colorado consumer
- Developers who build or substantially modify ADMT
- Employers and HR platforms — no carve-out reaches them
- Businesses outside Colorado, where the consumer is inside it
- Before use — clear, conspicuous point-of-interaction notice
- An adverse outcome — plain-language disclosure, in 30 days
- On request — meaningful human review, and data correction
- For three years from each consequential decision — records
Whose duty is it
The duty is yours. The technology is theirs.
The deployer who makes the decision
SB 26-189 binds whoever uses the technology to make or materially influence the consequential decision. Notice before use, disclosure after an adverse outcome, the review route and the three-year record are yours - and none of them can be discharged by anyone else in the chain.
The people who built the technology
Owes documentation, not your disclosures: intended uses, known harmful uses, training-data categories, the limitations - and notice when the system is substantially modified. Good documentation makes your duties possible to discharge; it does not perform them on your behalf, and never has.
Where a carve-out actually stops
Insurance, HIPAA, FDA and ECOA/FCRA carve-outs all exist, and every one of them is a subject-matter carve-out rather than a blanket exemption. None reaches employment decisions. An insurer screening its own job applicants is a deployer like any other, and is treated exactly as one.
What most teams assume
“Colorado repealed its AI law - nothing to do.”
What the statute says
It was replaced. The duties start 1 January 2027.
It is the most common finding we write up.
- Who it is for
- Employers & HR platforms
- Lenders & fintech
- Insurers
- Housing & tenant screening
- Health systems
- Ed-tech & admissions
Why this matters in 2027
02
The sixty-day cure period is not a grace period you can plan around — it falls away entirely for knowing or for repeated violations.
03
There is no private right of action, which narrows who can sue you. It does not narrow a single one of the things you actually owe.
04
Your notice is public by design. Anyone at all can read what you tell consumers and check it against what the system actually does.
The 60-second check
Three questions. Then you’ll know.
No email, no signup. A starting point, not a determination.
Opens in a panel. Close it any time - your answers are kept.
Colorado SB 26-189
Your scope check
The calendar
Four duties, each on its own clock.
Three of these are measured against a moment you do not choose - so they cannot be added up, and they cannot be run in parallel.
-
Notify
Before useClear and conspicuous notice at the point of interaction - before the technology touches the decision.
-
Disclose
Within 30 daysPlain language within 30 days of an adverse outcome: what was decided, and the part the technology played in it.
-
Review
On requestMeaningful human review, and a route to correct inaccurate data. Both where commercially reasonable.
-
Retain
Three yearsThe clock runs from each consequential decision, not your reporting year. Overwrite it and it is gone.
The trap
Only the disclosure can be written after the fact. The notice has to be live in front of first use, the review route has to exist before somebody asks for it, and the record has to have been kept from the decision itself - which is the one nobody can go back for.
Requirement & coverage
What the statute says, what we ship
12 obligations, and the artefact that discharges each one. Paired, so every claim on this page can be checked.
- Whose obligation it is Deployer or developer - and they are different duties
- A written determination of who owes what for each system, so a developer's documentation is never mistaken for your notice.
- Exemption position Insurance, HIPAA, FDA, ECOA/FCRA - and where each stops
- A written position on every carve-out you rely on, including the decisions it does not reach.
- ADMT inventory What you run, and where it touches a decision
- A register with owners, vendors, domains and the materiality call recorded against each entry.
- Covered-ADMT classification “Materially influences” is the test
- A written classification per system with its reasoning, so the borderline calls survive being asked about.
- Developer documentation pack Intended uses, harmful uses, training data, limitations
- A drafted pack per model, and a gap list against what your vendors currently supply.
- Material-update notice Deployers told of substantial modifications
- A change-notification clause and a trigger definition your release process can actually follow.
- Point-of-interaction notice Clear, conspicuous, before use
- Notice copy per channel, where it sits in the journey, and who owns the wording.
- Adverse-outcome disclosure Plain language, within 30 days
- A template disclosure and the operational trigger that starts the 30-day clock.
- Consumer information request System name, version, developer, data types and sources
- A response pack per system and one intake route, so answers do not vary by who replies.
- Meaningful human review Designated, trained, able to override
- A review procedure, the reviewer brief, and the evidence the reviewer sees before deciding.
- Data correction route Factually inaccurate personal data
- A correction workflow with a recorded outcome, and the boundary against opinions and scores written down.
- Three-year records From each consequential decision
- A retention schedule mapped to your systems of record, with the deletion rule stated rather than assumed.
The engagement
Decision technology, independently reviewed
From CV screening to credit decisioning.
-
Inventory
Which systems sit in a decision path, and which decisions they touch.
-
Classify
The materially-influences call, recorded per system with its reasoning.
-
Sign off and build
You see the draft first. Then the notices, the review route and the retention rule.
Struck in your favour
Why deployers choose iDharma for Colorado
We track the statute
This page was rewritten the week SB 26-189 replaced the Act, and it says where a call is arguable.
Independent of vendors
We resell none of the tools in your decision path and take no fee from the platforms inside it.
One review, several laws
The inventory and the classification carry into the EU AI Act, NIST AI RMF and LL 144 scopes.
Artefacts, not a deck
The register, the classification memo, the notice copy - in formats you can actually put to use.
Four marks, struck on every review.
Deliverables
What you get
Concrete artefacts, each with a name and a format - you know what lands before you buy.
Readiness review report
The full review in one document: every system in a decision path with its owner, vendor and materiality call, the covered-ADMT judgement written with its reasoning, the four duties tested against the artefacts you already hold, and a ranked list of what has to exist before 1 January 2027.
ADMT register
Every system in a decision path with its owner, vendor, domain and materiality call, in a workbook your own teams can keep current after we go.
Covered-ADMT classification
The materially-influences call for each system, written with its reasoning, so a borderline judgement survives being asked about a year later.
Notice & disclosure pack
Point-of-interaction notice per channel and the adverse-outcome disclosure, drafted in plain language and checked for accessibility.
Human-review procedure
Who reviews, what they see before deciding, and the override authority that makes “meaningful” do the work the statute asks of it.
Retention schedule
Three years from each decision, mapped onto your systems of record, with the deletion rule written down rather than left to a default.
Carve-out position
Whether the insurance, HIPAA, FDA or ECOA/FCRA carve-out you rely on reaches the decisions you are relying on it for - and where it stops.
Format & fee
Real numbers, upfront.
- Scope
- Set by the statute, not by us
- Input
- Your systems and their vendors
- Re-review
- On material change - $10,500 against your known baseline
The statute fixed the scope, not us, so the fee is flat - nothing to meter, and nothing charged until you approve.
Request this review
SB 26-189 · Named engagement
$12,500 flat
- ADMT register across your decision paths
- Covered-ADMT classification, reasoned
- Notice and 30-day disclosure drafts
- Human-review procedure and retention
Show your hand
Four things you have to be able to produce
SB 26-189 is not graded on intent. Each of these is either in your hand on the day someone asks, or it is not.
The register,
current
Every system in a consequential decision path, with the materiality call recorded against each one. You cannot give notice about a technology you have not found.
The notice,
before use
Clear and conspicuous, at the point of interaction, and issued before the technology ever touches the decision. A notice given once the decision is made is not notice.
The disclosure,
in 30 days
After an adverse outcome, in plain language: what was decided, and what part the technology played. The clock starts running at the outcome, not at the complaint.
The record,
three years
Notices as issued, review requests and what was done about them, held three years from each decision. The record is the evidence, not the assurance.
Four cards, and the date on each one is part of the card.
FAQ
Plain answers
What the law is now, what you owe, and when. Answered straight.
Request this reviewIs the Colorado AI Act still law?
No. SB 24-205 was repealed by SB 26-189 on 14 May 2026 and never took effect for a single day - its start date had already moved from 1 February 2026 to 30 June 2026 before the repeal landed.
What replaced it, and when does it bite?
SB 26-189, signed 14 May 2026, applying to consequential decisions made on or after 1 January 2027. It is built on disclosure and consumer rights rather than risk management and a duty of care.
What makes ADMT “covered”?
It materially influences a consequential decision - the output is a non-trivial factor in the outcome. A system that only formats or routes work is not covered; one whose score decides who progresses is.
What does a deployer actually have to do?
Four things: notice before covered ADMT is used; plain-language disclosure within 30 days of an adverse outcome; a route to correct data and request meaningful human review; and records kept three years from the decision.
What are the penalties?
A violation is a deceptive trade practice under the Colorado Consumer Protection Act, carrying civil penalties of up to $20,000 per violation. The Attorney General enforces alone, a 60-day cure period applies, and there is no private right of action.
Get started
Request your readiness review
Tell us where automated decisions happen and we come back with a scoping call within one business day.
What we need from you
Nothing you do not already have. Most of this comes out of your existing system inventory in an afternoon, and we tell you exactly which extracts before you commit.
- Which systems sit in a decision path, and at which stage
- Whether those decisions touch a Colorado consumer
- Which of the eight consequential domains it touches
- What documentation your vendors already supply
- Your target readiness date, if you have one
What happens next
- You send the five items we need.
- A scoping call, within one business day.
- Nothing is charged until you approve the scope.
Sources & standing
Where this page gets its facts
Where the claims on this page come from, and what they are worth - stated, not assumed.
What it is drawn from
- SB 26-189, Colorado General Assembly
- SB 24-205 (repealed), and SB 25B-004
- Signed
- 14 May 2026
- Applies from
- 1 January 2027
What it means
- General information about what the statute requires — not legal advice, and no professional relationship arises from it. It determines nothing about your own systems.
- Where a scope question is arguable, our reports say so rather than the convenient one.
Scope & limitation
- Written against secondary analyses of the bill, not the enrolled text. Do not rest a binding decision on it; engage qualified counsel.
- It covers SB 26-189 alone - other state and federal rules can reach the same system.
- Use it as a starting point for a scoping conversation, not as your final word.
Something on this page out of date?
Tell usFrom Insights
Before you commission one
How to Prepare for an AI Audit: The Readiness Checklist
Six things to have ready before the engagement starts. Assembling them takes a fortnight off the clock — and tends to find the first two findings before an auditor does.
Read the notes
METHODOLOGY NOTES
What Is an AI Audit? Scope, Standards, and What You Get
An independent review of what your AI actually does, measured against a named standard — not a certificate, and not a review of what the documentation says it does.
STANDARDS EXPLAINED
What an AI Governance Framework Actually Contains
Five working parts, not a policy document. What each one has to do, how to tell whether yours is real, and why a framework is not the same thing as compliance.
STANDARDS EXPLAINED
Colorado SB 26-189: Four Duties, and the One Nobody Budgets For
Notice before, disclosure after, human review on request, records for three years. Three are policy changes. The second is an engineering project, and it arrives late.
